# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 11.07.2020 13:39:10.024 Process: id = "1" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x15385000" os_pid = "0x11a8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x119c [0041.701] GetProcessHeap () returned 0x130000 [0041.701] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x30) returned 0x1432d0 [0041.701] GetProcessHeap () returned 0x130000 [0041.701] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x3310) returned 0x150520 [0041.707] GetProcessHeap () returned 0x130000 [0041.707] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x300) returned 0x142b08 [0041.707] GetProcessHeap () returned 0x130000 [0041.707] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f888 [0041.707] GetTickCount () returned 0x114c1ab [0041.707] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x115f920, cchData=32 | out: lpLCData="\x03") returned 16 [0041.708] GetProcessHeap () returned 0x130000 [0041.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f870 [0041.708] GetProcessHeap () returned 0x130000 [0041.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14e180 [0041.708] GetProcessHeap () returned 0x130000 [0041.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14e968 [0041.708] GetProcessHeap () returned 0x130000 [0041.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14eb80 [0041.708] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14eb80, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0041.708] GetProcessHeap () returned 0x130000 [0041.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14eb80 | out: hHeap=0x130000) returned 1 [0041.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.708] GetProcessHeap () returned 0x130000 [0041.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0041.708] GetProcessHeap () returned 0x130000 [0041.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e968 | out: hHeap=0x130000) returned 1 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f870 | out: hHeap=0x130000) returned 1 [0041.709] GetVersion () returned 0x23f00206 [0041.709] GetCurrentProcess () returned 0xffffffff [0041.709] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x115f8b4 | out: TokenHandle=0x115f8b4*=0x1fc) returned 1 [0041.709] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x14, TokenInformation=0x115f8ac, TokenInformationLength=0x4, ReturnLength=0x115f8b0 | out: TokenInformation=0x115f8ac, ReturnLength=0x115f8b0) returned 1 [0041.709] CloseHandle (hObject=0x1fc) returned 1 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x13b0c8 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14e180 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14e968 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e968 | out: hHeap=0x130000) returned 1 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x13aec0 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x13af10 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x14ed58 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0041.709] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13af10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ed58 | out: hHeap=0x130000) returned 1 [0041.709] GetProcessHeap () returned 0x130000 [0041.709] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x13aec0 | out: hHeap=0x130000) returned 1 [0041.709] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x115f86c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x115f86c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.710] GetProcessHeap () returned 0x130000 [0041.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x13af10 | out: hHeap=0x130000) returned 1 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x30) returned 0x143458 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x2a) returned 0x143228 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x143228, Size=0x52) returned 0x141880 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x143458 | out: hHeap=0x130000) returned 1 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141880 | out: hHeap=0x130000) returned 1 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1c) returned 0x13aec0 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1c) returned 0x13af10 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x14ef88 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x14f0a0 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x14efb0 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0041.711] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x14f0a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14efb0 | out: hHeap=0x130000) returned 1 [0041.711] GetProcessHeap () returned 0x130000 [0041.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ef88 | out: hHeap=0x130000) returned 1 [0041.711] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x115f854, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x115f854*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f0a0 | out: hHeap=0x130000) returned 1 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142470 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1426f8 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1426f8, Size=0x72) returned 0x142140 [0041.712] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0041.712] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x1fc [0041.712] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142470 | out: hHeap=0x130000) returned 1 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142140 | out: hHeap=0x130000) returned 1 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x14f118 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x14efb0 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x14eee8 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0041.712] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x14efb0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14eee8 | out: hHeap=0x130000) returned 1 [0041.712] GetProcessHeap () returned 0x130000 [0041.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f118 | out: hHeap=0x130000) returned 1 [0041.712] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x115f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x115f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14efb0 | out: hHeap=0x130000) returned 1 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142470 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142938 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142938, Size=0x72) returned 0x142140 [0041.713] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0041.713] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x200 [0041.713] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142470 | out: hHeap=0x130000) returned 1 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142140 | out: hHeap=0x130000) returned 1 [0041.713] ReleaseMutex (hMutex=0x200) returned 1 [0041.713] CloseHandle (hObject=0x200) returned 1 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x30) returned 0x1433e8 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14f170 [0041.713] GetVersion () returned 0x23f00206 [0041.713] GetProcessHeap () returned 0x130000 [0041.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14ec50 [0041.713] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0041.713] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0041.713] Wow64DisableWow64FsRedirection (in: OldValue=0x115f890 | out: OldValue=0x115f890*=0x0) returned 1 [0041.713] GetProcessHeap () returned 0x130000 [0041.714] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ec50 | out: hHeap=0x130000) returned 1 [0041.714] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x756e0000 [0041.714] GetProcAddress (hModule=0x756e0000, lpProcName="CreateProcessWithTokenW") returned 0x756f0c70 [0041.714] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14f170, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0041.714] GetShellWindow () returned 0x100f0 [0041.714] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x115f89c | out: lpdwProcessId=0x115f89c) returned 0x5cc [0041.714] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x560) returned 0x200 [0041.714] OpenProcessToken (in: ProcessHandle=0x200, DesiredAccess=0x2000000, TokenHandle=0x115f8ac | out: TokenHandle=0x115f8ac*=0x204) returned 1 [0041.714] DuplicateTokenEx (in: hExistingToken=0x204, dwDesiredAccess=0x2000000, lpTokenAttributes=0x115f874, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x115f8b0 | out: phNewToken=0x115f8b0*=0x208) returned 1 [0041.715] CreateProcessWithTokenW (in: hToken=0x208, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x115f828*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x115f880 | out: lpCommandLine=0x0, lpProcessInformation=0x115f880*(hProcess=0x244, hThread=0x248, dwProcessId=0x1184, dwThreadId=0x1180)) returned 1 [0041.891] GetProcessHeap () returned 0x130000 [0041.891] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14ea98 [0041.891] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0041.892] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x772e6b50 [0041.892] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0041.892] GetProcessHeap () returned 0x130000 [0041.892] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ea98 | out: hHeap=0x130000) returned 1 [0041.892] CloseHandle (hObject=0x200) returned 1 [0041.892] CloseHandle (hObject=0x244) returned 1 [0041.892] CloseHandle (hObject=0x248) returned 1 [0041.892] CloseHandle (hObject=0x204) returned 1 [0041.892] CloseHandle (hObject=0x208) returned 1 [0041.892] GetProcessHeap () returned 0x130000 [0041.892] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f170 | out: hHeap=0x130000) returned 1 [0041.892] GetProcessHeap () returned 0x130000 [0041.892] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1433e8 | out: hHeap=0x130000) returned 1 [0041.892] Sleep (dwMilliseconds=0x1388) [0046.929] GetProcessHeap () returned 0x130000 [0046.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xd0) returned 0x14c338 [0046.929] GetProcessHeap () returned 0x130000 [0046.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xc3) returned 0x142e98 [0046.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f4b85, lpParameter=0x142e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0046.931] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0046.931] CloseHandle (hObject=0x208) returned 1 [0046.931] GetProcessHeap () returned 0x130000 [0046.931] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14c338 | out: hHeap=0x130000) returned 1 [0046.931] GetProcessHeap () returned 0x130000 [0046.931] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x60) returned 0x1415b0 [0046.931] GetProcessHeap () returned 0x130000 [0046.931] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x5c) returned 0x141290 [0046.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f4b85, lpParameter=0x141290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0046.932] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0046.932] CloseHandle (hObject=0x208) returned 1 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1415b0 | out: hHeap=0x130000) returned 1 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153fe8 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153fc0 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e30 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.932] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153fc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0046.932] GetProcessHeap () returned 0x130000 [0046.932] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153fe8 | out: hHeap=0x130000) returned 1 [0046.932] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x115f874, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x115f874*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153fc0 | out: hHeap=0x130000) returned 1 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x60) returned 0x1415b0 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153db8 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153de0 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e08 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.933] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x153de0, nSize=0xf | out: lpDst="") returned 0x1e [0046.933] GetProcessHeap () returned 0x130000 [0046.933] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x153de0, Size=0x3a) returned 0x1426b0 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x3a) returned 0x142668 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.933] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1426b0, nSize=0x1d | out: lpDst="") returned 0x1e [0046.933] GetProcessHeap () returned 0x130000 [0046.933] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142668 | out: hHeap=0x130000) returned 1 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1426b0, Size=0x72) returned 0x142140 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x72) returned 0x141ce8 [0046.933] GetProcessHeap () returned 0x130000 [0046.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.934] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x142140, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0046.934] GetProcessHeap () returned 0x130000 [0046.934] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141ce8 | out: hHeap=0x130000) returned 1 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153db8 | out: hHeap=0x130000) returned 1 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142308 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3e) returned 0x142470 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x3e) returned 0x142980 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.934] GetProcessHeap () returned 0x130000 [0046.934] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x10) returned 0x14f840 [0046.934] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f78c | out: phkResult=0x115f78c*=0x204) returned 0x0 [0046.934] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x115f788, lpData=0x142980, lpcbData=0x115f790*=0x3e | out: lpType=0x115f788*=0x2, lpData=0x142980*=0x0, lpcbData=0x115f790*=0x98) returned 0xea [0046.935] RegCloseKey (hKey=0x204) returned 0x0 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f840 | out: hHeap=0x130000) returned 1 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142980 | out: hHeap=0x130000) returned 1 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142470, Size=0x7a) returned 0x13f120 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x7a) returned 0x141350 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1429f8 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x10) returned 0x14f8d0 [0046.935] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f78c | out: phkResult=0x115f78c*=0x204) returned 0x0 [0046.935] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x115f788, lpData=0x141350, lpcbData=0x115f790*=0x7a | out: lpType=0x115f788*=0x2, lpData=0x141350*=0xf8, lpcbData=0x115f790*=0x98) returned 0xea [0046.935] RegCloseKey (hKey=0x204) returned 0x0 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f8d0 | out: hHeap=0x130000) returned 1 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1429f8 | out: hHeap=0x130000) returned 1 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x13f120, Size=0xf2) returned 0x141448 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xf2) returned 0x141fd8 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.935] GetProcessHeap () returned 0x130000 [0046.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x10) returned 0x14f840 [0046.935] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f78c | out: phkResult=0x115f78c*=0x204) returned 0x0 [0046.935] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x115f788, lpData=0x141fd8, lpcbData=0x115f790*=0xf2 | out: lpType=0x115f788*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x115f790*=0x98) returned 0x0 [0046.936] RegCloseKey (hKey=0x204) returned 0x0 [0046.936] GetProcessHeap () returned 0x130000 [0046.936] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f840 | out: hHeap=0x130000) returned 1 [0046.936] GetProcessHeap () returned 0x130000 [0046.939] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0046.939] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f78c | out: phkResult=0x115f78c*=0x204) returned 0x0 [0046.939] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x115f788, lpData=0x142070, lpcbData=0x115f790*=0x5a | out: lpType=0x115f788*=0x0, lpData=0x142070*=0x80, lpcbData=0x115f790*=0x5a) returned 0x2 [0046.940] RegCloseKey (hKey=0x204) returned 0x0 [0046.940] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f7a0 | out: phkResult=0x115f7a0*=0x204) returned 0x0 [0046.940] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x115f79c, lpData=0x142070, lpcbData=0x115f7a4*=0x5a | out: lpType=0x115f79c*=0x2, lpData=0x142070*=0x80, lpcbData=0x115f7a4*=0x78) returned 0xea [0046.940] RegCloseKey (hKey=0x204) returned 0x0 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141fd8 | out: hHeap=0x130000) returned 1 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x141448, Size=0x1e2) returned 0x14e180 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e2) returned 0x14f170 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x10) returned 0x14f8d0 [0046.940] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f78c | out: phkResult=0x115f78c*=0x204) returned 0x0 [0046.940] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x115f788, lpData=0x14f170, lpcbData=0x115f790*=0x1e2 | out: lpType=0x115f788*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x115f790*=0x98) returned 0x0 [0046.940] RegCloseKey (hKey=0x204) returned 0x0 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f8d0 | out: hHeap=0x130000) returned 1 [0046.940] GetProcessHeap () returned 0x130000 [0046.940] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153de0 [0046.940] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f78c | out: phkResult=0x115f78c*=0x204) returned 0x0 [0046.940] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x115f788, lpData=0x14f208, lpcbData=0x115f790*=0x14a | out: lpType=0x115f788*=0x0, lpData=0x14f208*=0x72, lpcbData=0x115f790*=0x14a) returned 0x2 [0046.940] RegCloseKey (hKey=0x204) returned 0x0 [0046.941] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x115f7a0 | out: phkResult=0x115f7a0*=0x204) returned 0x0 [0046.941] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x115f79c, lpData=0x14f208, lpcbData=0x115f7a4*=0x14a | out: lpType=0x115f79c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x115f7a4*=0x78) returned 0x0 [0046.941] RegCloseKey (hKey=0x204) returned 0x0 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153de0 | out: hHeap=0x130000) returned 1 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.941] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x14e180, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f170 | out: hHeap=0x130000) returned 1 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142308 | out: hHeap=0x130000) returned 1 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f840 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x10) returned 0x14f8d0 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6f0 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.941] ExpandEnvironmentStringsW (in: lpSrc="oit.txt", lpDst=0x14f8d0, nSize=0x8 | out: lpDst="oit.txt") returned 0x8 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6f0 | out: hHeap=0x130000) returned 1 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f840 | out: hHeap=0x130000) returned 1 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14f170 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x154248 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x154460 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x156790 [0046.941] GetProcessHeap () returned 0x130000 [0046.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x1569a8 [0046.942] GetProcessHeap () returned 0x130000 [0046.942] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x156bc0 [0046.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x154248, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0046.942] GetProcessHeap () returned 0x130000 [0046.942] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x156dd8 [0046.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x156dd8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0046.942] GetProcessHeap () returned 0x130000 [0046.942] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x156dd8 | out: hHeap=0x130000) returned 1 [0046.942] GetProcessHeap () returned 0x130000 [0046.942] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x156dd8 [0046.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x156dd8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0046.942] GetProcessHeap () returned 0x130000 [0046.942] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x156dd8 | out: hHeap=0x130000) returned 1 [0046.942] GetProcessHeap () returned 0x130000 [0046.942] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x156dd8 [0046.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x156dd8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0046.942] GetProcessHeap () returned 0x130000 [0046.942] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x156dd8 | out: hHeap=0x130000) returned 1 [0046.942] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=0) returned 1 [0046.956] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x115f884 | out: phkResult=0x115f884*=0x204) returned 0x0 [0046.956] RegSetValueExW (in: hKey=0x204, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe") returned 0x0 [0046.956] RegCloseKey (hKey=0x204) returned 0x0 [0046.956] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x115f898 | out: phkResult=0x115f898*=0x204) returned 0x0 [0046.956] RegSetValueExW (in: hKey=0x204, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe") returned 0x0 [0046.957] RegCloseKey (hKey=0x204) returned 0x0 [0046.957] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt"), bFailIfExists=1) returned 0 [0046.957] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt")) returned 0xffffffff [0046.957] GetProcessHeap () returned 0x130000 [0046.957] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x118) returned 0x141fd8 [0046.957] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 0 [0046.957] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0046.958] GetFileAttributesW (lpFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0046.958] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 1 [0046.964] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0046.964] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0046.964] GetProcessHeap () returned 0x130000 [0046.964] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141fd8 | out: hHeap=0x130000) returned 1 [0046.964] GetProcessHeap () returned 0x130000 [0046.964] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f8d0 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f170 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x154248 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x154460 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x156790 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1569a8 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x156bc0 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1415b0 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142140 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153de0 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e08 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.965] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153de0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.965] GetProcessHeap () returned 0x130000 [0046.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0046.965] GetProcessHeap () returned 0x130000 [0046.966] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0046.966] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x115f8ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x115f8ac*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153de0 | out: hHeap=0x130000) returned 1 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x148618 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f8d0 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x190) returned 0x141db0 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x70) returned 0x13ea40 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x66) returned 0x1368e0 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1368e0, Size=0xca) returned 0x13e518 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x184) returned 0x14e180 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f5a0 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14f170 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x250) returned 0x154248 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xa0) returned 0x141350 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x94) returned 0x1429f8 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x94) returned 0x141448 [0046.966] GetProcessHeap () returned 0x130000 [0046.966] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141fd8 [0046.966] GetProcessHeap () returned 0x130000 [0046.967] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141fd8 | out: hHeap=0x130000) returned 1 [0046.967] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0x1429f8, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0046.967] GetProcessHeap () returned 0x130000 [0046.967] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0046.967] GetProcessHeap () returned 0x130000 [0046.967] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0046.967] GetProcessHeap () returned 0x130000 [0046.967] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x70) returned 0x1368e0 [0046.967] GetProcessHeap () returned 0x130000 [0046.967] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x62) returned 0x14e310 [0046.967] GetProcessHeap () returned 0x130000 [0046.967] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x62) returned 0x142140 [0046.967] GetProcessHeap () returned 0x130000 [0046.967] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0046.967] GetProcessHeap () returned 0x130000 [0047.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0047.321] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x14e310, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142140 | out: hHeap=0x130000) returned 1 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x14e310, Size=0xc2) returned 0x141fd8 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xc2) returned 0x13feb0 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0047.321] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x141fd8, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x13feb0 | out: hHeap=0x130000) returned 1 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1368e0 | out: hHeap=0x130000) returned 1 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x159b20 [0047.321] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x159b20, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0047.321] GetProcessHeap () returned 0x130000 [0047.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159b20 | out: hHeap=0x130000) returned 1 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x24e) returned 0x159b20 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x159b20, Size=0x3cc) returned 0x159b20 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x96) returned 0x141350 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x141350, Size=0x140) returned 0x13feb0 [0047.321] GetProcessHeap () returned 0x130000 [0047.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x6a) returned 0x1368e0 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f170 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x154248 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1429f8 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141fd8 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f8d0 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141db0 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x13ea40 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153de0 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f70 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e08 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0047.322] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0047.322] GetProcessHeap () returned 0x130000 [0047.322] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153de0 | out: hHeap=0x130000) returned 1 [0047.322] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x115f8ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x115f8ac*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x148438 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f8d0 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x190) returned 0x141db0 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x70) returned 0x13ea40 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x66) returned 0x142140 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142140, Size=0xca) returned 0x141fd8 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x184) returned 0x14e180 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f660 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x14f170 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x250) returned 0x154248 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xa0) returned 0x141350 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x94) returned 0x1429f8 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x94) returned 0x159ef8 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x159f98 [0047.323] GetProcessHeap () returned 0x130000 [0047.323] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159f98 | out: hHeap=0x130000) returned 1 [0047.323] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0x1429f8, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159ef8 | out: hHeap=0x130000) returned 1 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x70) returned 0x14e310 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x62) returned 0x142140 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x62) returned 0x141678 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0047.324] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x142140, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141678 | out: hHeap=0x130000) returned 1 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142140, Size=0xc2) returned 0x159ef8 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xc2) returned 0x159fc8 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141350 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141350 | out: hHeap=0x130000) returned 1 [0047.324] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x159ef8, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159fc8 | out: hHeap=0x130000) returned 1 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e310 | out: hHeap=0x130000) returned 1 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20a) returned 0x159fc8 [0047.324] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x159fc8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0047.324] GetProcessHeap () returned 0x130000 [0047.324] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159fc8 | out: hHeap=0x130000) returned 1 [0047.324] GetProcessHeap () returned 0x130000 [0047.324] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x182) returned 0x159fc8 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x24e) returned 0x15a158 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x96) returned 0x141350 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x141350, Size=0x140) returned 0x15a3b0 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x6a) returned 0x14e310 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f170 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x154248 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1429f8 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159ef8 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f8d0 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141db0 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x13ea40 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0047.325] GetProcessHeap () returned 0x130000 [0047.325] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x14) returned 0x149d00 [0047.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f22ee, lpParameter=0x149d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0047.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f239a, lpParameter=0x115f8e4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0047.326] GetProcessHeap () returned 0x130000 [0047.327] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x14) returned 0x14a000 [0047.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f2161, lpParameter=0x14a000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0047.327] GetProcessHeap () returned 0x130000 [0047.327] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x14) returned 0x149ca0 [0047.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f1a76, lpParameter=0x149ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0047.328] GetProcessHeap () returned 0x130000 [0047.328] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x14) returned 0x149da0 [0047.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f1cc5, lpParameter=0x149da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0047.328] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x1194 Thread: id = 3 os_tid = 0x1188 Thread: id = 11 os_tid = 0xd0c [0046.987] GetProcessHeap () returned 0x130000 [0046.987] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0046.987] GetProcessHeap () returned 0x130000 [0046.987] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x14) returned 0x149e00 [0046.987] GetProcessHeap () returned 0x130000 [0046.987] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x14) returned 0x149e80 [0046.987] GetProcessHeap () returned 0x130000 [0046.987] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141448 [0046.987] GetProcessHeap () returned 0x130000 [0046.987] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0046.987] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x149e00, nSize=0xa | out: lpDst="") returned 0x1c [0046.987] GetProcessHeap () returned 0x130000 [0046.987] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x149e80 | out: hHeap=0x130000) returned 1 [0046.987] GetProcessHeap () returned 0x130000 [0046.987] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x149e00, Size=0x26) returned 0x148528 [0046.987] GetProcessHeap () returned 0x130000 [0046.988] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x26) returned 0x148648 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141448 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0046.988] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x148528, nSize=0x13 | out: lpDst="") returned 0x1c [0046.988] GetProcessHeap () returned 0x130000 [0046.988] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x148648 | out: hHeap=0x130000) returned 1 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x148528, Size=0x4a) returned 0x14ef10 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4a) returned 0x14edb0 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141448 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0046.988] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x14ef10, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0046.988] GetProcessHeap () returned 0x130000 [0046.988] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14edb0 | out: hHeap=0x130000) returned 1 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14eeb8 [0046.988] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0046.988] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0046.988] Wow64DisableWow64FsRedirection (in: OldValue=0x2bffdfc | out: OldValue=0x2bffdfc*=0x0) returned 1 [0046.988] GetProcessHeap () returned 0x130000 [0046.988] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14eeb8 | out: hHeap=0x130000) returned 1 [0046.988] CreatePipe (in: hReadPipe=0x2bffdf0, hWritePipe=0x2bffdec, lpPipeAttributes=0x2bffe0c, nSize=0x0 | out: hReadPipe=0x2bffdf0*=0x248, hWritePipe=0x2bffdec*=0x264) returned 1 [0046.989] CreatePipe (in: hReadPipe=0x2bffdf4, hWritePipe=0x2bffdf8, lpPipeAttributes=0x2bffe0c, nSize=0x0 | out: hReadPipe=0x2bffdf4*=0x268, hWritePipe=0x2bffdf8*=0x26c) returned 1 [0046.989] SetHandleInformation (hObject=0x264, dwMask=0x1, dwFlags=0x0) returned 1 [0046.989] SetHandleInformation (hObject=0x268, dwMask=0x1, dwFlags=0x0) returned 1 [0046.989] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2bffe28*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x26c, hStdError=0x26c), lpProcessInformation=0x2bffe18 | out: lpCommandLine=0x0, lpProcessInformation=0x2bffe18*(hProcess=0x274, hThread=0x270, dwProcessId=0xd64, dwThreadId=0xd48)) returned 1 [0047.364] WriteFile (in: hFile=0x264, lpBuffer=0x142e98*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x2bffe08, lpOverlapped=0x0 | out: lpBuffer=0x142e98*, lpNumberOfBytesWritten=0x2bffe08*=0xc2, lpOverlapped=0x0) returned 1 [0047.365] WaitForSingleObject (hHandle=0x274, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0xab4 [0046.992] GetProcessHeap () returned 0x130000 [0046.992] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0046.992] GetProcessHeap () returned 0x130000 [0046.992] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x14) returned 0x149e00 [0046.992] GetProcessHeap () returned 0x130000 [0046.992] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x14) returned 0x149e80 [0046.995] GetProcessHeap () returned 0x130000 [0046.995] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141448 [0046.995] GetProcessHeap () returned 0x130000 [0046.995] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0046.995] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x149e00, nSize=0xa | out: lpDst="") returned 0x1c [0046.996] GetProcessHeap () returned 0x130000 [0046.996] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x149e80 | out: hHeap=0x130000) returned 1 [0046.996] GetProcessHeap () returned 0x130000 [0046.996] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x149e00, Size=0x26) returned 0x148588 [0046.996] GetProcessHeap () returned 0x130000 [0046.996] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x26) returned 0x148438 [0046.996] GetProcessHeap () returned 0x130000 [0046.996] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141448 [0046.996] GetProcessHeap () returned 0x130000 [0046.996] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0046.996] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x148588, nSize=0x13 | out: lpDst="") returned 0x1c [0047.004] GetProcessHeap () returned 0x130000 [0047.004] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x148438 | out: hHeap=0x130000) returned 1 [0047.004] GetProcessHeap () returned 0x130000 [0047.004] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x148588, Size=0x4a) returned 0x14ef68 [0047.004] GetProcessHeap () returned 0x130000 [0047.004] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4a) returned 0x14edb0 [0047.004] GetProcessHeap () returned 0x130000 [0047.004] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x141448 [0047.004] GetProcessHeap () returned 0x130000 [0047.004] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141448 | out: hHeap=0x130000) returned 1 [0047.304] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x14ef68, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0047.304] GetProcessHeap () returned 0x130000 [0047.305] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14edb0 | out: hHeap=0x130000) returned 1 [0047.305] GetProcessHeap () returned 0x130000 [0047.305] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0047.305] GetProcessHeap () returned 0x130000 [0047.305] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14eeb8 [0047.305] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0047.305] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0047.305] Wow64DisableWow64FsRedirection (in: OldValue=0x2cff8a4 | out: OldValue=0x2cff8a4*=0x0) returned 1 [0047.306] GetProcessHeap () returned 0x130000 [0047.306] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14eeb8 | out: hHeap=0x130000) returned 1 [0047.306] CreatePipe (in: hReadPipe=0x2cff898, hWritePipe=0x2cff894, lpPipeAttributes=0x2cff8b4, nSize=0x0 | out: hReadPipe=0x2cff898*=0x288, hWritePipe=0x2cff894*=0x28c) returned 1 [0047.306] CreatePipe (in: hReadPipe=0x2cff89c, hWritePipe=0x2cff8a0, lpPipeAttributes=0x2cff8b4, nSize=0x0 | out: hReadPipe=0x2cff89c*=0x290, hWritePipe=0x2cff8a0*=0x294) returned 1 [0047.306] SetHandleInformation (hObject=0x28c, dwMask=0x1, dwFlags=0x0) returned 1 [0047.306] SetHandleInformation (hObject=0x290, dwMask=0x1, dwFlags=0x0) returned 1 [0047.307] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2cff8d0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x288, hStdOutput=0x294, hStdError=0x294), lpProcessInformation=0x2cff8c0 | out: lpCommandLine=0x0, lpProcessInformation=0x2cff8c0*(hProcess=0x29c, hThread=0x298, dwProcessId=0xd40, dwThreadId=0xd74)) returned 1 [0047.319] WriteFile (in: hFile=0x28c, lpBuffer=0x141290*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2cff8b0, lpOverlapped=0x0 | out: lpBuffer=0x141290*, lpNumberOfBytesWritten=0x2cff8b0*=0x5b, lpOverlapped=0x0) returned 1 [0047.319] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) Thread: id = 15 os_tid = 0xd90 [0047.370] GetProcessHeap () returned 0x130000 [0047.370] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x440) returned 0x159260 [0047.370] GetProcessHeap () returned 0x130000 [0047.370] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x30) returned 0x1430a0 [0047.370] GetCurrentProcess () returned 0xffffffff [0047.370] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x2e3fb8c | out: TokenHandle=0x2e3fb8c*=0x27c) returned 1 [0047.370] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2e3fb84 | out: lpLuid=0x2e3fb84*(LowPart=0x14, HighPart=0)) returned 1 [0047.384] AdjustTokenPrivileges (in: TokenHandle=0x27c, DisableAllPrivileges=0, NewState=0x2e3fb74*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0047.384] CloseHandle (hObject=0x27c) returned 1 [0047.384] GetProcessHeap () returned 0x130000 [0047.384] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1430a0 | out: hHeap=0x130000) returned 1 [0047.384] GetProcessHeap () returned 0x130000 [0047.385] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x434) returned 0x15a4f8 [0047.385] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c8 [0048.638] Process32FirstW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.638] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.639] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.640] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.640] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.641] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.641] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.641] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.642] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.642] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.643] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0048.643] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0048.644] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.644] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.645] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.645] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.646] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.646] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.647] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.647] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.648] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.648] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.648] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.649] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.649] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.650] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.650] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.651] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0048.651] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.652] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0048.652] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.652] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0048.653] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0048.653] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0048.654] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0048.654] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0048.655] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0048.655] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.656] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0048.656] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0048.657] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0048.657] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0048.658] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0048.658] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0048.659] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0048.659] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0048.659] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0048.660] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0048.660] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0048.661] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0048.661] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0048.662] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0048.662] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0048.721] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0048.721] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0048.722] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0048.722] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0048.723] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0048.723] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0048.724] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0048.725] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0048.726] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0048.727] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0048.727] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0048.728] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0048.729] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0048.730] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0048.731] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0048.731] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0048.732] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0048.733] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0048.734] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0048.735] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0048.735] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0048.736] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0048.737] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0048.737] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0048.738] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0048.739] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0048.739] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0048.740] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0048.741] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0048.741] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0048.742] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0048.743] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0048.743] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0048.744] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0048.745] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0048.745] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0048.746] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0048.747] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0048.747] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0048.748] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0048.749] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0048.749] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0048.750] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0048.751] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0048.751] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0048.752] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0048.752] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0048.753] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0048.753] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0048.754] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0048.755] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0048.755] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.756] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0048.756] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0048.875] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0048.876] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0048.876] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0048.877] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0048.877] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.878] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.878] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.879] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0048.879] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0048.880] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.880] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.881] Process32NextW (in: hSnapshot=0x2c8, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0048.881] CloseHandle (hObject=0x2c8) returned 1 [0048.881] Sleep (dwMilliseconds=0x1f4) [0050.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0050.102] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.102] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.103] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.103] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.104] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.104] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.105] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.105] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.105] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.106] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.106] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0050.107] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0050.107] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.108] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.108] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.109] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.109] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.110] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.110] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.110] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.111] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.111] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.112] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.112] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.113] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.113] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.114] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.114] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0050.114] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.115] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0050.115] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.116] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0050.116] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0050.117] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0050.117] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0050.117] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0050.118] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0050.118] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.119] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0050.120] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0050.120] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0050.120] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0050.121] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0050.121] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0050.122] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0050.122] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0050.123] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0050.123] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0050.124] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0050.124] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0050.125] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0050.125] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0050.126] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0050.126] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0050.126] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0050.127] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0050.127] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0050.185] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0050.185] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0050.187] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0050.187] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0050.188] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0050.189] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0050.190] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0050.190] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0050.191] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0050.192] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0050.193] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0050.193] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0050.194] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0050.195] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0050.196] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0050.197] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0050.197] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0050.198] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0050.199] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0050.200] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0050.200] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0050.201] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0050.205] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0050.206] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0050.207] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0050.208] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0050.208] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0050.209] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0050.210] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0050.211] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0050.211] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0050.212] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0050.213] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0050.213] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0050.214] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0050.215] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0050.215] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0050.216] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0050.217] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0050.240] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0050.241] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0050.242] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0051.296] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0051.297] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0051.297] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0051.298] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0051.299] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0051.299] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.300] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0051.301] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0051.302] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0051.302] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0051.303] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0051.304] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0051.304] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.305] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.305] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.307] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0051.308] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0051.308] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.310] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.310] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.311] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.311] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0051.312] CloseHandle (hObject=0x2fc) returned 1 [0051.312] Sleep (dwMilliseconds=0x1f4) [0052.087] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0052.100] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.100] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.101] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.102] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.102] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.103] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.103] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.104] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.104] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.104] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.105] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0052.105] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0052.106] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.106] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.107] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.107] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.108] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.108] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.109] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.109] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.110] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.110] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.111] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.111] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.111] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.112] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.112] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.113] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0052.113] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.114] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0052.114] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.115] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0052.115] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0052.116] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0052.116] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0052.116] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0052.117] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0052.117] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.118] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0052.118] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0052.119] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0052.119] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0052.120] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0052.120] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0052.121] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0052.121] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0052.122] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0052.122] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0052.440] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0052.441] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0052.441] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0052.442] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0052.443] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0052.443] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0052.443] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0052.444] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0052.445] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0052.445] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0052.445] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0052.446] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0052.447] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0052.448] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0052.449] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0052.450] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0052.451] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0052.452] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0052.452] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0052.453] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0052.454] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0052.455] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0052.456] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0052.456] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0052.457] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0052.458] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0052.459] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0052.460] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0052.461] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0052.461] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0052.462] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0052.463] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0052.464] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0052.464] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0052.465] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0052.466] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0052.467] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0052.467] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0052.468] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0052.469] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0052.470] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0052.470] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0052.471] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0052.472] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0052.472] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0052.473] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0052.474] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0052.474] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0052.475] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0052.476] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0052.476] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0052.477] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0052.812] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0052.813] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0052.814] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0052.815] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0052.815] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.816] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0052.816] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0052.817] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0052.817] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0052.818] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0052.818] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0052.819] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.820] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.820] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.821] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0052.821] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0052.822] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.822] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.823] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.823] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.824] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0052.824] CloseHandle (hObject=0x2fc) returned 1 [0052.824] Sleep (dwMilliseconds=0x1f4) [0053.590] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0053.602] Process32FirstW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.603] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.603] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.604] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.604] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.605] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.605] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.606] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.606] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.607] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.607] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0053.608] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0053.608] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.609] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.609] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.610] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.610] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.611] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.611] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.612] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.612] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.613] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.613] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.613] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.614] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.614] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.615] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.615] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0053.616] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.616] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0053.617] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.617] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0053.617] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0053.618] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0053.618] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0053.619] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0053.619] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0053.620] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.620] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0053.620] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0053.621] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0053.621] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0053.622] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0053.622] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0053.878] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0053.878] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0053.879] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0053.879] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0053.880] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0053.880] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0053.881] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0053.881] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0053.882] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0053.882] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0053.883] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0053.883] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0053.884] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0053.884] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0053.884] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0053.885] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0053.886] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0053.887] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0053.888] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0053.889] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0053.890] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0053.890] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0053.891] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0053.892] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0053.893] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0053.894] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0053.895] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.895] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.896] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.897] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.898] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.898] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.899] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.900] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.901] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0053.902] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.902] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.903] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.904] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.905] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.905] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.906] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.907] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.908] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.908] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.909] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.910] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.910] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.911] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.912] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.912] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.047] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.048] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.049] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.049] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.050] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0054.051] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0054.051] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0054.052] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0054.053] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0054.054] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.054] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0054.055] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0054.055] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0054.056] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0054.056] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0054.057] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0054.058] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.058] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.059] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.059] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0054.060] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0054.060] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.071] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.072] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.072] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.073] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0054.073] CloseHandle (hObject=0x31c) returned 1 [0054.074] Sleep (dwMilliseconds=0x1f4) [0054.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0054.793] Process32FirstW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.794] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.794] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.795] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.796] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.808] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.818] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.818] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.819] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.819] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.820] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0054.820] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0054.821] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.821] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.822] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.822] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.823] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.823] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.823] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.824] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.824] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.825] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.825] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.828] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.849] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.849] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.850] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.850] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0054.851] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.851] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0054.852] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.852] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0054.853] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0054.853] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0054.854] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0054.854] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0054.855] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0054.855] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.855] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0054.856] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0054.856] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0054.857] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0054.857] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0054.858] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0054.858] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0054.859] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0054.859] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0054.860] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0054.860] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.861] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0054.861] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0055.162] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0055.162] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0055.163] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0055.163] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0055.164] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0055.164] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0055.165] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.165] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.166] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.167] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.168] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.169] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.170] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.171] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.171] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.172] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.173] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.174] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0055.175] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0055.176] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0055.176] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0055.177] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0055.178] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0055.179] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0055.180] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0055.180] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0055.182] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0055.182] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0055.183] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0055.184] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0055.185] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0055.185] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0055.187] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0055.187] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0055.188] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0055.189] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0055.189] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0055.190] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0055.191] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0055.192] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0055.192] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0055.193] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0055.194] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0055.415] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0055.416] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0055.417] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0055.417] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0055.499] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0055.500] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0055.500] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0055.501] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0055.502] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0055.502] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0055.503] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.504] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.504] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0055.505] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.506] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0055.506] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0055.507] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0055.508] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.508] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.509] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.509] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0055.510] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0055.510] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.511] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.512] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.512] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.513] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.513] Process32NextW (in: hSnapshot=0x31c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.514] CloseHandle (hObject=0x31c) returned 1 [0055.514] Sleep (dwMilliseconds=0x1f4) [0056.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0056.299] Process32FirstW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.300] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.300] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.301] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.301] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.302] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.302] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.303] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.303] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.304] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.304] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0056.305] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0056.305] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.306] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.306] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.307] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.307] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.308] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.308] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.308] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.309] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.309] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.310] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.310] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.311] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.311] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.312] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.312] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0056.313] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.313] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0056.314] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.314] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0056.315] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0056.315] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0056.315] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0056.316] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0056.316] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0056.317] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.317] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0056.318] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0056.763] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0056.763] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0056.764] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0056.764] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0056.764] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0056.765] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0056.765] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0056.766] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0056.766] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0056.767] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0056.767] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0056.768] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0056.768] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0056.769] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0056.769] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0056.769] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0056.770] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0056.770] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0056.771] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0056.772] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0056.773] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0056.773] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0056.774] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0056.775] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0056.776] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0056.777] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0056.777] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0056.778] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0056.779] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0056.780] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0056.781] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0056.781] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0056.782] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0056.783] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0056.784] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0056.785] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0056.785] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0056.786] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0056.787] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0056.788] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0056.789] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0056.789] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0056.790] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0056.791] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0056.792] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0056.792] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0056.793] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0056.794] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0056.795] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0056.795] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0056.796] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0056.798] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0056.799] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0056.799] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0056.800] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0056.801] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0056.801] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0056.802] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0057.039] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0057.069] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0057.069] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0057.070] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0057.071] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0057.071] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0057.072] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.072] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.073] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0057.074] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.074] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0057.076] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0057.077] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0057.077] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.078] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.078] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.079] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0057.080] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0057.080] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.081] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.081] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.082] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.083] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.083] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.084] CloseHandle (hObject=0x340) returned 1 [0057.084] Sleep (dwMilliseconds=0x1f4) [0057.649] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0057.665] Process32FirstW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.665] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.666] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.666] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.667] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.667] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.668] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.668] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.669] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.669] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.670] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0057.670] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0057.670] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.671] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.671] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.672] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.672] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.673] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.673] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.674] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.674] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.675] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.675] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.675] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.676] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.676] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.677] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.677] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0057.678] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.679] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.679] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.680] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0057.680] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0057.681] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0057.681] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0057.682] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0057.682] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0057.682] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.683] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0057.683] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0057.684] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0057.684] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0057.685] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0057.685] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0057.686] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0057.686] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0057.687] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0057.687] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0057.687] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.688] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0057.688] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0057.689] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0057.689] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0057.690] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0057.690] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0057.691] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0057.691] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0057.692] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.692] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.795] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.796] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.797] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.797] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.798] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.799] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.800] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.801] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.801] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.802] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.806] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.807] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.808] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.809] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.810] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.810] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.811] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.812] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.813] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.813] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.814] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.816] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.816] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.817] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.818] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.819] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.820] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.820] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0057.821] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0057.822] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0057.823] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0057.823] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0057.824] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0057.825] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0057.825] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0057.826] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0057.827] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0057.827] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0057.828] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0057.828] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0057.829] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0057.830] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0057.830] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0057.831] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0057.831] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0057.832] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.833] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.833] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0057.935] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.935] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0057.936] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0057.936] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0057.937] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.938] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.938] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.939] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0057.939] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0057.940] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.940] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.941] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.941] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.942] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.942] Process32NextW (in: hSnapshot=0x340, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.943] CloseHandle (hObject=0x340) returned 1 [0057.943] Sleep (dwMilliseconds=0x1f4) [0058.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0058.582] Process32FirstW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.583] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.583] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.584] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.584] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.585] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.585] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.586] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.586] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.587] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.587] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0058.588] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0058.588] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.589] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.589] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.592] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.594] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.595] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.595] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.596] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.596] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.597] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.597] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.597] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.598] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.598] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.599] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.608] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0058.608] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.609] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.609] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.610] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0058.611] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0058.611] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0058.612] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0058.612] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0058.613] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0058.614] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.614] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0058.615] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0058.615] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0058.616] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0058.616] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0058.617] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0058.617] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0058.618] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0058.619] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0058.619] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0058.620] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0058.620] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0058.621] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0058.621] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0058.622] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0058.622] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0058.623] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0058.624] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0058.624] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0058.625] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0058.626] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0058.627] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0058.628] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0058.690] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0058.691] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0058.692] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0058.693] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0058.694] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0058.696] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0058.754] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0058.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0058.797] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0058.804] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0058.809] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0058.814] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0058.817] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0058.817] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0058.818] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0058.819] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0058.820] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0058.821] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0058.822] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0058.822] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0058.823] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0058.824] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0058.825] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0058.825] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0058.826] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0058.827] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0058.828] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0058.828] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0058.829] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0058.830] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0058.830] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0058.831] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0058.832] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0058.832] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0058.833] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0058.834] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0058.835] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0058.835] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0058.836] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0058.837] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0058.837] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0058.838] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0058.839] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0058.840] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.840] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.841] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0058.841] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.842] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0058.843] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0058.843] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0058.844] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.844] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.845] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.845] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0058.846] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0058.847] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.847] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.848] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.848] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.849] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.849] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.044] CloseHandle (hObject=0x33c) returned 1 [0059.044] Sleep (dwMilliseconds=0x1f4) [0060.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0060.142] Process32FirstW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.143] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.143] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.145] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.145] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.146] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.146] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.147] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.147] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.148] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.148] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.149] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.149] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.149] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.150] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.150] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.151] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.151] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.152] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.152] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.153] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.153] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.154] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.154] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.155] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.156] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.156] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.157] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0060.158] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.158] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.159] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.160] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0060.160] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0060.160] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0060.161] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0060.161] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0060.473] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0060.477] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.479] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0060.482] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0060.484] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0060.485] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0060.485] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0060.486] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0060.486] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0060.487] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0060.487] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0060.488] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0060.488] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.489] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0060.489] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0060.490] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0060.490] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0060.491] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0060.491] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0060.492] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0060.492] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0060.492] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0060.497] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.500] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.504] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.508] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.513] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.523] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.528] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.529] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.531] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.532] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0060.534] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0060.536] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0060.538] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0060.539] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0060.541] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0060.543] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0060.544] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0060.546] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0060.547] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0060.549] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0060.550] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0060.552] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0060.840] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0060.848] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0060.852] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.855] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.861] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.864] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.868] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.872] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.875] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.879] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.883] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.885] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.888] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.890] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.892] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.892] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.893] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.894] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.894] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.895] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0060.896] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0060.896] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0060.897] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0060.898] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0060.898] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.899] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.899] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0060.900] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.901] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0060.901] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0060.902] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0060.902] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.903] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.904] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.904] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0060.905] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0060.905] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.906] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.906] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.907] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.908] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.908] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.909] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0060.909] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0060.910] CloseHandle (hObject=0x300) returned 1 [0060.910] Sleep (dwMilliseconds=0x1f4) [0061.691] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0061.703] Process32FirstW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.703] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.704] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.704] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.705] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.705] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.706] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.706] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.707] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.707] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.707] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.708] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.708] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.709] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.709] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.710] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.710] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.711] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.711] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.712] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.712] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.713] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.713] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.714] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.714] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.715] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.715] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.715] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0061.716] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.716] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.717] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.717] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0061.718] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0061.718] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0061.719] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0061.719] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0061.720] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0061.720] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.721] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0061.721] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0061.722] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0061.722] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0061.723] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0061.723] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0061.724] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0061.724] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0061.725] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0061.725] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0061.726] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0061.726] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0061.727] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0061.727] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0061.728] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0061.728] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0061.729] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0061.729] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0061.730] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0061.730] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0061.731] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0061.732] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0061.733] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0061.733] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0061.734] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.048] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.049] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.049] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.050] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.054] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.067] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.104] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.106] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.107] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.108] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.109] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.110] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.110] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.111] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.112] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.113] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.114] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.115] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.116] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.116] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.117] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.118] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.118] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.119] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.120] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.121] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.121] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.122] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.123] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.124] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.124] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.125] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.126] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.126] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.127] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.128] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.128] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0062.129] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0062.248] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0062.249] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0062.249] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0062.250] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.251] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.251] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0062.252] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.253] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0062.534] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0062.535] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0062.535] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.536] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.537] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.537] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0062.538] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0062.538] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.539] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.540] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.540] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.541] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.541] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.542] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0062.542] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0062.543] CloseHandle (hObject=0x300) returned 1 [0062.543] Sleep (dwMilliseconds=0x1f4) [0063.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0063.092] Process32FirstW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.093] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.093] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.094] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.094] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.095] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.095] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.096] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.096] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.097] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.097] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.098] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.098] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.099] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.099] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.100] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.100] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.100] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.101] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.102] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.102] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.103] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.103] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.104] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.104] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.105] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.105] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.106] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0063.106] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.107] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.107] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.108] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0063.108] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0063.109] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0063.109] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0063.110] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0063.110] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0063.111] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.111] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0063.112] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0063.112] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0063.113] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0063.113] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0063.113] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0063.114] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0063.114] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0063.115] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0063.115] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0063.116] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.129] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0063.171] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0063.171] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0063.172] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0063.172] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0063.173] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0063.173] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0063.174] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0063.175] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.175] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0063.176] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0063.177] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.178] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.179] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.180] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.181] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.182] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.183] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.183] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.184] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.185] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.186] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.187] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.188] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.189] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.190] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0063.191] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0063.191] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0063.192] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0063.193] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0063.194] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.195] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.208] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.209] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.210] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.212] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.212] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.213] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.214] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.215] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.215] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.216] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.217] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.217] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.229] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.230] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.231] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.231] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.232] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.233] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.233] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0063.234] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0063.235] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0063.236] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0063.236] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0063.237] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.238] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.238] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0063.239] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.239] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0063.240] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0063.241] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0063.242] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.250] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.251] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.251] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0063.252] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0063.252] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.253] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.254] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.254] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.255] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.255] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.256] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0063.257] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0063.257] CloseHandle (hObject=0x300) returned 1 [0063.257] Sleep (dwMilliseconds=0x1f4) [0063.844] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0063.852] Process32FirstW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.853] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.853] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.854] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.854] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.855] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.855] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.856] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.856] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.857] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.857] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.857] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.858] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.858] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.859] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.859] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.860] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.860] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.861] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.861] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.862] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.862] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.863] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.863] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.864] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.864] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.865] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.865] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0063.865] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.866] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.866] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.867] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0063.872] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0063.873] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0063.873] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0063.874] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0063.874] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0063.875] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.875] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0063.875] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0063.876] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0063.876] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0063.877] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0063.877] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0063.878] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0063.878] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0063.879] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0063.879] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0063.880] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.880] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0063.907] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0063.907] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0063.907] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0063.908] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0063.908] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0063.909] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0063.909] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0063.910] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.910] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0063.911] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0063.912] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.913] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.914] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.915] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.916] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.916] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.917] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.918] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.919] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.920] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.921] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.921] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.922] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.923] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.924] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0063.925] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0063.926] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0063.926] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0063.927] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0063.928] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.929] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.930] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.931] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.931] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.932] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.933] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.934] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.934] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.935] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.936] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.937] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.937] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.938] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.949] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.950] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.951] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.951] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.952] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.953] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.953] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0063.954] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0063.955] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0063.955] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0063.956] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0063.957] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.957] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.958] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0063.958] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.959] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0063.960] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0063.960] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0063.961] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.962] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.962] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.963] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0063.964] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0063.964] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.965] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.965] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.966] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.966] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.967] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.967] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0063.968] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0063.968] CloseHandle (hObject=0x300) returned 1 [0063.968] Sleep (dwMilliseconds=0x1f4) [0064.890] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0064.897] Process32FirstW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.897] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.898] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.899] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.899] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.900] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.900] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.901] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.901] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.902] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.902] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0064.902] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0064.903] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.903] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.904] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.904] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.905] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.905] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.906] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.906] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.907] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.907] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.908] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.908] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.909] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.912] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.912] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.913] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0064.913] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.913] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.914] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.915] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0064.915] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0064.916] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0064.916] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0064.917] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0064.917] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0064.918] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.918] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0064.918] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0064.919] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0064.920] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0064.920] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0064.920] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0064.921] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0064.921] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0064.922] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0064.922] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0064.923] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0064.923] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0064.924] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0064.924] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0064.925] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0064.925] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0064.926] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0064.926] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0064.926] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0064.927] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0064.927] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0065.005] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0065.006] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0065.007] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0065.007] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0065.008] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0065.009] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0065.010] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0065.011] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0065.012] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0065.013] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0065.013] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0065.014] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0065.015] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0065.016] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0065.017] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0065.017] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0065.018] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0065.019] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0065.020] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0065.021] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0065.021] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0065.022] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0065.023] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0065.024] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0065.024] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0065.025] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0065.026] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0065.027] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0065.028] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0065.028] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0065.029] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0065.030] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0065.030] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0065.031] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0065.032] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0065.033] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0065.033] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0065.034] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0065.035] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0065.035] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0065.036] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0065.106] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0065.107] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0065.108] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0065.108] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0065.109] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.110] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.110] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0065.111] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.111] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0065.112] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0065.113] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0065.113] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.114] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.114] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.115] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0065.116] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0065.116] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.117] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.117] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.118] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.119] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.119] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0065.120] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0065.120] Process32NextW (in: hSnapshot=0x300, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0065.121] CloseHandle (hObject=0x300) returned 1 [0065.121] Sleep (dwMilliseconds=0x1f4) [0066.983] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0067.734] Process32FirstW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.734] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.735] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.735] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.736] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.736] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.737] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.737] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.738] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.738] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.739] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.739] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.740] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.740] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.741] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.741] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.742] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.746] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.747] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.747] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.748] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.748] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.749] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.749] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.750] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.750] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.751] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.751] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.752] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.752] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.753] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.753] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.754] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0067.754] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0067.755] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.755] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.756] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.756] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.757] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0067.757] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0068.337] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0068.341] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0068.379] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0068.408] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0068.410] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0068.427] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0068.428] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0068.438] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0068.439] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.440] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0068.440] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0068.441] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0068.442] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0068.442] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0068.443] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0068.444] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0068.444] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0068.445] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0068.446] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0068.447] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0068.448] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0068.449] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0068.452] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0068.453] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0068.454] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0068.455] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0068.456] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0068.457] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0068.459] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0068.460] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0068.461] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0068.462] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0068.463] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0068.465] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0068.991] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0068.992] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0068.993] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0068.994] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0068.995] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0068.996] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0068.996] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0068.997] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0068.998] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0068.999] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0069.000] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0069.001] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0069.001] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0069.002] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0069.003] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0069.004] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0069.004] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0069.005] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0069.006] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0069.007] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0069.007] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0069.008] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0069.009] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0069.010] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0069.010] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0069.011] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0069.012] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0069.012] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0069.014] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0069.014] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0069.015] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.016] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.016] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0069.047] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.048] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0069.049] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0069.049] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0069.050] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.051] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.051] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.052] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0069.052] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0069.053] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.054] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.054] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.055] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.055] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.056] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0069.057] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0069.057] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0069.058] CloseHandle (hObject=0x33c) returned 1 [0069.058] Sleep (dwMilliseconds=0x1f4) [0069.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0069.792] Process32FirstW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.794] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.795] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.795] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.796] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.796] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.797] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.797] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.798] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.798] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.799] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.799] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.800] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x60, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.800] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.801] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.801] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.802] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.802] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.803] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.803] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.804] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.804] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.805] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.805] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.806] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.806] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0069.807] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.807] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.808] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.808] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0069.809] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0069.809] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0069.811] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0069.812] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0069.812] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0069.813] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.813] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0069.814] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0069.814] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0069.815] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0069.815] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0069.816] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0069.816] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0069.816] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0069.817] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0069.817] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0069.818] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0069.818] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0069.819] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0069.819] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0069.820] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0069.820] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0069.820] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0069.821] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0069.821] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0069.822] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.822] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.823] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.824] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.825] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.081] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.095] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.099] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.099] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.100] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.101] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.102] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.103] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.104] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.104] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.105] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.106] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.107] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.108] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.109] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.110] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.110] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.111] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.112] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.113] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.114] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.115] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.115] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.116] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.117] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.118] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.119] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.119] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.120] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.121] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.122] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.122] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.123] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.124] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.125] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.125] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.126] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.127] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0070.127] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0070.128] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0070.129] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0070.129] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0070.130] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.131] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.131] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0070.132] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.133] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0070.133] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0070.134] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0070.134] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.135] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.136] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.136] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0070.137] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0070.137] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.470] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.471] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.471] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.472] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.473] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.473] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0070.474] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0070.475] Process32NextW (in: hSnapshot=0x33c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0070.475] CloseHandle (hObject=0x33c) returned 1 [0070.475] Sleep (dwMilliseconds=0x1f4) [0071.267] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0071.274] Process32FirstW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.274] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.275] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.275] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.275] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.276] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.276] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.277] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.277] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.278] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.278] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0071.279] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0071.279] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.280] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.280] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x60, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.281] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.281] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.282] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.282] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.283] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.283] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.284] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.284] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.285] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.285] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.290] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.293] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.294] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0071.299] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.302] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.319] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.319] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0071.320] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0071.320] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0071.321] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0071.321] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0071.322] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0071.322] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.323] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0071.323] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0071.323] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0071.324] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0071.324] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0071.325] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0071.326] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0071.326] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0071.327] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0071.327] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0071.328] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0071.328] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0071.329] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0071.329] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0071.329] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0071.330] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0071.330] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0071.331] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0071.331] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0071.332] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0071.332] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0071.333] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0071.334] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0071.335] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0071.336] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0071.337] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0071.337] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0071.338] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0071.339] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0071.340] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0071.341] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0071.542] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0071.557] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0071.597] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0071.598] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0071.599] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0071.599] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0071.600] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0071.601] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0071.602] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0071.603] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0071.604] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0071.604] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0071.605] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0071.606] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0071.607] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0071.608] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0071.609] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0071.610] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0071.610] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0071.611] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0071.612] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0071.613] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0071.613] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0071.614] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0071.615] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0071.616] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0071.616] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0071.617] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0071.618] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0071.618] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0071.619] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0071.620] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0071.620] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0071.621] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0071.622] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0071.622] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.623] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.624] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0071.624] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.625] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0071.626] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0071.626] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0071.627] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.627] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.628] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.628] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0071.629] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0071.630] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.630] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.631] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.631] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.632] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.632] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0071.633] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0071.633] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0071.634] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0071.634] CloseHandle (hObject=0x330) returned 1 [0071.634] Sleep (dwMilliseconds=0x1f4) [0072.287] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0072.294] Process32FirstW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.294] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.295] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.295] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.297] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.302] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.321] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.321] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.322] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.322] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.323] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0072.323] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0072.324] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.324] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.325] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x60, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.325] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.326] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.326] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.327] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.327] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.327] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.328] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.328] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.329] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.329] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.330] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.330] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.331] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0072.331] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.332] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.332] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.333] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0072.333] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0072.334] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0072.334] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0072.334] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0072.335] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0072.335] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.336] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0072.336] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0072.337] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0072.337] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0072.338] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0072.338] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0072.339] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0072.339] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0072.340] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0072.340] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0072.341] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.341] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0072.342] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0072.342] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0072.342] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0072.343] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0072.343] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0072.344] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0072.344] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0072.345] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0072.345] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0072.346] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0072.347] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0072.348] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0072.349] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0072.350] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0072.350] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0072.483] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0072.485] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0072.487] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0072.490] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0072.493] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0072.499] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.598] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.599] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.600] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.601] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.602] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.603] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.604] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.604] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.605] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.606] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.607] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.608] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.608] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.609] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.610] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.611] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.612] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.613] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.613] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.614] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.615] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.615] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.616] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.617] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.618] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.618] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.619] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.620] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.620] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0072.621] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0072.622] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0072.622] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0072.623] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0072.624] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.624] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.625] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0072.626] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.709] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0072.710] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0072.710] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0072.711] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.711] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.712] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.713] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0072.754] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0072.772] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.778] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.781] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.781] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.782] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.783] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.783] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0072.784] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0072.784] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0072.785] CloseHandle (hObject=0x324) returned 1 [0072.785] Sleep (dwMilliseconds=0x1f4) [0073.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0073.475] Process32FirstW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.475] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.476] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.476] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.477] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.477] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.478] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.478] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.479] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.479] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.480] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.480] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.481] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.481] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.481] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.482] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.482] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.483] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.483] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.484] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.484] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.485] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.485] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.486] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.486] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.487] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.487] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.488] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0073.488] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.489] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.489] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.490] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0073.490] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0073.490] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0073.491] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0073.491] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0073.492] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0073.492] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.493] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0073.493] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0073.494] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0073.494] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0073.495] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0073.495] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0073.496] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0073.496] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0073.497] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0073.497] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0073.498] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0073.498] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0073.498] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0073.499] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0073.499] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0073.500] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0073.500] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0073.520] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0073.520] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0073.521] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.521] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.522] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.523] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.524] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.525] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.525] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.526] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.527] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.528] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.529] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.530] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.535] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.536] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.537] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.538] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.538] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.539] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.540] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.541] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.542] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.542] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.545] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.550] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.706] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.707] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.707] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.708] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0073.709] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0073.710] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0073.710] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0073.711] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0073.712] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0073.713] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0073.713] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0073.714] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0073.715] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0073.716] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0073.716] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0073.717] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0073.718] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0073.719] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0073.783] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0073.784] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0073.784] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0074.086] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0074.087] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0074.087] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.088] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.089] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0074.089] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.090] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0074.090] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0074.091] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0074.092] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.092] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.093] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.093] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0074.094] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0074.095] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.095] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.096] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.097] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.097] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.098] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0074.098] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0074.099] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0074.099] Process32NextW (in: hSnapshot=0x330, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0074.100] CloseHandle (hObject=0x330) returned 1 [0074.100] Sleep (dwMilliseconds=0x1f4) [0074.664] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0074.672] Process32FirstW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.673] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0074.673] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0074.674] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.674] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0074.675] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.675] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0074.676] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0074.676] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0074.677] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.677] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0074.678] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0074.678] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.679] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0074.679] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.680] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.682] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.682] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.683] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.683] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.684] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.684] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.685] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.685] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.686] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0074.686] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.687] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0074.687] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0074.688] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.688] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.689] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0074.689] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0074.690] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0074.690] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0074.691] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0074.691] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0074.692] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0074.692] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.693] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0074.693] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0074.694] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0074.694] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0074.695] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0074.695] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0074.696] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0074.696] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0074.697] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0074.697] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0074.698] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0074.698] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0074.699] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0074.699] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0074.699] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0074.700] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0074.700] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0075.775] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0075.776] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0075.776] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.777] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.778] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.779] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.779] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.780] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0075.781] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0075.782] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0075.783] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0075.784] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0075.785] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0075.786] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0075.786] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0075.787] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0075.788] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0075.789] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0075.790] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0075.791] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0075.791] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0075.792] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0075.793] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0075.794] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0075.795] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0075.795] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0075.796] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0075.797] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0075.798] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0075.799] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0075.800] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0075.801] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0075.801] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0075.802] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0075.803] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0075.804] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0075.804] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0075.805] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0075.806] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0075.807] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.170] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.170] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.171] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.172] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.172] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0076.181] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0076.181] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0076.182] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0076.183] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0076.184] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.185] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.185] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0076.186] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.186] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0076.187] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0076.188] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0076.189] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.190] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.190] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.191] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0076.192] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0076.192] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.193] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.193] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.194] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.195] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.195] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd64, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0076.196] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd40, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0076.196] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0076.197] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0076.198] Process32NextW (in: hSnapshot=0x324, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0076.198] CloseHandle (hObject=0x324) returned 1 [0076.198] Sleep (dwMilliseconds=0x1f4) [0077.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x32c [0077.170] Process32FirstW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.170] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.180] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.180] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.181] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.181] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.182] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.183] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.183] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.184] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.184] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.185] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.185] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.186] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.186] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.187] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.188] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.188] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.189] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.189] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.191] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.191] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.191] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.192] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.193] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.194] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.194] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.195] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0077.197] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.197] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.198] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.198] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0077.202] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0077.202] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0077.203] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0077.203] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0077.204] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0077.204] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.205] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0077.205] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0077.206] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0077.207] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0077.207] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0077.208] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0077.208] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0077.209] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0077.210] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0077.210] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0077.211] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.211] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0077.212] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0077.212] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0077.213] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0077.213] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0077.214] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0077.523] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0077.524] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0077.524] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0077.525] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0077.529] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0077.530] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0077.531] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0077.531] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0077.532] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0077.533] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0077.534] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0077.535] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0077.536] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0077.537] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0077.538] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0077.538] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.539] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.540] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.541] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.542] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.543] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.543] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.544] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0077.545] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0077.546] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0077.547] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0077.547] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0077.548] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0077.549] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0077.550] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0077.551] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0077.552] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0077.552] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0077.553] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0077.554] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0077.555] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.555] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.556] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.557] Process32NextW (in: hSnapshot=0x32c, lppe=0x2e3f960 | out: lppe=0x2e3f960*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.557] Process32NextW (hSnapshot=0x32c, lppe=0x2e3f960) Thread: id = 16 os_tid = 0xc18 [0047.427] GetVersion () returned 0x23f00206 [0047.427] GetCurrentProcess () returned 0xffffffff [0047.427] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2f7f8b4 | out: TokenHandle=0x2f7f8b4*=0x27c) returned 1 [0047.427] GetTokenInformation (in: TokenHandle=0x27c, TokenInformationClass=0x14, TokenInformation=0x2f7f8ac, TokenInformationLength=0x4, ReturnLength=0x2f7f8b0 | out: TokenInformation=0x2f7f8ac, ReturnLength=0x2f7f8b0) returned 1 [0047.427] CloseHandle (hObject=0x27c) returned 1 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f20 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f70 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1429f8 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1429f8 | out: hHeap=0x130000) returned 1 [0047.427] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0047.427] GetProcessHeap () returned 0x130000 [0047.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0047.427] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.428] GetProcessHeap () returned 0x130000 [0047.428] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0047.428] GetProcessHeap () returned 0x130000 [0047.428] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142470 [0047.428] GetProcessHeap () returned 0x130000 [0047.428] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142500 [0047.428] GetProcessHeap () returned 0x130000 [0047.428] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142500, Size=0x72) returned 0x141ce8 [0047.428] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x27c [0047.428] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0x0) returned 0x102 [0047.428] CloseHandle (hObject=0x27c) returned 1 [0047.428] GetProcessHeap () returned 0x130000 [0047.428] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142470 | out: hHeap=0x130000) returned 1 [0047.428] GetProcessHeap () returned 0x130000 [0047.428] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141ce8 | out: hHeap=0x130000) returned 1 [0047.428] Sleep (dwMilliseconds=0x3e8) [0048.696] GetProcessHeap () returned 0x130000 [0048.696] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e08 [0048.696] GetProcessHeap () returned 0x130000 [0048.696] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0048.696] GetProcessHeap () returned 0x130000 [0048.696] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0048.696] GetProcessHeap () returned 0x130000 [0048.696] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0048.696] GetProcessHeap () returned 0x130000 [0048.696] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0048.696] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.696] GetProcessHeap () returned 0x130000 [0048.696] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0048.696] GetProcessHeap () returned 0x130000 [0048.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0048.697] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.697] GetProcessHeap () returned 0x130000 [0048.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0048.697] GetProcessHeap () returned 0x130000 [0048.697] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0048.697] GetProcessHeap () returned 0x130000 [0048.697] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0048.697] GetProcessHeap () returned 0x130000 [0048.697] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15db50 [0048.697] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2cc [0048.697] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0048.697] CloseHandle (hObject=0x2cc) returned 1 [0048.697] GetProcessHeap () returned 0x130000 [0048.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0048.697] GetProcessHeap () returned 0x130000 [0048.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15db50 | out: hHeap=0x130000) returned 1 [0048.697] Sleep (dwMilliseconds=0x3e8) [0050.129] GetProcessHeap () returned 0x130000 [0050.129] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f70 [0050.129] GetProcessHeap () returned 0x130000 [0050.129] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e08 [0050.129] GetProcessHeap () returned 0x130000 [0050.129] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e30 [0050.129] GetProcessHeap () returned 0x130000 [0050.129] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0050.129] GetProcessHeap () returned 0x130000 [0050.129] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0050.129] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.129] GetProcessHeap () returned 0x130000 [0050.129] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0050.129] GetProcessHeap () returned 0x130000 [0050.130] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0050.130] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.130] GetProcessHeap () returned 0x130000 [0050.130] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0050.130] GetProcessHeap () returned 0x130000 [0050.130] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x1426f8 [0050.130] GetProcessHeap () returned 0x130000 [0050.130] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142500 [0050.130] GetProcessHeap () returned 0x130000 [0050.130] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142500, Size=0x72) returned 0x15e0d0 [0050.130] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x300 [0050.130] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0050.130] CloseHandle (hObject=0x300) returned 1 [0050.130] GetProcessHeap () returned 0x130000 [0050.130] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1426f8 | out: hHeap=0x130000) returned 1 [0050.130] GetProcessHeap () returned 0x130000 [0050.130] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e0d0 | out: hHeap=0x130000) returned 1 [0050.130] Sleep (dwMilliseconds=0x3e8) [0051.346] GetProcessHeap () returned 0x130000 [0051.346] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0051.346] GetProcessHeap () returned 0x130000 [0051.346] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e08 [0051.346] GetProcessHeap () returned 0x130000 [0051.346] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e30 [0051.346] GetProcessHeap () returned 0x130000 [0051.346] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0051.426] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0051.426] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x1425d8 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142668 [0051.426] GetProcessHeap () returned 0x130000 [0051.426] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142668, Size=0x72) returned 0x15db50 [0051.426] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2fc [0051.427] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0051.427] CloseHandle (hObject=0x2fc) returned 1 [0051.427] GetProcessHeap () returned 0x130000 [0051.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1425d8 | out: hHeap=0x130000) returned 1 [0051.427] GetProcessHeap () returned 0x130000 [0051.427] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15db50 | out: hHeap=0x130000) returned 1 [0051.427] Sleep (dwMilliseconds=0x3e8) [0052.807] GetProcessHeap () returned 0x130000 [0052.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0052.807] GetProcessHeap () returned 0x130000 [0052.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f70 [0052.807] GetProcessHeap () returned 0x130000 [0052.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0052.807] GetProcessHeap () returned 0x130000 [0052.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1098 [0052.965] GetProcessHeap () returned 0x130000 [0052.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1098 | out: hHeap=0x130000) returned 1 [0052.965] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.965] GetProcessHeap () returned 0x130000 [0052.965] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0053.078] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15d550 [0053.079] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x31c [0053.079] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0053.079] CloseHandle (hObject=0x31c) returned 1 [0053.079] GetProcessHeap () returned 0x130000 [0053.079] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0053.079] GetProcessHeap () returned 0x130000 [0053.079] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15d550 | out: hHeap=0x130000) returned 1 [0053.079] Sleep (dwMilliseconds=0x3e8) [0054.355] GetProcessHeap () returned 0x130000 [0054.355] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0054.355] GetProcessHeap () returned 0x130000 [0054.355] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f70 [0054.355] GetProcessHeap () returned 0x130000 [0054.355] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0054.361] GetProcessHeap () returned 0x130000 [0054.361] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1000 [0054.361] GetProcessHeap () returned 0x130000 [0054.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1000 | out: hHeap=0x130000) returned 1 [0054.361] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.361] GetProcessHeap () returned 0x130000 [0054.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0054.361] GetProcessHeap () returned 0x130000 [0054.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0054.361] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.361] GetProcessHeap () returned 0x130000 [0054.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0054.361] GetProcessHeap () returned 0x130000 [0054.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0054.362] GetProcessHeap () returned 0x130000 [0054.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0054.362] GetProcessHeap () returned 0x130000 [0054.362] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15e050 [0054.362] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x338 [0054.362] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0054.362] CloseHandle (hObject=0x338) returned 1 [0054.362] GetProcessHeap () returned 0x130000 [0054.362] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0054.362] GetProcessHeap () returned 0x130000 [0054.362] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e050 | out: hHeap=0x130000) returned 1 [0054.362] Sleep (dwMilliseconds=0x3e8) [0055.655] GetProcessHeap () returned 0x130000 [0055.655] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0055.655] GetProcessHeap () returned 0x130000 [0055.655] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0055.655] GetProcessHeap () returned 0x130000 [0055.655] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0055.655] GetProcessHeap () returned 0x130000 [0055.655] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1130 [0055.655] GetProcessHeap () returned 0x130000 [0055.655] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1130 | out: hHeap=0x130000) returned 1 [0055.655] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.655] GetProcessHeap () returned 0x130000 [0055.655] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0055.655] GetProcessHeap () returned 0x130000 [0055.655] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0055.655] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.656] GetProcessHeap () returned 0x130000 [0055.656] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0055.656] GetProcessHeap () returned 0x130000 [0055.656] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x1425d8 [0055.656] GetProcessHeap () returned 0x130000 [0055.656] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142500 [0055.656] GetProcessHeap () returned 0x130000 [0055.656] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142500, Size=0x72) returned 0x15da50 [0055.656] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x31c [0055.656] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0055.656] CloseHandle (hObject=0x31c) returned 1 [0055.656] GetProcessHeap () returned 0x130000 [0055.656] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1425d8 | out: hHeap=0x130000) returned 1 [0055.657] GetProcessHeap () returned 0x130000 [0055.657] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15da50 | out: hHeap=0x130000) returned 1 [0055.657] Sleep (dwMilliseconds=0x3e8) [0056.994] GetProcessHeap () returned 0x130000 [0056.994] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f20 [0056.994] GetProcessHeap () returned 0x130000 [0056.994] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0056.994] GetProcessHeap () returned 0x130000 [0056.994] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0056.994] GetProcessHeap () returned 0x130000 [0056.994] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a05e8 [0056.994] GetProcessHeap () returned 0x130000 [0056.994] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a05e8 | out: hHeap=0x130000) returned 1 [0056.994] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0056.995] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15de50 [0056.995] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x31c [0056.995] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0056.995] CloseHandle (hObject=0x31c) returned 1 [0056.995] GetProcessHeap () returned 0x130000 [0056.995] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0056.995] GetProcessHeap () returned 0x130000 [0056.996] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15de50 | out: hHeap=0x130000) returned 1 [0056.996] Sleep (dwMilliseconds=0x3e8) [0058.326] GetProcessHeap () returned 0x130000 [0058.326] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0058.326] GetProcessHeap () returned 0x130000 [0058.326] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f70 [0058.326] GetProcessHeap () returned 0x130000 [0058.326] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0058.326] GetProcessHeap () returned 0x130000 [0058.326] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0718 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0718 | out: hHeap=0x130000) returned 1 [0058.327] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0058.327] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0058.327] GetProcessHeap () returned 0x130000 [0058.327] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15dad0 [0058.327] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2e0 [0058.328] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0058.328] CloseHandle (hObject=0x2e0) returned 1 [0058.328] GetProcessHeap () returned 0x130000 [0058.328] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0058.328] GetProcessHeap () returned 0x130000 [0058.328] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15dad0 | out: hHeap=0x130000) returned 1 [0058.328] Sleep (dwMilliseconds=0x3e8) [0059.681] GetProcessHeap () returned 0x130000 [0059.681] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f20 [0059.681] GetProcessHeap () returned 0x130000 [0059.681] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0059.681] GetProcessHeap () returned 0x130000 [0059.681] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0059.681] GetProcessHeap () returned 0x130000 [0059.681] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0aa8 [0059.681] GetProcessHeap () returned 0x130000 [0059.681] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0aa8 | out: hHeap=0x130000) returned 1 [0059.681] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.681] GetProcessHeap () returned 0x130000 [0059.681] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0059.681] GetProcessHeap () returned 0x130000 [0059.681] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0059.681] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.682] GetProcessHeap () returned 0x130000 [0059.682] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0059.682] GetProcessHeap () returned 0x130000 [0059.682] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0059.682] GetProcessHeap () returned 0x130000 [0059.682] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0059.682] GetProcessHeap () returned 0x130000 [0059.682] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15e250 [0059.682] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0059.682] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0059.682] CloseHandle (hObject=0x320) returned 1 [0059.682] GetProcessHeap () returned 0x130000 [0059.682] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0059.682] GetProcessHeap () returned 0x130000 [0059.682] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e250 | out: hHeap=0x130000) returned 1 [0059.682] Sleep (dwMilliseconds=0x3e8) [0060.922] GetProcessHeap () returned 0x130000 [0060.922] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0060.922] GetProcessHeap () returned 0x130000 [0060.922] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f20 [0060.922] GetProcessHeap () returned 0x130000 [0060.922] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0060.922] GetProcessHeap () returned 0x130000 [0060.922] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1130 [0060.922] GetProcessHeap () returned 0x130000 [0060.922] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1130 | out: hHeap=0x130000) returned 1 [0060.922] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.922] GetProcessHeap () returned 0x130000 [0060.922] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0060.922] GetProcessHeap () returned 0x130000 [0060.922] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0060.922] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.923] GetProcessHeap () returned 0x130000 [0060.923] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0060.923] GetProcessHeap () returned 0x130000 [0060.923] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0060.923] GetProcessHeap () returned 0x130000 [0060.923] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142620 [0060.923] GetProcessHeap () returned 0x130000 [0060.923] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142620, Size=0x72) returned 0x15d750 [0060.923] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x300 [0060.923] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0060.923] CloseHandle (hObject=0x300) returned 1 [0060.923] GetProcessHeap () returned 0x130000 [0060.923] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0060.923] GetProcessHeap () returned 0x130000 [0060.923] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15d750 | out: hHeap=0x130000) returned 1 [0060.923] Sleep (dwMilliseconds=0x3e8) [0062.350] GetProcessHeap () returned 0x130000 [0062.350] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f70 [0062.350] GetProcessHeap () returned 0x130000 [0062.350] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0062.350] GetProcessHeap () returned 0x130000 [0062.350] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0062.350] GetProcessHeap () returned 0x130000 [0062.350] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a12f8 [0062.350] GetProcessHeap () returned 0x130000 [0062.350] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a12f8 | out: hHeap=0x130000) returned 1 [0062.350] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.350] GetProcessHeap () returned 0x130000 [0062.350] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0062.350] GetProcessHeap () returned 0x130000 [0062.350] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0062.350] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.351] GetProcessHeap () returned 0x130000 [0062.351] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0062.351] GetProcessHeap () returned 0x130000 [0062.351] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0062.351] GetProcessHeap () returned 0x130000 [0062.351] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1426b0 [0062.351] GetProcessHeap () returned 0x130000 [0062.351] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1426b0, Size=0x72) returned 0x15d7d0 [0062.351] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x334 [0062.351] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0062.351] CloseHandle (hObject=0x334) returned 1 [0062.351] GetProcessHeap () returned 0x130000 [0062.351] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0062.351] GetProcessHeap () returned 0x130000 [0062.351] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15d7d0 | out: hHeap=0x130000) returned 1 [0062.351] Sleep (dwMilliseconds=0x3e8) [0063.417] GetProcessHeap () returned 0x130000 [0063.417] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f20 [0063.417] GetProcessHeap () returned 0x130000 [0063.417] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f70 [0063.417] GetProcessHeap () returned 0x130000 [0063.417] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e30 [0063.417] GetProcessHeap () returned 0x130000 [0063.417] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1428 [0063.417] GetProcessHeap () returned 0x130000 [0063.417] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1428 | out: hHeap=0x130000) returned 1 [0063.417] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.417] GetProcessHeap () returned 0x130000 [0063.417] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0063.417] GetProcessHeap () returned 0x130000 [0063.417] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0063.417] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.418] GetProcessHeap () returned 0x130000 [0063.418] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0063.418] GetProcessHeap () returned 0x130000 [0063.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0063.418] GetProcessHeap () returned 0x130000 [0063.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142668 [0063.418] GetProcessHeap () returned 0x130000 [0063.418] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142668, Size=0x72) returned 0x15e2d0 [0063.418] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x300 [0063.418] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0063.418] CloseHandle (hObject=0x300) returned 1 [0063.418] GetProcessHeap () returned 0x130000 [0063.418] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0063.418] GetProcessHeap () returned 0x130000 [0063.418] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e2d0 | out: hHeap=0x130000) returned 1 [0063.418] Sleep (dwMilliseconds=0x3e8) [0064.928] GetProcessHeap () returned 0x130000 [0064.928] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e80 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0a10 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0a10 | out: hHeap=0x130000) returned 1 [0064.929] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0064.929] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0064.929] GetProcessHeap () returned 0x130000 [0064.929] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15d650 [0064.929] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x334 [0064.930] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0064.930] CloseHandle (hObject=0x334) returned 1 [0064.930] GetProcessHeap () returned 0x130000 [0064.930] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0064.930] GetProcessHeap () returned 0x130000 [0064.930] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15d650 | out: hHeap=0x130000) returned 1 [0064.930] Sleep (dwMilliseconds=0x3e8) [0067.761] GetProcessHeap () returned 0x130000 [0067.761] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f70 [0067.761] GetProcessHeap () returned 0x130000 [0067.761] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0067.761] GetProcessHeap () returned 0x130000 [0067.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0680 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0680 | out: hHeap=0x130000) returned 1 [0067.762] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0067.762] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15d4d0 [0067.762] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x300 [0067.762] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0067.762] CloseHandle (hObject=0x300) returned 1 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0067.762] GetProcessHeap () returned 0x130000 [0067.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15d4d0 | out: hHeap=0x130000) returned 1 [0067.762] Sleep (dwMilliseconds=0x3e8) [0069.072] GetProcessHeap () returned 0x130000 [0069.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f20 [0069.072] GetProcessHeap () returned 0x130000 [0069.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0069.072] GetProcessHeap () returned 0x130000 [0069.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0069.072] GetProcessHeap () returned 0x130000 [0069.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0718 [0069.072] GetProcessHeap () returned 0x130000 [0069.072] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0718 | out: hHeap=0x130000) returned 1 [0069.072] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0069.072] GetProcessHeap () returned 0x130000 [0069.072] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0069.072] GetProcessHeap () returned 0x130000 [0069.072] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0069.072] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0069.073] GetProcessHeap () returned 0x130000 [0069.073] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0069.073] GetProcessHeap () returned 0x130000 [0069.073] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0069.073] GetProcessHeap () returned 0x130000 [0069.073] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0069.073] GetProcessHeap () returned 0x130000 [0069.073] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15e0d0 [0069.073] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0069.073] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0069.073] CloseHandle (hObject=0x320) returned 1 [0069.073] GetProcessHeap () returned 0x130000 [0069.073] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0069.073] GetProcessHeap () returned 0x130000 [0069.073] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e0d0 | out: hHeap=0x130000) returned 1 [0069.073] Sleep (dwMilliseconds=0x3e8) [0070.430] GetProcessHeap () returned 0x130000 [0070.430] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0070.430] GetProcessHeap () returned 0x130000 [0070.430] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e80 [0070.430] GetProcessHeap () returned 0x130000 [0070.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a08e0 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a08e0 | out: hHeap=0x130000) returned 1 [0070.431] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0070.431] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15d4d0 [0070.431] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x338 [0070.431] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0070.431] CloseHandle (hObject=0x338) returned 1 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0070.431] GetProcessHeap () returned 0x130000 [0070.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15d4d0 | out: hHeap=0x130000) returned 1 [0070.431] Sleep (dwMilliseconds=0x3e8) [0071.635] GetProcessHeap () returned 0x130000 [0071.635] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e30 [0071.635] GetProcessHeap () returned 0x130000 [0071.635] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e80 [0071.635] GetProcessHeap () returned 0x130000 [0071.635] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0071.635] GetProcessHeap () returned 0x130000 [0071.635] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1390 [0071.635] GetProcessHeap () returned 0x130000 [0071.635] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1390 | out: hHeap=0x130000) returned 1 [0071.635] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0071.635] GetProcessHeap () returned 0x130000 [0071.635] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0071.635] GetProcessHeap () returned 0x130000 [0071.635] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0071.635] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0071.636] GetProcessHeap () returned 0x130000 [0071.636] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0071.636] GetProcessHeap () returned 0x130000 [0071.636] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0071.636] GetProcessHeap () returned 0x130000 [0071.636] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0071.636] GetProcessHeap () returned 0x130000 [0071.636] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15e250 [0071.636] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x330 [0071.636] WaitForSingleObject (hHandle=0x330, dwMilliseconds=0x0) returned 0x102 [0071.636] CloseHandle (hObject=0x330) returned 1 [0071.636] GetProcessHeap () returned 0x130000 [0071.636] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0071.636] GetProcessHeap () returned 0x130000 [0071.636] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e250 | out: hHeap=0x130000) returned 1 [0071.636] Sleep (dwMilliseconds=0x3e8) [0072.807] GetProcessHeap () returned 0x130000 [0072.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f20 [0072.807] GetProcessHeap () returned 0x130000 [0072.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0072.807] GetProcessHeap () returned 0x130000 [0072.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0072.807] GetProcessHeap () returned 0x130000 [0072.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0e38 [0072.807] GetProcessHeap () returned 0x130000 [0072.807] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0e38 | out: hHeap=0x130000) returned 1 [0072.808] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0072.808] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x1426f8 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x142938 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x142938, Size=0x72) returned 0x15e1d0 [0072.808] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x32c [0072.808] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x102 [0072.808] CloseHandle (hObject=0x32c) returned 1 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1426f8 | out: hHeap=0x130000) returned 1 [0072.808] GetProcessHeap () returned 0x130000 [0072.808] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15e1d0 | out: hHeap=0x130000) returned 1 [0072.808] Sleep (dwMilliseconds=0x3e8) [0074.121] GetProcessHeap () returned 0x130000 [0074.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f70 [0074.121] GetProcessHeap () returned 0x130000 [0074.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0074.121] GetProcessHeap () returned 0x130000 [0074.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0074.122] GetProcessHeap () returned 0x130000 [0074.122] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1130 [0074.122] GetProcessHeap () returned 0x130000 [0074.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1130 | out: hHeap=0x130000) returned 1 [0074.122] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0074.122] GetProcessHeap () returned 0x130000 [0074.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0074.122] GetProcessHeap () returned 0x130000 [0074.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0074.122] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0074.270] GetProcessHeap () returned 0x130000 [0074.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0074.270] GetProcessHeap () returned 0x130000 [0074.270] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142620 [0074.270] GetProcessHeap () returned 0x130000 [0074.270] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0074.270] GetProcessHeap () returned 0x130000 [0074.270] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15dfd0 [0074.270] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x330 [0074.270] WaitForSingleObject (hHandle=0x330, dwMilliseconds=0x0) returned 0x102 [0074.271] CloseHandle (hObject=0x330) returned 1 [0074.271] GetProcessHeap () returned 0x130000 [0074.271] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142620 | out: hHeap=0x130000) returned 1 [0074.271] GetProcessHeap () returned 0x130000 [0074.271] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15dfd0 | out: hHeap=0x130000) returned 1 [0074.271] Sleep (dwMilliseconds=0x3e8) [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f70 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f20 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e80 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a1130 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a1130 | out: hHeap=0x130000) returned 1 [0075.772] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0075.772] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1422c0 [0075.772] GetProcessHeap () returned 0x130000 [0075.772] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1422c0, Size=0x72) returned 0x15db50 [0075.773] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x318 [0075.773] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0075.773] CloseHandle (hObject=0x318) returned 1 [0075.773] GetProcessHeap () returned 0x130000 [0075.773] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0075.773] GetProcessHeap () returned 0x130000 [0075.773] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15db50 | out: hHeap=0x130000) returned 1 [0075.773] Sleep (dwMilliseconds=0x3e8) [0077.225] GetProcessHeap () returned 0x130000 [0077.225] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0077.225] GetProcessHeap () returned 0x130000 [0077.225] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153e30 [0077.225] GetProcessHeap () returned 0x130000 [0077.225] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f20 [0077.225] GetProcessHeap () returned 0x130000 [0077.225] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1a0a10 [0077.225] GetProcessHeap () returned 0x130000 [0077.225] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0a10 | out: hHeap=0x130000) returned 1 [0077.225] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153e30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0077.225] GetProcessHeap () returned 0x130000 [0077.225] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0077.225] GetProcessHeap () returned 0x130000 [0077.225] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0077.225] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2f7f83c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2f7f83c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0077.226] GetProcessHeap () returned 0x130000 [0077.226] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e30 | out: hHeap=0x130000) returned 1 [0077.226] GetProcessHeap () returned 0x130000 [0077.226] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142500 [0077.226] GetProcessHeap () returned 0x130000 [0077.226] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x3a) returned 0x1425d8 [0077.226] GetProcessHeap () returned 0x130000 [0077.226] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x1425d8, Size=0x72) returned 0x15dad0 [0077.226] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x314 [0077.226] WaitForSingleObject (hHandle=0x314, dwMilliseconds=0x0) returned 0x102 [0077.226] CloseHandle (hObject=0x314) returned 1 [0077.226] GetProcessHeap () returned 0x130000 [0077.226] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x142500 | out: hHeap=0x130000) returned 1 [0077.226] GetProcessHeap () returned 0x130000 [0077.226] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15dad0 | out: hHeap=0x130000) returned 1 [0077.226] Sleep (dwMilliseconds=0x3e8) Thread: id = 17 os_tid = 0xda0 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x21a) returned 0x15b6d8 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x148648 [0047.429] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x27c [0047.429] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0047.429] GetComputerNameW (in: lpBuffer=0x15b6e8, nSize=0x30bf968 | out: lpBuffer="NQDPDE", nSize=0x30bf968) returned 1 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f20 [0047.429] CloseHandle (hObject=0x2bc) returned 1 [0047.429] CloseHandle (hObject=0x27c) returned 1 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x148648 | out: hHeap=0x130000) returned 1 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15b6d8 | out: hHeap=0x130000) returned 1 [0047.429] GetProcessHeap () returned 0x130000 [0047.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14a000 | out: hHeap=0x130000) returned 1 Thread: id = 18 os_tid = 0x58 [0047.431] GetLogicalDrives () returned 0x4 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142590 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x148588 [0047.431] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x27c [0047.431] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0047.431] GetProcessHeap () returned 0x130000 [0047.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153f70 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f20 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153e08 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0047.431] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e08 | out: hHeap=0x130000) returned 1 [0047.431] GetProcessHeap () returned 0x130000 [0047.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0047.431] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x31ffadc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x31ffadc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.432] GetProcessHeap () returned 0x130000 [0047.432] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0047.432] GetProcessHeap () returned 0x130000 [0047.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6f0 [0047.432] GetProcessHeap () returned 0x130000 [0047.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f780 [0047.432] GetProcessHeap () returned 0x130000 [0047.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f678 [0047.432] GetProcessHeap () returned 0x130000 [0047.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0047.432] GetProcessHeap () returned 0x130000 [0047.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f690 [0047.432] htonl (hostlong=0xb4197730) returned 0x307719b4 [0047.432] QueryPerformanceCounter (in: lpPerformanceCount=0x31ff9d0 | out: lpPerformanceCount=0x31ff9d0*=14328847032) returned 1 [0047.432] GetTickCount () returned 0x114d812 [0047.432] GetCurrentProcessId () returned 0x11a8 [0047.432] GetCurrentThreadId () returned 0x58 [0047.432] GetLocalTime (in: lpSystemTime=0x31ff9b8 | out: lpSystemTime=0x31ff9b8*(wYear=0x7e4, wMonth=0x7, wDayOfWeek=0x6, wDay=0xb, wHour=0xf, wMinute=0x27, wSecond=0x38, wMilliseconds=0xa3)) [0047.432] SystemTimeToFileTime (in: lpSystemTime=0x31ff9b8, lpFileTime=0x31ff9c8 | out: lpFileTime=0x31ff9c8) returned 1 [0047.432] QueryPerformanceCounter (in: lpPerformanceCount=0x31ff9d0 | out: lpPerformanceCount=0x31ff9d0*=14328872179) returned 1 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x28) returned 0x148648 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6c0 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x1494f8 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x14) returned 0x149e00 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6d8 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x80) returned 0x1414d8 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f810 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x82) returned 0x1429f8 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f708 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x149508 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f720 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x80) returned 0x159ef8 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f738 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x2) returned 0x149518 [0047.433] GetProcessHeap () returned 0x130000 [0047.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x15b748 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f750 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x80) returned 0x14e180 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15c098 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x15b8d8 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x149518, Size=0x82) returned 0x14e208 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x15b8d8, Size=0x100) returned 0x141db0 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15bf00 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x82) returned 0x141eb8 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15be70 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x82) returned 0x15c2e8 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x14e208, Size=0x104) returned 0x15c378 [0047.434] GetProcessHeap () returned 0x130000 [0047.434] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x141db0, Size=0x200) returned 0x15c488 [0047.435] GetProcessHeap () returned 0x130000 [0047.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15b748 | out: hHeap=0x130000) returned 1 [0047.435] GetProcessHeap () returned 0x130000 [0047.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c488 | out: hHeap=0x130000) returned 1 [0047.435] GetProcessHeap () returned 0x130000 [0047.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c098 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159ef8 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f720 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f750 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c378 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f738 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141eb8 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15bf00 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c2e8 | out: hHeap=0x130000) returned 1 [0047.436] GetProcessHeap () returned 0x130000 [0047.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15be70 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1494f8 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6c0 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1429f8 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f810 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1414d8 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6d8 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x149508 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f708 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x148648 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x149e00 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xa4) returned 0x140cb8 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f780 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f678 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f690 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6f0 | out: hHeap=0x130000) returned 1 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x18) returned 0x149e40 [0047.437] GetProcessHeap () returned 0x130000 [0047.437] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0xe) returned 0x14f678 [0047.437] ResetEvent (hEvent=0x2bc) returned 1 [0047.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f56b3, lpParameter=0x149e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0047.438] CloseHandle (hObject=0x2c0) returned 1 [0047.438] GetProcessHeap () returned 0x130000 [0047.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f690 [0047.438] GetProcessHeap () returned 0x130000 [0047.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6d8 [0047.438] GetProcessHeap () returned 0x130000 [0047.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6f0 [0047.438] GetProcessHeap () returned 0x130000 [0047.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0047.438] GetProcessHeap () returned 0x130000 [0047.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f6c0 [0047.438] htonl (hostlong=0xb4197730) returned 0x307719b4 [0047.438] GetProcessHeap () returned 0x130000 [0047.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x28) returned 0x148648 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f708 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x1494f8 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x14) returned 0x14a000 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f810 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x80) returned 0x1414d8 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f720 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x82) returned 0x1429f8 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f738 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x149508 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f750 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x80) returned 0x159ef8 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x14f780 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x2) returned 0x149518 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x15b748 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15bbe8 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x80) returned 0x14e180 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15bc78 [0047.439] GetProcessHeap () returned 0x130000 [0047.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x4) returned 0x15b778 [0047.439] GetProcessHeap () returned 0x130000 [0047.440] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x149518, Size=0x82) returned 0x14e208 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x15b778, Size=0x100) returned 0x141db0 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15bc90 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x82) returned 0x141eb8 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10) returned 0x15bc00 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x82) returned 0x15c2e8 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x14e208, Size=0x104) returned 0x15c378 [0047.440] GetProcessHeap () returned 0x130000 [0047.440] RtlReAllocateHeap (Heap=0x130000, Flags=0x0, Ptr=0x141db0, Size=0x200) returned 0x15c488 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15b748 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c488 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15bc78 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x159ef8 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f750 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14e180 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15bbe8 | out: hHeap=0x130000) returned 1 [0047.441] GetProcessHeap () returned 0x130000 [0047.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c378 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f780 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x141eb8 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15bc90 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15c2e8 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x15bc00 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1494f8 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f708 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1429f8 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f720 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1414d8 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f810 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x149508 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f738 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x148648 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14a000 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0xa4) returned 0x140f78 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6d8 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6f0 | out: hHeap=0x130000) returned 1 [0047.442] GetProcessHeap () returned 0x130000 [0047.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0047.443] GetProcessHeap () returned 0x130000 [0047.443] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f6c0 | out: hHeap=0x130000) returned 1 [0047.443] GetProcessHeap () returned 0x130000 [0047.443] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14f690 | out: hHeap=0x130000) returned 1 [0047.443] GetProcessHeap () returned 0x130000 [0047.443] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x18) returned 0x14a000 [0047.443] GetProcessHeap () returned 0x130000 [0047.443] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0xe) returned 0x14f690 [0047.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f56b3, lpParameter=0x14a000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0047.443] CloseHandle (hObject=0x2c0) returned 1 [0047.444] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) Thread: id = 19 os_tid = 0xb90 [0047.445] GetLogicalDrives () returned 0x4 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x20) returned 0x153e80 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x8, Size=0x1e) returned 0x153f20 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x1e) returned 0x153f70 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x90) returned 0x1598b8 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1598b8 | out: hHeap=0x130000) returned 1 [0047.445] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x153f20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f70 | out: hHeap=0x130000) returned 1 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153e80 | out: hHeap=0x130000) returned 1 [0047.445] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x333fa5c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x333fa5c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x153f20 | out: hHeap=0x130000) returned 1 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x40) returned 0x142470 [0047.445] GetProcessHeap () returned 0x130000 [0047.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x15be40 [0047.445] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0047.445] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0047.446] GetLogicalDrives () returned 0x4 [0047.446] Sleep (dwMilliseconds=0x3e8) [0048.696] GetLogicalDrives () returned 0x4 [0048.696] Sleep (dwMilliseconds=0x3e8) [0050.130] GetLogicalDrives () returned 0x4 [0050.130] Sleep (dwMilliseconds=0x3e8) [0051.346] GetLogicalDrives () returned 0x4 [0051.346] Sleep (dwMilliseconds=0x3e8) [0052.575] GetLogicalDrives () returned 0x4 [0052.575] Sleep (dwMilliseconds=0x3e8) [0053.729] GetLogicalDrives () returned 0x4 [0053.729] Sleep (dwMilliseconds=0x3e8) [0054.954] GetLogicalDrives () returned 0x4 [0054.954] Sleep (dwMilliseconds=0x3e8) [0056.173] GetLogicalDrives () returned 0x4 [0056.173] Sleep (dwMilliseconds=0x3e8) [0057.487] GetLogicalDrives () returned 0x4 [0057.487] Sleep (dwMilliseconds=0x3e8) [0058.681] GetLogicalDrives () returned 0x4 [0058.681] Sleep (dwMilliseconds=0x3e8) [0060.324] GetLogicalDrives () returned 0x4 [0060.324] Sleep (dwMilliseconds=0x3e8) [0061.437] GetLogicalDrives () returned 0x4 [0061.437] Sleep (dwMilliseconds=0x3e8) [0062.678] GetLogicalDrives () returned 0x4 [0062.679] Sleep (dwMilliseconds=0x3e8) [0063.769] GetLogicalDrives () returned 0x4 [0063.769] Sleep (dwMilliseconds=0x3e8) [0064.946] GetLogicalDrives () returned 0x4 [0064.947] Sleep (dwMilliseconds=0x3e8) [0067.759] GetLogicalDrives () returned 0x4 [0067.760] Sleep (dwMilliseconds=0x3e8) [0069.075] GetLogicalDrives () returned 0x4 [0069.075] Sleep (dwMilliseconds=0x3e8) [0070.413] GetLogicalDrives () returned 0x4 [0070.413] Sleep (dwMilliseconds=0x3e8) [0071.638] GetLogicalDrives () returned 0x4 [0071.638] Sleep (dwMilliseconds=0x3e8) [0072.805] GetLogicalDrives () returned 0x4 [0072.805] Sleep (dwMilliseconds=0x3e8) [0074.123] GetLogicalDrives () returned 0x4 [0074.123] Sleep (dwMilliseconds=0x3e8) [0075.368] GetLogicalDrives () returned 0x4 [0075.368] Sleep (dwMilliseconds=0x3e8) [0076.765] GetLogicalDrives () returned 0x4 [0076.765] Sleep (dwMilliseconds=0x3e8) Thread: id = 20 os_tid = 0xce0 [0049.908] GetProcessHeap () returned 0x130000 [0049.908] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x38) returned 0x18f6d8 [0049.908] GetProcessHeap () returned 0x130000 [0049.908] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x18) returned 0x149e60 [0049.908] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e4 [0049.911] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e8 [0049.911] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec [0049.911] GetProcessHeap () returned 0x130000 [0049.911] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1b0dc8 [0049.922] GetProcessHeap () returned 0x130000 [0049.922] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1c0dd0 [0049.931] GetProcessHeap () returned 0x130000 [0049.931] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14ed58 [0049.933] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0049.933] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0049.933] Wow64DisableWow64FsRedirection (in: OldValue=0x30bfbec | out: OldValue=0x30bfbec*=0x0) returned 1 [0049.934] GetProcessHeap () returned 0x130000 [0049.934] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ed58 | out: hHeap=0x130000) returned 1 [0049.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x11f54bf, lpParameter=0x30bfbf4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0049.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x11f54bf, lpParameter=0x30bfbf4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0049.949] GetProcessHeap () returned 0x130000 [0049.949] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1e0de0 [0049.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x18fd18 [0049.949] GetProcessHeap () returned 0x130000 [0049.949] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0049.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0049.950] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0049.950] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0049.950] GetProcessHeap () returned 0x130000 [0049.950] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x200df0 [0049.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0049.951] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.951] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0049.951] SetEvent (hEvent=0x2e8) returned 1 [0049.951] ResetEvent (hEvent=0x2ec) returned 1 [0049.951] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0049.951] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0049.952] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0049.952] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0049.952] GetProcessHeap () returned 0x130000 [0049.952] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x200df0 | out: hHeap=0x130000) returned 1 [0049.953] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0049.953] GetProcessHeap () returned 0x130000 [0049.953] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x200df0 [0049.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0049.954] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0049.954] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0049.955] GetProcessHeap () returned 0x130000 [0049.955] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x200df0 | out: hHeap=0x130000) returned 1 [0049.955] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0049.955] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0049.955] GetProcessHeap () returned 0x130000 [0049.955] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0049.956] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0049.956] GetProcessHeap () returned 0x130000 [0049.956] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0049.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0049.957] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0049.957] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0049.957] GetProcessHeap () returned 0x130000 [0049.957] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x200df0 [0049.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0049.957] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.957] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.957] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.957] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0049.957] GetProcessHeap () returned 0x130000 [0049.957] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x200df0 | out: hHeap=0x130000) returned 1 [0049.957] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0049.957] GetProcessHeap () returned 0x130000 [0049.957] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x200df0 [0049.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0049.958] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.958] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.958] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.958] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0049.958] GetProcessHeap () returned 0x130000 [0049.958] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x200df0 | out: hHeap=0x130000) returned 1 [0049.958] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0049.958] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0049.959] GetProcessHeap () returned 0x130000 [0049.959] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0049.959] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0049.959] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0049.959] GetProcessHeap () returned 0x130000 [0049.959] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0049.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0050.146] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1 [0050.146] GetProcessHeap () returned 0x130000 [0050.146] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0051.429] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.429] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.429] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.429] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.429] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.429] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0051.429] GetProcessHeap () returned 0x130000 [0051.429] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.430] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1 [0051.430] GetProcessHeap () returned 0x130000 [0051.430] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0051.430] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.430] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.430] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.430] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.431] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0051.431] GetProcessHeap () returned 0x130000 [0051.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1 [0051.431] GetProcessHeap () returned 0x130000 [0051.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.431] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.431] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0051.431] GetProcessHeap () returned 0x130000 [0051.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.431] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1 [0051.432] GetProcessHeap () returned 0x130000 [0051.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0051.432] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.432] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.432] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.432] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.432] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.432] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0051.432] GetProcessHeap () returned 0x130000 [0051.432] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.432] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1 [0051.432] GetProcessHeap () returned 0x130000 [0051.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0051.433] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.433] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0051.433] GetProcessHeap () returned 0x130000 [0051.433] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1 [0051.433] GetProcessHeap () returned 0x130000 [0051.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0051.433] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.433] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.434] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0051.434] GetProcessHeap () returned 0x130000 [0051.434] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1 [0051.434] GetProcessHeap () returned 0x130000 [0051.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.434] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.434] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.435] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0051.435] GetProcessHeap () returned 0x130000 [0051.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.435] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1 [0051.435] GetProcessHeap () returned 0x130000 [0051.435] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0051.435] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.435] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.435] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.435] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.435] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.435] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0051.435] GetProcessHeap () returned 0x130000 [0051.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.435] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1 [0051.435] GetProcessHeap () returned 0x130000 [0051.435] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.436] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.436] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0051.436] GetProcessHeap () returned 0x130000 [0051.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1 [0051.436] GetProcessHeap () returned 0x130000 [0051.436] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0051.436] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.436] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.437] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0051.437] GetProcessHeap () returned 0x130000 [0051.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1 [0051.437] GetProcessHeap () returned 0x130000 [0051.437] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.437] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.437] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.437] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0051.437] GetProcessHeap () returned 0x130000 [0051.437] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.438] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1 [0051.438] GetProcessHeap () returned 0x130000 [0051.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0051.438] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.438] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.438] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.438] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.438] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.438] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0051.438] GetProcessHeap () returned 0x130000 [0051.438] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.438] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1 [0051.438] GetProcessHeap () returned 0x130000 [0051.438] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0051.438] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.439] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.439] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.439] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.439] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.439] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0051.439] GetProcessHeap () returned 0x130000 [0051.439] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.439] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1 [0051.439] GetProcessHeap () returned 0x130000 [0051.439] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0051.440] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.440] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.440] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.440] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.440] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.440] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0051.440] GetProcessHeap () returned 0x130000 [0051.440] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.440] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1 [0051.440] GetProcessHeap () returned 0x130000 [0051.440] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0051.441] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.441] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.441] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.441] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.441] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.441] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0051.441] GetProcessHeap () returned 0x130000 [0051.441] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.441] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1 [0051.441] GetProcessHeap () returned 0x130000 [0051.441] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0051.442] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.442] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.442] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.442] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.442] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.442] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0051.443] GetProcessHeap () returned 0x130000 [0051.443] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.443] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1 [0051.443] GetProcessHeap () returned 0x130000 [0051.443] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0051.444] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.444] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.444] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.444] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.444] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.444] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0051.444] GetProcessHeap () returned 0x130000 [0051.445] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.445] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1 [0051.445] GetProcessHeap () returned 0x130000 [0051.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0051.445] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.445] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.446] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0051.446] GetProcessHeap () returned 0x130000 [0051.446] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1 [0051.446] GetProcessHeap () returned 0x130000 [0051.446] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0051.446] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.447] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.447] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.447] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0051.447] GetProcessHeap () returned 0x130000 [0051.447] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.447] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1 [0051.447] GetProcessHeap () returned 0x130000 [0051.447] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0051.448] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.448] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.448] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.448] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.448] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.448] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0051.448] GetProcessHeap () returned 0x130000 [0051.448] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.448] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1 [0051.448] GetProcessHeap () returned 0x130000 [0051.448] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0051.449] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.449] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.449] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.449] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.449] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.449] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0051.449] GetProcessHeap () returned 0x130000 [0051.449] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.449] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1 [0051.450] GetProcessHeap () returned 0x130000 [0051.450] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0051.450] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.450] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.450] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.450] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.450] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.450] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0051.450] GetProcessHeap () returned 0x130000 [0051.450] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.450] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1 [0051.450] GetProcessHeap () returned 0x130000 [0051.450] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0051.451] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.451] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.451] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.451] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.451] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.451] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0051.451] GetProcessHeap () returned 0x130000 [0051.451] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.451] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1 [0051.451] GetProcessHeap () returned 0x130000 [0051.451] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0051.451] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.451] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.452] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.452] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.452] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.452] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0051.452] GetProcessHeap () returned 0x130000 [0051.452] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.452] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1 [0051.452] GetProcessHeap () returned 0x130000 [0051.452] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0051.453] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.453] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.453] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.453] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.453] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.453] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0051.453] GetProcessHeap () returned 0x130000 [0051.453] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.453] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1 [0051.453] GetProcessHeap () returned 0x130000 [0051.453] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0051.454] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.454] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0051.454] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0051.454] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0051.454] FindClose (in: hFindFile=0x18fa58 | out: hFindFile=0x18fa58) returned 1 [0051.455] GetProcessHeap () returned 0x130000 [0051.455] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.455] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0051.455] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0051.455] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1 [0051.455] GetProcessHeap () returned 0x130000 [0051.455] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0051.455] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.455] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0051.455] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0051.455] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0051.455] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0051.456] GetProcessHeap () returned 0x130000 [0051.456] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.456] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1 [0051.456] GetProcessHeap () returned 0x130000 [0051.456] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0051.458] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.458] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0051.459] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0051.460] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0051.460] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0051.460] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0051.460] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0051.460] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0051.460] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0051.461] GetProcessHeap () returned 0x130000 [0051.461] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0051.461] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0051.461] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0051.461] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0051.461] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0051.461] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0051.461] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0051.462] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0051.462] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0051.462] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0051.462] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0051.463] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0051.464] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0051.464] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0051.464] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0051.464] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0051.464] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0051.464] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0051.464] GetProcessHeap () returned 0x130000 [0051.464] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0051.464] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0051.464] GetProcessHeap () returned 0x130000 [0051.464] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0051.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0051.466] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0051.684] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1 [0051.686] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0051.689] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0051.691] GetProcessHeap () returned 0x130000 [0051.693] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0051.701] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.703] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0051.703] GetProcessHeap () returned 0x130000 [0051.703] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0051.703] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0051.703] GetProcessHeap () returned 0x130000 [0051.703] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0051.703] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.704] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0051.704] GetProcessHeap () returned 0x130000 [0051.704] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="da-DK", cAlternateFileName="")) returned 1 [0051.704] GetProcessHeap () returned 0x130000 [0051.704] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0051.704] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.704] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.704] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0051.704] GetProcessHeap () returned 0x130000 [0051.704] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="de-DE", cAlternateFileName="")) returned 1 [0051.705] GetProcessHeap () returned 0x130000 [0051.705] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0051.705] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.705] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0051.705] GetProcessHeap () returned 0x130000 [0051.705] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="el-GR", cAlternateFileName="")) returned 1 [0051.705] GetProcessHeap () returned 0x130000 [0051.705] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0051.705] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.705] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.706] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0051.706] GetProcessHeap () returned 0x130000 [0051.706] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="en-GB", cAlternateFileName="")) returned 1 [0051.706] GetProcessHeap () returned 0x130000 [0051.706] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0051.706] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.706] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0051.706] GetProcessHeap () returned 0x130000 [0051.706] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.706] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.706] GetProcessHeap () returned 0x130000 [0051.706] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0051.706] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.707] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.707] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.707] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.707] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0051.707] GetProcessHeap () returned 0x130000 [0051.707] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.707] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="es-ES", cAlternateFileName="")) returned 1 [0051.707] GetProcessHeap () returned 0x130000 [0051.707] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.707] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.707] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.707] GetProcessHeap () returned 0x130000 [0051.707] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.707] GetProcessHeap () returned 0x130000 [0051.707] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0051.708] GetProcessHeap () returned 0x130000 [0051.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.708] GetProcessHeap () returned 0x130000 [0051.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0051.708] GetProcessHeap () returned 0x130000 [0051.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.708] GetProcessHeap () returned 0x130000 [0051.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.708] GetProcessHeap () returned 0x130000 [0051.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.708] GetProcessHeap () returned 0x130000 [0051.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb98 [0051.710] GetProcessHeap () returned 0x130000 [0051.710] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0051.711] GetProcessHeap () returned 0x130000 [0051.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.712] GetProcessHeap () returned 0x130000 [0051.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0051.713] GetProcessHeap () returned 0x130000 [0051.713] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.713] GetProcessHeap () returned 0x130000 [0051.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0051.713] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.713] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.713] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0051.713] GetProcessHeap () returned 0x130000 [0051.713] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.713] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0051.713] GetProcessHeap () returned 0x130000 [0051.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.920] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.920] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.920] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.920] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.920] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.920] GetProcessHeap () returned 0x130000 [0051.920] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.920] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0051.920] GetProcessHeap () returned 0x130000 [0051.920] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0051.921] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.921] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.921] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.921] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.921] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0051.921] GetProcessHeap () returned 0x130000 [0051.921] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.921] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0051.921] GetProcessHeap () returned 0x130000 [0051.921] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0051.922] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.922] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0051.922] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.922] GetProcessHeap () returned 0x130000 [0051.922] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e2758 [0051.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.923] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.923] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0051.923] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0051.923] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0051.923] GetProcessHeap () returned 0x130000 [0051.924] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e2758 | out: hHeap=0x130000) returned 1 [0051.924] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0051.924] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0051.924] GetProcessHeap () returned 0x130000 [0051.924] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.924] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0051.924] GetProcessHeap () returned 0x130000 [0051.924] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.925] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.925] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.925] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.925] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.925] GetProcessHeap () returned 0x130000 [0051.925] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.925] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0051.925] GetProcessHeap () returned 0x130000 [0051.925] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0051.927] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.927] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.927] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.927] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.927] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0051.927] GetProcessHeap () returned 0x130000 [0051.927] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.927] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0051.927] GetProcessHeap () returned 0x130000 [0051.927] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0051.928] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.928] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.928] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.928] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0051.928] GetProcessHeap () returned 0x130000 [0051.928] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.928] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0051.928] GetProcessHeap () returned 0x130000 [0051.928] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.929] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.929] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.929] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.930] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0051.930] GetProcessHeap () returned 0x130000 [0051.930] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.930] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0051.930] GetProcessHeap () returned 0x130000 [0051.930] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0051.930] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.930] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.930] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.930] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.930] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0051.930] GetProcessHeap () returned 0x130000 [0051.930] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.930] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0051.930] GetProcessHeap () returned 0x130000 [0051.930] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.931] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.932] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.932] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.932] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0051.932] GetProcessHeap () returned 0x130000 [0051.932] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.932] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0051.932] GetProcessHeap () returned 0x130000 [0051.932] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.936] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.936] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.936] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.936] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.936] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0051.937] GetProcessHeap () returned 0x130000 [0051.937] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.937] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0051.937] GetProcessHeap () returned 0x130000 [0051.937] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.937] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.937] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.937] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.937] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.937] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0051.937] GetProcessHeap () returned 0x130000 [0051.937] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.937] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0051.938] GetProcessHeap () returned 0x130000 [0051.938] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0051.956] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.957] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.957] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.957] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0051.957] GetProcessHeap () returned 0x130000 [0051.957] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.957] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0051.957] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0051.957] GetProcessHeap () returned 0x130000 [0051.957] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0051.958] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.958] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.958] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.958] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.958] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0051.958] GetProcessHeap () returned 0x130000 [0051.958] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.958] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0051.958] GetProcessHeap () returned 0x130000 [0051.958] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0051.959] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.959] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.959] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.959] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.959] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0051.959] GetProcessHeap () returned 0x130000 [0051.959] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.959] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0051.959] GetProcessHeap () returned 0x130000 [0051.959] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0051.999] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.999] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.000] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.000] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.000] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0052.000] GetProcessHeap () returned 0x130000 [0052.000] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0052.000] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0052.000] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0052.000] GetProcessHeap () returned 0x130000 [0052.000] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0052.001] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0052.001] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0052.001] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0052.001] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0052.001] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0052.001] GetProcessHeap () returned 0x130000 [0052.001] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0052.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fb98 [0052.010] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0052.010] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 0 [0052.010] FindClose (in: hFindFile=0x18fb98 | out: hFindFile=0x18fb98) returned 1 [0052.010] GetProcessHeap () returned 0x130000 [0052.010] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0052.010] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab460c6f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0052.010] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0052.011] GetProcessHeap () returned 0x130000 [0052.011] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0052.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0052.197] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0052.277] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0052.278] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0052.279] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0052.280] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0052.281] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0052.282] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0052.283] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0052.284] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0052.286] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0052.287] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0052.288] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0052.288] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0052.288] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0052.864] GetProcessHeap () returned 0x130000 [0052.864] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xaced8ceb, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0052.956] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0052.956] GetProcessHeap () returned 0x130000 [0052.956] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0052.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0052.957] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 0 [0052.957] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0052.957] GetProcessHeap () returned 0x130000 [0052.957] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1f0de8 | out: hHeap=0x130000) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x18fd18, lpFindFileData=0x30bf968 | out: lpFindFileData=0x30bf968*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0052.957] GetProcessHeap () returned 0x130000 [0052.957] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1f0de8 [0052.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fb98 [0052.958] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0052.958] GetProcessHeap () returned 0x130000 [0052.958] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0052.958] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0052.958] GetProcessHeap () returned 0x130000 [0052.958] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0052.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0052.961] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0052.961] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0052.961] GetProcessHeap () returned 0x130000 [0052.961] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0052.961] GetProcessHeap () returned 0x130000 [0052.961] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0052.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0052.962] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0052.962] GetProcessHeap () returned 0x130000 [0052.962] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0052.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0052.964] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0052.972] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0052.973] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0052.973] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0052.973] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0052.973] GetProcessHeap () returned 0x130000 [0052.973] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0052.973] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0052.973] GetProcessHeap () returned 0x130000 [0052.973] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0052.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0052.974] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.975] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0052.976] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0052.976] GetProcessHeap () returned 0x130000 [0052.976] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0052.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0052.977] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.977] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.977] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.980] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0052.980] GetProcessHeap () returned 0x130000 [0052.980] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0052.980] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0052.980] GetProcessHeap () returned 0x130000 [0052.980] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0052.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0052.980] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.980] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.980] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.980] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0052.980] GetProcessHeap () returned 0x130000 [0052.980] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0052.980] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0052.981] GetProcessHeap () returned 0x130000 [0052.981] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0052.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0052.981] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.981] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0052.981] GetProcessHeap () returned 0x130000 [0052.981] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0052.981] GetProcessHeap () returned 0x130000 [0052.981] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0052.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0052.981] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.981] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.982] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0052.982] GetProcessHeap () returned 0x130000 [0052.982] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0052.982] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.982] GetProcessHeap () returned 0x130000 [0052.982] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0052.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.025] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.025] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.025] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.028] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0053.029] GetProcessHeap () returned 0x130000 [0053.029] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.029] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0053.029] GetProcessHeap () returned 0x130000 [0053.029] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0053.029] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.029] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.029] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.029] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0053.030] GetProcessHeap () returned 0x130000 [0053.030] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.030] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0053.030] GetProcessHeap () returned 0x130000 [0053.030] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0053.030] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.030] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.030] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.030] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0053.030] GetProcessHeap () returned 0x130000 [0053.030] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.030] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0053.030] GetProcessHeap () returned 0x130000 [0053.030] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0053.032] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0053.033] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0053.035] GetProcessHeap () returned 0x130000 [0053.035] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.035] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0053.035] GetProcessHeap () returned 0x130000 [0053.035] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.037] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.037] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.037] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.037] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.037] GetProcessHeap () returned 0x130000 [0053.037] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.037] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0053.037] GetProcessHeap () returned 0x130000 [0053.037] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.037] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.038] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.038] GetProcessHeap () returned 0x130000 [0053.038] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0053.038] GetProcessHeap () returned 0x130000 [0053.038] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0053.038] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.038] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0053.038] GetProcessHeap () returned 0x130000 [0053.038] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.038] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0053.038] GetProcessHeap () returned 0x130000 [0053.038] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.039] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.039] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.039] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.039] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0053.039] GetProcessHeap () returned 0x130000 [0053.039] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.039] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0053.039] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0053.039] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0053.039] GetProcessHeap () returned 0x130000 [0053.039] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.042] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.042] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.042] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.042] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0053.043] GetProcessHeap () returned 0x130000 [0053.043] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.043] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0053.043] GetProcessHeap () returned 0x130000 [0053.043] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.043] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.043] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.043] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.043] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0053.043] GetProcessHeap () returned 0x130000 [0053.043] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.043] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0053.043] GetProcessHeap () returned 0x130000 [0053.043] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0053.045] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.047] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0053.047] GetProcessHeap () returned 0x130000 [0053.047] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.048] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0053.048] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0053.048] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0053.048] GetProcessHeap () returned 0x130000 [0053.048] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.048] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0053.048] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0053.048] GetProcessHeap () returned 0x130000 [0053.048] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0053.050] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.050] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0053.050] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0053.050] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0053.050] GetProcessHeap () returned 0x130000 [0053.050] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.050] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0053.050] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0053.050] GetProcessHeap () returned 0x130000 [0053.050] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.051] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.051] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0053.051] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0053.051] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0053.051] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0053.051] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0053.051] GetProcessHeap () returned 0x130000 [0053.051] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.051] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0053.051] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0053.051] GetProcessHeap () returned 0x130000 [0053.051] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0053.056] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.059] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0053.069] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0053.070] GetProcessHeap () returned 0x130000 [0053.070] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.070] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0053.070] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0053.070] GetProcessHeap () returned 0x130000 [0053.070] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.070] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.070] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0053.071] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0053.071] GetProcessHeap () returned 0x130000 [0053.071] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0053.071] GetProcessHeap () returned 0x130000 [0053.071] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.071] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0053.071] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0053.071] GetProcessHeap () returned 0x130000 [0053.071] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0053.071] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1 [0053.071] GetProcessHeap () returned 0x130000 [0053.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.072] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0053.072] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0053.072] GetProcessHeap () returned 0x130000 [0053.072] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0053.072] GetProcessHeap () returned 0x130000 [0053.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.072] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0053.072] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0053.072] GetProcessHeap () returned 0x130000 [0053.073] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0053.073] GetProcessHeap () returned 0x130000 [0053.073] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.073] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0053.073] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.073] GetProcessHeap () returned 0x130000 [0053.073] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0053.073] GetProcessHeap () returned 0x130000 [0053.073] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.074] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0053.074] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0053.074] GetProcessHeap () returned 0x130000 [0053.074] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0053.074] FindClose (in: hFindFile=0x18fa58 | out: hFindFile=0x18fa58) returned 1 [0053.074] GetProcessHeap () returned 0x130000 [0053.074] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0053.075] GetProcessHeap () returned 0x130000 [0053.075] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0053.076] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.076] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0053.076] GetProcessHeap () returned 0x130000 [0053.076] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0053.076] GetProcessHeap () returned 0x130000 [0053.076] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0053.076] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.077] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0053.077] GetProcessHeap () returned 0x130000 [0053.077] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0053.077] GetProcessHeap () returned 0x130000 [0053.077] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.077] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.077] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0053.077] GetProcessHeap () returned 0x130000 [0053.077] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0053.077] GetProcessHeap () returned 0x130000 [0053.077] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.078] GetProcessHeap () returned 0x130000 [0053.078] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0053.284] GetProcessHeap () returned 0x130000 [0053.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.284] GetProcessHeap () returned 0x130000 [0053.284] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.284] GetProcessHeap () returned 0x130000 [0053.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.284] GetProcessHeap () returned 0x130000 [0053.284] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.285] GetProcessHeap () returned 0x130000 [0053.285] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.285] GetProcessHeap () returned 0x130000 [0053.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.286] GetProcessHeap () returned 0x130000 [0053.286] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.286] GetProcessHeap () returned 0x130000 [0053.286] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.286] GetProcessHeap () returned 0x130000 [0053.287] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.287] GetProcessHeap () returned 0x130000 [0053.287] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.287] GetProcessHeap () returned 0x130000 [0053.287] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.287] GetProcessHeap () returned 0x130000 [0053.287] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.287] GetProcessHeap () returned 0x130000 [0053.287] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.287] GetProcessHeap () returned 0x130000 [0053.287] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.288] GetProcessHeap () returned 0x130000 [0053.288] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.288] GetProcessHeap () returned 0x130000 [0053.288] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.289] GetProcessHeap () returned 0x130000 [0053.289] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.289] GetProcessHeap () returned 0x130000 [0053.289] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0053.289] GetProcessHeap () returned 0x130000 [0053.289] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.289] GetProcessHeap () returned 0x130000 [0053.289] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.289] GetProcessHeap () returned 0x130000 [0053.289] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.289] GetProcessHeap () returned 0x130000 [0053.289] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0053.290] GetProcessHeap () returned 0x130000 [0053.290] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.290] GetProcessHeap () returned 0x130000 [0053.290] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0053.290] GetProcessHeap () returned 0x130000 [0053.290] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.290] GetProcessHeap () returned 0x130000 [0053.290] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.291] GetProcessHeap () returned 0x130000 [0053.291] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.291] GetProcessHeap () returned 0x130000 [0053.291] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0053.291] GetProcessHeap () returned 0x130000 [0053.291] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.291] GetProcessHeap () returned 0x130000 [0053.291] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.339] GetProcessHeap () returned 0x130000 [0053.339] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.339] GetProcessHeap () returned 0x130000 [0053.340] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.340] GetProcessHeap () returned 0x130000 [0053.340] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.340] GetProcessHeap () returned 0x130000 [0053.340] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0053.340] GetProcessHeap () returned 0x130000 [0053.340] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.340] GetProcessHeap () returned 0x130000 [0053.340] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.340] GetProcessHeap () returned 0x130000 [0053.341] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.341] GetProcessHeap () returned 0x130000 [0053.341] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.341] GetProcessHeap () returned 0x130000 [0053.341] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.341] GetProcessHeap () returned 0x130000 [0053.341] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0053.342] GetProcessHeap () returned 0x130000 [0053.342] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.342] GetProcessHeap () returned 0x130000 [0053.342] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0053.343] GetProcessHeap () returned 0x130000 [0053.343] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.343] GetProcessHeap () returned 0x130000 [0053.343] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0053.344] GetProcessHeap () returned 0x130000 [0053.344] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0053.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.344] GetProcessHeap () returned 0x130000 [0053.344] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.345] GetProcessHeap () returned 0x130000 [0053.345] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.345] GetProcessHeap () returned 0x130000 [0053.345] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0053.346] GetProcessHeap () returned 0x130000 [0053.346] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0053.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0053.347] GetProcessHeap () returned 0x130000 [0053.347] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0053.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0053.351] GetProcessHeap () returned 0x130000 [0053.351] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0053.351] GetProcessHeap () returned 0x130000 [0053.351] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0053.351] GetProcessHeap () returned 0x130000 [0053.351] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0053.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0053.353] GetProcessHeap () returned 0x130000 [0053.353] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0053.353] GetProcessHeap () returned 0x130000 [0053.353] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0053.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.353] GetProcessHeap () returned 0x130000 [0053.354] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0053.354] GetProcessHeap () returned 0x130000 [0053.354] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0053.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0054.250] GetProcessHeap () returned 0x130000 [0054.250] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0054.250] GetProcessHeap () returned 0x130000 [0054.250] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0054.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0054.251] GetProcessHeap () returned 0x130000 [0054.251] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0054.251] GetProcessHeap () returned 0x130000 [0054.251] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.251] GetProcessHeap () returned 0x130000 [0054.251] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0054.251] GetProcessHeap () returned 0x130000 [0054.251] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0054.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0054.252] GetProcessHeap () returned 0x130000 [0054.252] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0054.252] GetProcessHeap () returned 0x130000 [0054.252] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.252] GetProcessHeap () returned 0x130000 [0054.252] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0054.253] GetProcessHeap () returned 0x130000 [0054.253] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0054.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0054.277] GetProcessHeap () returned 0x130000 [0054.277] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0054.277] GetProcessHeap () returned 0x130000 [0054.277] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0054.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0054.285] GetProcessHeap () returned 0x130000 [0054.285] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0054.285] GetProcessHeap () returned 0x130000 [0054.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0054.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0054.285] GetProcessHeap () returned 0x130000 [0054.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0054.285] GetProcessHeap () returned 0x130000 [0054.286] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0054.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x30bea38 | out: lpFindFileData=0x30bea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0054.518] GetProcessHeap () returned 0x130000 [0054.518] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0054.554] GetProcessHeap () returned 0x130000 [0054.554] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.775] GetProcessHeap () returned 0x130000 [0054.775] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0054.775] GetProcessHeap () returned 0x130000 [0054.775] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0054.776] GetProcessHeap () returned 0x130000 [0054.776] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0054.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0054.781] GetProcessHeap () returned 0x130000 [0054.781] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0054.781] GetProcessHeap () returned 0x130000 [0054.782] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0054.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0054.782] GetProcessHeap () returned 0x130000 [0054.782] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0054.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0054.815] GetProcessHeap () returned 0x130000 [0054.815] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0054.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0054.816] ResetEvent (hEvent=0x2e4) returned 1 [0054.816] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0054.833] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0054.833] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0054.833] GetProcessHeap () returned 0x130000 [0054.833] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0054.833] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0054.833] ResetEvent (hEvent=0x2e4) returned 1 [0054.833] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0054.844] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0054.844] ResetEvent (hEvent=0x2e4) returned 1 [0054.844] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0054.849] ResetEvent (hEvent=0x2e4) returned 1 [0054.849] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.149] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0055.149] ResetEvent (hEvent=0x2e4) returned 1 [0055.149] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.385] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0055.385] ResetEvent (hEvent=0x2e4) returned 1 [0055.386] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.391] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0055.391] ResetEvent (hEvent=0x2e4) returned 1 [0055.391] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.398] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0055.398] ResetEvent (hEvent=0x2e4) returned 1 [0055.398] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.409] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0055.409] ResetEvent (hEvent=0x2e4) returned 1 [0055.409] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.498] ResetEvent (hEvent=0x2e4) returned 1 [0055.498] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.733] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0055.734] ResetEvent (hEvent=0x2e4) returned 1 [0055.734] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.746] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0055.746] ResetEvent (hEvent=0x2e4) returned 1 [0055.746] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.753] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0055.753] ResetEvent (hEvent=0x2e4) returned 1 [0055.753] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.786] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0055.787] ResetEvent (hEvent=0x2e4) returned 1 [0055.787] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.800] ResetEvent (hEvent=0x2e4) returned 1 [0055.800] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0055.813] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0055.813] ResetEvent (hEvent=0x2e4) returned 1 [0055.813] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.005] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0056.005] ResetEvent (hEvent=0x2e4) returned 1 [0056.005] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.016] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0056.016] ResetEvent (hEvent=0x2e4) returned 1 [0056.016] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.022] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0056.022] ResetEvent (hEvent=0x2e4) returned 1 [0056.022] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.025] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0056.026] ResetEvent (hEvent=0x2e4) returned 1 [0056.026] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.033] ResetEvent (hEvent=0x2e4) returned 1 [0056.033] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.041] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0056.041] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0056.042] GetProcessHeap () returned 0x130000 [0056.042] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0056.042] ResetEvent (hEvent=0x2e4) returned 1 [0056.042] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.048] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.048] GetProcessHeap () returned 0x130000 [0056.048] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0056.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0056.048] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.048] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0056.049] ResetEvent (hEvent=0x2e4) returned 1 [0056.049] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.052] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0056.052] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0056.052] GetProcessHeap () returned 0x130000 [0056.052] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0056.052] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0056.052] GetProcessHeap () returned 0x130000 [0056.052] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0056.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0056.052] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.052] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0056.053] ResetEvent (hEvent=0x2e4) returned 1 [0056.053] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.060] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0056.060] ResetEvent (hEvent=0x2e4) returned 1 [0056.060] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.067] ResetEvent (hEvent=0x2e4) returned 1 [0056.067] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.104] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0056.104] GetProcessHeap () returned 0x130000 [0056.104] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0056.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0056.104] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.104] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0056.104] ResetEvent (hEvent=0x2e4) returned 1 [0056.105] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.323] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0056.323] ResetEvent (hEvent=0x2e4) returned 1 [0056.323] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.332] ResetEvent (hEvent=0x2e4) returned 1 [0056.332] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.339] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0056.339] ResetEvent (hEvent=0x2e4) returned 1 [0056.339] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.353] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0056.353] ResetEvent (hEvent=0x2e4) returned 1 [0056.353] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.361] ResetEvent (hEvent=0x2e4) returned 1 [0056.361] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0056.376] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0056.376] ResetEvent (hEvent=0x2e4) returned 1 [0056.376] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0057.549] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0057.549] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0057.550] GetProcessHeap () returned 0x130000 [0057.550] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0057.550] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0057.550] ResetEvent (hEvent=0x2e4) returned 1 [0057.550] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0058.567] ResetEvent (hEvent=0x2e4) returned 1 [0058.567] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0058.685] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0058.685] ResetEvent (hEvent=0x2e4) returned 1 [0058.685] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0059.097] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0059.097] ResetEvent (hEvent=0x2e4) returned 1 [0059.097] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0059.339] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0059.339] ResetEvent (hEvent=0x2e4) returned 1 [0059.339] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0059.366] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0059.366] ResetEvent (hEvent=0x2e4) returned 1 [0059.366] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0059.382] ResetEvent (hEvent=0x2e4) returned 1 [0059.382] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0059.691] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0059.691] ResetEvent (hEvent=0x2e4) returned 1 [0059.691] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0059.702] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0059.702] ResetEvent (hEvent=0x2e4) returned 1 [0059.702] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0060.659] ResetEvent (hEvent=0x2e4) returned 1 [0060.659] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0060.734] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0060.734] ResetEvent (hEvent=0x2e4) returned 1 [0060.734] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0060.934] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0060.934] ResetEvent (hEvent=0x2e4) returned 1 [0060.934] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0060.999] ResetEvent (hEvent=0x2e4) returned 1 [0060.999] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0061.010] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0061.010] ResetEvent (hEvent=0x2e4) returned 1 [0061.010] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0061.140] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0061.140] ResetEvent (hEvent=0x2e4) returned 1 [0061.140] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0061.160] ResetEvent (hEvent=0x2e4) returned 1 [0061.160] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0061.168] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0061.168] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0061.169] GetProcessHeap () returned 0x130000 [0061.169] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0061.169] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0061.169] GetProcessHeap () returned 0x130000 [0061.169] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0061.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0061.170] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.170] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0061.170] GetProcessHeap () returned 0x130000 [0061.170] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0061.171] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.171] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0061.171] ResetEvent (hEvent=0x2e4) returned 1 [0061.171] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0061.180] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0061.181] ResetEvent (hEvent=0x2e4) returned 1 [0061.181] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0062.352] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0062.352] ResetEvent (hEvent=0x2e4) returned 1 [0062.352] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0063.075] ResetEvent (hEvent=0x2e4) returned 1 [0063.075] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0063.132] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0063.132] ResetEvent (hEvent=0x2e4) returned 1 [0063.132] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.123] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0065.124] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0065.124] GetProcessHeap () returned 0x130000 [0065.124] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0065.125] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0065.125] ResetEvent (hEvent=0x2e4) returned 1 [0065.125] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.125] ResetEvent (hEvent=0x2e4) returned 1 [0065.125] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.126] ResetEvent (hEvent=0x2e4) returned 1 [0065.126] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.127] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0065.127] ResetEvent (hEvent=0x2e4) returned 1 [0065.127] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.127] ResetEvent (hEvent=0x2e4) returned 1 [0065.127] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.129] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0065.129] ResetEvent (hEvent=0x2e4) returned 1 [0065.129] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.249] ResetEvent (hEvent=0x2e4) returned 1 [0065.249] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.277] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0065.277] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0065.277] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0065.278] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0065.278] ResetEvent (hEvent=0x2e4) returned 1 [0065.278] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0065.281] ResetEvent (hEvent=0x2e4) returned 1 [0065.281] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0066.480] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0066.480] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0066.480] GetProcessHeap () returned 0x130000 [0066.480] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0066.480] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0066.480] ResetEvent (hEvent=0x2e4) returned 1 [0066.480] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0066.499] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0066.499] ResetEvent (hEvent=0x2e4) returned 1 [0066.502] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0066.546] ResetEvent (hEvent=0x2e4) returned 1 [0066.546] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0066.691] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0066.691] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0066.692] GetProcessHeap () returned 0x130000 [0066.692] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0066.692] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0066.692] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0066.692] GetProcessHeap () returned 0x130000 [0066.692] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0066.694] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.694] ResetEvent (hEvent=0x2e4) returned 1 [0066.694] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0066.933] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0066.933] GetProcessHeap () returned 0x130000 [0066.933] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0066.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0066.934] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.934] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50817450, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0xfa861600, ftLastAccessTime.dwHighDateTime=0x1d5d020, ftLastWriteTime.dwLowDateTime=0xfa861600, ftLastWriteTime.dwHighDateTime=0x1d5d020, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="appointment_impressed.exe", cAlternateFileName="APPOIN~1.EXE")) returned 1 [0066.934] ResetEvent (hEvent=0x2e4) returned 1 [0066.934] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0066.963] ResetEvent (hEvent=0x2e4) returned 1 [0066.963] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0067.288] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0067.288] GetProcessHeap () returned 0x130000 [0067.288] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0067.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0067.290] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.290] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0067.290] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0067.290] ResetEvent (hEvent=0x2e4) returned 1 [0067.290] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0067.427] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0067.427] ResetEvent (hEvent=0x2e4) returned 1 [0067.427] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0067.547] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0067.547] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0067.547] GetProcessHeap () returned 0x130000 [0067.547] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0067.547] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0067.547] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212334b0, ftCreationTime.dwHighDateTime=0x1d589bc, ftLastAccessTime.dwLowDateTime=0xf7007d40, ftLastAccessTime.dwHighDateTime=0x1d59f42, ftLastWriteTime.dwLowDateTime=0xf7007d40, ftLastWriteTime.dwHighDateTime=0x1d59f42, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0067.547] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0067.548] GetProcessHeap () returned 0x130000 [0067.548] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0067.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0067.548] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.548] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0067.549] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0067.549] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0067.549] GetProcessHeap () returned 0x130000 [0067.549] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0067.549] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0067.549] GetProcessHeap () returned 0x130000 [0067.549] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0067.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0067.549] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.549] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0067.549] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0067.549] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0067.549] GetProcessHeap () returned 0x130000 [0067.549] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0067.549] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0067.549] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0067.550] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0067.550] GetProcessHeap () returned 0x130000 [0067.550] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0067.550] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x30bf6e0 | out: lpFindFileData=0x30bf6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Java", cAlternateFileName="")) returned 1 [0067.550] GetProcessHeap () returned 0x130000 [0067.550] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0067.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0067.551] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.551] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a59d780, ftCreationTime.dwHighDateTime=0x1d5b2ea, ftLastAccessTime.dwLowDateTime=0xa2bc2510, ftLastAccessTime.dwHighDateTime=0x1d5bd45, ftLastWriteTime.dwLowDateTime=0xa2bc2510, ftLastWriteTime.dwHighDateTime=0x1d5bd45, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="brook_den.exe", cAlternateFileName="BROOK_~1.EXE")) returned 1 [0067.551] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x30bf458 | out: lpFindFileData=0x30bf458*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0067.551] GetProcessHeap () returned 0x130000 [0067.551] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0067.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0067.552] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.552] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0067.552] GetProcessHeap () returned 0x130000 [0067.552] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0067.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0067.552] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.552] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0067.552] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0067.552] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0067.553] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0067.553] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0067.553] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0067.553] GetProcessHeap () returned 0x130000 [0067.553] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0067.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0067.553] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.553] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0067.553] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0067.554] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0067.554] GetProcessHeap () returned 0x130000 [0067.554] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0067.554] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0067.560] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0067.560] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0067.560] ResetEvent (hEvent=0x2e4) returned 1 [0067.560] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.229] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0068.229] ResetEvent (hEvent=0x2e4) returned 1 [0068.229] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.231] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0068.231] ResetEvent (hEvent=0x2e4) returned 1 [0068.231] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.237] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0068.237] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0068.237] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0068.237] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0068.237] ResetEvent (hEvent=0x2e4) returned 1 [0068.237] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.240] ResetEvent (hEvent=0x2e4) returned 1 [0068.240] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.247] ResetEvent (hEvent=0x2e4) returned 1 [0068.247] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.257] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0068.257] ResetEvent (hEvent=0x2e4) returned 1 [0068.257] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.270] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0068.270] ResetEvent (hEvent=0x2e4) returned 1 [0068.270] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.971] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0068.972] ResetEvent (hEvent=0x2e4) returned 1 [0068.972] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0068.986] ResetEvent (hEvent=0x2e4) returned 1 [0068.986] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.037] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0069.037] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0069.037] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0069.038] ResetEvent (hEvent=0x2e4) returned 1 [0069.038] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.046] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0069.046] ResetEvent (hEvent=0x2e4) returned 1 [0069.046] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.178] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0069.178] ResetEvent (hEvent=0x2e4) returned 1 [0069.178] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.194] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0069.195] ResetEvent (hEvent=0x2e4) returned 1 [0069.195] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.548] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0069.548] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0069.548] ResetEvent (hEvent=0x2e4) returned 1 [0069.548] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.589] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0069.589] ResetEvent (hEvent=0x2e4) returned 1 [0069.589] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.604] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0069.604] ResetEvent (hEvent=0x2e4) returned 1 [0069.604] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.619] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0069.619] ResetEvent (hEvent=0x2e4) returned 1 [0069.619] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.743] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0069.743] ResetEvent (hEvent=0x2e4) returned 1 [0069.743] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.833] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0069.833] ResetEvent (hEvent=0x2e4) returned 1 [0069.833] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0069.878] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0069.878] ResetEvent (hEvent=0x2e4) returned 1 [0069.878] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0070.766] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0070.767] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0070.767] ResetEvent (hEvent=0x2e4) returned 1 [0070.767] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0070.778] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0070.778] ResetEvent (hEvent=0x2e4) returned 1 [0070.779] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0070.785] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0070.785] ResetEvent (hEvent=0x2e4) returned 1 [0070.786] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0070.814] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0070.814] ResetEvent (hEvent=0x2e4) returned 1 [0070.814] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0070.825] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0070.825] ResetEvent (hEvent=0x2e4) returned 1 [0070.825] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.072] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0071.072] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0071.072] ResetEvent (hEvent=0x2e4) returned 1 [0071.072] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.086] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0071.086] ResetEvent (hEvent=0x2e4) returned 1 [0071.086] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.088] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0071.088] ResetEvent (hEvent=0x2e4) returned 1 [0071.089] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.098] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0071.098] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0071.098] ResetEvent (hEvent=0x2e4) returned 1 [0071.098] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.493] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0071.493] ResetEvent (hEvent=0x2e4) returned 1 [0071.493] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.502] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0071.503] ResetEvent (hEvent=0x2e4) returned 1 [0071.503] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.516] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0071.516] ResetEvent (hEvent=0x2e4) returned 1 [0071.516] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.945] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0071.945] ResetEvent (hEvent=0x2e4) returned 1 [0071.945] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.956] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0071.956] ResetEvent (hEvent=0x2e4) returned 1 [0071.956] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0071.974] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0071.975] ResetEvent (hEvent=0x2e4) returned 1 [0071.975] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.193] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0072.193] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0072.193] ResetEvent (hEvent=0x2e4) returned 1 [0072.193] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.211] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0072.212] ResetEvent (hEvent=0x2e4) returned 1 [0072.212] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.232] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0072.232] ResetEvent (hEvent=0x2e4) returned 1 [0072.232] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.259] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0072.259] ResetEvent (hEvent=0x2e4) returned 1 [0072.260] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.401] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0072.401] ResetEvent (hEvent=0x2e4) returned 1 [0072.402] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.415] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0072.415] ResetEvent (hEvent=0x2e4) returned 1 [0072.415] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.439] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0072.439] ResetEvent (hEvent=0x2e4) returned 1 [0072.439] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.446] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0072.446] GetProcessHeap () returned 0x130000 [0072.446] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.449] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.449] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0072.449] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0072.449] ResetEvent (hEvent=0x2e4) returned 1 [0072.450] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.463] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0072.463] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0072.463] GetProcessHeap () returned 0x130000 [0072.464] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.464] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0072.464] ResetEvent (hEvent=0x2e4) returned 1 [0072.464] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.473] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0072.473] ResetEvent (hEvent=0x2e4) returned 1 [0072.473] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.480] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0072.481] ResetEvent (hEvent=0x2e4) returned 1 [0072.481] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.724] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0072.724] ResetEvent (hEvent=0x2e4) returned 1 [0072.724] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0072.745] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0072.745] ResetEvent (hEvent=0x2e4) returned 1 [0072.745] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.127] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0073.127] ResetEvent (hEvent=0x2e4) returned 1 [0073.127] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.129] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0073.130] ResetEvent (hEvent=0x2e4) returned 1 [0073.130] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.143] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="server", cAlternateFileName="")) returned 1 [0073.143] GetProcessHeap () returned 0x130000 [0073.143] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0073.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0073.146] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.146] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0073.146] ResetEvent (hEvent=0x2e4) returned 1 [0073.146] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.160] ResetEvent (hEvent=0x2e4) returned 1 [0073.160] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.170] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x866c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0073.170] ResetEvent (hEvent=0x2e4) returned 1 [0073.171] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.420] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0073.420] ResetEvent (hEvent=0x2e4) returned 1 [0073.420] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.435] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0073.435] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0073.435] GetProcessHeap () returned 0x130000 [0073.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0073.435] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0073.435] ResetEvent (hEvent=0x2e4) returned 1 [0073.436] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.445] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0073.445] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8ba40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0073.445] ResetEvent (hEvent=0x2e4) returned 1 [0073.446] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.518] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0073.519] ResetEvent (hEvent=0x2e4) returned 1 [0073.519] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.734] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21240, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0073.734] ResetEvent (hEvent=0x2e4) returned 1 [0073.734] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.745] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0073.745] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e440, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0073.745] ResetEvent (hEvent=0x2e4) returned 1 [0073.745] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0073.757] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0073.757] ResetEvent (hEvent=0x2e4) returned 1 [0073.757] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0074.115] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13840, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0074.115] ResetEvent (hEvent=0x2e4) returned 1 [0074.115] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0074.207] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0074.207] ResetEvent (hEvent=0x2e4) returned 1 [0074.207] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0074.282] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0074.282] ResetEvent (hEvent=0x2e4) returned 1 [0074.282] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0074.639] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0074.639] ResetEvent (hEvent=0x2e4) returned 1 [0074.639] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0075.691] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ae40, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-64.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0075.691] ResetEvent (hEvent=0x2e4) returned 1 [0075.691] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0075.702] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0075.702] ResetEvent (hEvent=0x2e4) returned 1 [0075.702] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0075.714] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0075.714] ResetEvent (hEvent=0x2e4) returned 1 [0075.714] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.054] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0076.054] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0076.054] GetProcessHeap () returned 0x130000 [0076.054] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0076.054] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0076.054] ResetEvent (hEvent=0x2e4) returned 1 [0076.054] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.223] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x30bf1d0 | out: lpFindFileData=0x30bf1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0076.223] GetProcessHeap () returned 0x130000 [0076.223] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0076.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0076.223] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.223] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0076.223] ResetEvent (hEvent=0x2e4) returned 1 [0076.223] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.236] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0076.236] GetProcessHeap () returned 0x130000 [0076.236] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0076.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0076.237] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.237] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0076.237] ResetEvent (hEvent=0x2e4) returned 1 [0076.237] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.238] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0076.239] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0076.239] GetProcessHeap () returned 0x130000 [0076.239] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0076.239] GetProcessHeap () returned 0x130000 [0076.239] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0076.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0076.239] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.239] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0076.239] GetProcessHeap () returned 0x130000 [0076.239] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0076.239] ResetEvent (hEvent=0x2e4) returned 1 [0076.240] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.250] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0076.250] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0076.250] ResetEvent (hEvent=0x2e4) returned 1 [0076.250] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.566] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0076.566] GetProcessHeap () returned 0x130000 [0076.566] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0076.566] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.566] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0076.566] ResetEvent (hEvent=0x2e4) returned 1 [0076.567] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.577] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0076.578] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0076.578] ResetEvent (hEvent=0x2e4) returned 1 [0076.578] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.602] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0076.602] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0076.602] ResetEvent (hEvent=0x2e4) returned 1 [0076.602] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.693] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0076.693] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0076.693] GetProcessHeap () returned 0x130000 [0076.693] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.693] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0076.693] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0076.693] ResetEvent (hEvent=0x2e4) returned 1 [0076.694] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.710] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x30bef48 | out: lpFindFileData=0x30bef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0076.710] GetProcessHeap () returned 0x130000 [0076.710] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0076.711] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.711] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0076.711] ResetEvent (hEvent=0x2e4) returned 1 [0076.711] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.714] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0076.714] ResetEvent (hEvent=0x2e4) returned 1 [0076.714] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.727] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0076.727] ResetEvent (hEvent=0x2e4) returned 1 [0076.727] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.740] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0076.740] ResetEvent (hEvent=0x2e4) returned 1 [0076.740] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0076.749] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0076.749] ResetEvent (hEvent=0x2e4) returned 1 [0076.749] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0077.320] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0077.320] ResetEvent (hEvent=0x2e4) returned 1 [0077.320] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0077.348] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0077.348] ResetEvent (hEvent=0x2e4) returned 1 [0077.348] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0077.360] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0077.361] ResetEvent (hEvent=0x2e4) returned 1 [0077.361] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) returned 0x0 [0077.375] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x30becc0 | out: lpFindFileData=0x30becc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0077.375] ResetEvent (hEvent=0x2e4) returned 1 [0077.375] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0xffffffff) Thread: id = 21 os_tid = 0xdc8 [0049.902] GetProcessHeap () returned 0x130000 [0049.902] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x38) returned 0x144030 [0049.902] GetProcessHeap () returned 0x130000 [0049.902] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x18) returned 0x149e20 [0049.902] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c8 [0049.902] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2cc [0049.902] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0 [0049.902] GetProcessHeap () returned 0x130000 [0049.902] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x15ed90 [0049.903] GetProcessHeap () returned 0x130000 [0049.903] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x16ed98 [0049.903] GetProcessHeap () returned 0x130000 [0049.903] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14ed58 [0049.903] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0049.904] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0049.904] Wow64DisableWow64FsRedirection (in: OldValue=0x347f774 | out: OldValue=0x347f774*=0x0) returned 1 [0049.904] GetProcessHeap () returned 0x130000 [0049.904] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ed58 | out: hHeap=0x130000) returned 1 [0049.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x11f54bf, lpParameter=0x347f77c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0049.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x11f54bf, lpParameter=0x347f77c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0049.905] GetProcessHeap () returned 0x130000 [0049.905] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x17eda0 [0049.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x347f4f0 | out: lpFindFileData=0x347f4f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x18fad8 [0049.907] GetProcessHeap () returned 0x130000 [0049.907] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0049.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0049.909] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0049.909] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0049.909] GetProcessHeap () returned 0x130000 [0049.909] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1a0dc0 [0049.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0049.919] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.920] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0049.920] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0049.920] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0049.920] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0049.920] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0049.921] GetProcessHeap () returned 0x130000 [0049.921] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0dc0 | out: hHeap=0x130000) returned 1 [0049.921] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0049.921] GetProcessHeap () returned 0x130000 [0049.921] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x1a0dc0 [0049.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0049.924] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0049.925] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0049.925] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0049.926] GetProcessHeap () returned 0x130000 [0049.926] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x1a0dc0 | out: hHeap=0x130000) returned 1 [0049.926] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0049.926] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0049.926] GetProcessHeap () returned 0x130000 [0049.926] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0049.927] FindNextFileW (in: hFindFile=0x18fad8, lpFindFileData=0x347f4f0 | out: lpFindFileData=0x347f4f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0049.927] GetProcessHeap () returned 0x130000 [0049.927] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0049.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0049.928] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0049.928] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0049.928] GetProcessHeap () returned 0x130000 [0049.928] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0049.928] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.928] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.928] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.928] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0049.928] GetProcessHeap () returned 0x130000 [0049.928] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.928] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0049.928] GetProcessHeap () returned 0x130000 [0049.928] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0049.929] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.929] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.929] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.929] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0049.929] GetProcessHeap () returned 0x130000 [0049.929] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.929] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0049.929] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0049.929] GetProcessHeap () returned 0x130000 [0049.929] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0049.930] FindNextFileW (in: hFindFile=0x18fad8, lpFindFileData=0x347f4f0 | out: lpFindFileData=0x347f4f0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0049.930] FindNextFileW (in: hFindFile=0x18fad8, lpFindFileData=0x347f4f0 | out: lpFindFileData=0x347f4f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0049.930] GetProcessHeap () returned 0x130000 [0049.930] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0049.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0049.933] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0049.934] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1 [0049.934] GetProcessHeap () returned 0x130000 [0049.934] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0049.935] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.935] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.935] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.935] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.935] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.935] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0049.935] GetProcessHeap () returned 0x130000 [0049.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.935] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1 [0049.935] GetProcessHeap () returned 0x130000 [0049.936] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0049.936] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.936] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.936] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.937] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.937] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.937] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0049.937] GetProcessHeap () returned 0x130000 [0049.937] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.937] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1 [0049.937] GetProcessHeap () returned 0x130000 [0049.937] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0049.938] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.938] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.938] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.938] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.938] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.938] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0049.938] GetProcessHeap () returned 0x130000 [0049.938] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.938] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1 [0049.938] GetProcessHeap () returned 0x130000 [0049.938] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0049.939] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.939] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0049.939] GetProcessHeap () returned 0x130000 [0049.939] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.939] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1 [0049.939] GetProcessHeap () returned 0x130000 [0049.939] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0049.940] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.940] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.940] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.940] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.940] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.940] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0049.940] GetProcessHeap () returned 0x130000 [0049.940] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.940] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1 [0049.940] GetProcessHeap () returned 0x130000 [0049.940] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0049.941] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.941] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.941] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.942] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.942] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.942] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0049.942] GetProcessHeap () returned 0x130000 [0049.942] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.942] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1 [0049.942] GetProcessHeap () returned 0x130000 [0049.942] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0049.943] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.943] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.943] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.943] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.943] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.943] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0049.943] GetProcessHeap () returned 0x130000 [0049.943] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.943] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1 [0049.943] GetProcessHeap () returned 0x130000 [0049.943] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0049.944] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.944] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.944] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.944] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.944] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.944] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0049.944] GetProcessHeap () returned 0x130000 [0049.944] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.944] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1 [0049.944] GetProcessHeap () returned 0x130000 [0049.944] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0049.945] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.945] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.945] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.945] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.945] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.945] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0049.945] GetProcessHeap () returned 0x130000 [0049.945] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.945] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1 [0049.945] GetProcessHeap () returned 0x130000 [0049.945] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0049.946] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.946] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0049.946] GetProcessHeap () returned 0x130000 [0049.946] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1 [0049.946] GetProcessHeap () returned 0x130000 [0049.946] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0049.946] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.946] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.947] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.947] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0049.947] GetProcessHeap () returned 0x130000 [0049.947] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.947] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1 [0049.947] GetProcessHeap () returned 0x130000 [0049.947] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0049.947] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.947] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0049.948] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0049.948] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0049.948] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0049.948] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0049.948] GetProcessHeap () returned 0x130000 [0049.948] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0049.948] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1 [0049.948] GetProcessHeap () returned 0x130000 [0049.948] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0049.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0050.146] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.146] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.146] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0050.146] GetProcessHeap () returned 0x130000 [0050.146] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.427] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1 [0051.427] GetProcessHeap () returned 0x130000 [0051.427] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.442] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.452] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.454] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.456] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.458] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.458] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0051.458] GetProcessHeap () returned 0x130000 [0051.458] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.458] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1 [0051.458] GetProcessHeap () returned 0x130000 [0051.458] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0051.462] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.462] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.466] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.466] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.466] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.466] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0051.466] GetProcessHeap () returned 0x130000 [0051.466] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.466] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1 [0051.466] GetProcessHeap () returned 0x130000 [0051.466] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.466] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.466] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.467] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0051.467] GetProcessHeap () returned 0x130000 [0051.467] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1 [0051.467] GetProcessHeap () returned 0x130000 [0051.467] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.467] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.468] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0051.468] GetProcessHeap () returned 0x130000 [0051.468] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.468] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1 [0051.468] GetProcessHeap () returned 0x130000 [0051.468] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0051.468] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.468] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.468] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.468] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.468] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.468] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0051.468] GetProcessHeap () returned 0x130000 [0051.468] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.468] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1 [0051.468] GetProcessHeap () returned 0x130000 [0051.468] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.468] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.469] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.469] GetProcessHeap () returned 0x130000 [0051.469] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1 [0051.469] GetProcessHeap () returned 0x130000 [0051.469] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0051.469] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.469] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.469] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0051.470] GetProcessHeap () returned 0x130000 [0051.470] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1 [0051.470] GetProcessHeap () returned 0x130000 [0051.470] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.470] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.470] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.470] GetProcessHeap () returned 0x130000 [0051.470] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1 [0051.470] GetProcessHeap () returned 0x130000 [0051.470] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0051.470] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.470] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.471] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0051.471] GetProcessHeap () returned 0x130000 [0051.471] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1 [0051.471] GetProcessHeap () returned 0x130000 [0051.471] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0051.471] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.471] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.471] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0051.471] GetProcessHeap () returned 0x130000 [0051.471] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1 [0051.472] GetProcessHeap () returned 0x130000 [0051.472] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.472] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.472] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0051.472] GetProcessHeap () returned 0x130000 [0051.472] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1 [0051.472] GetProcessHeap () returned 0x130000 [0051.472] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0051.472] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.472] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0051.473] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0051.473] GetProcessHeap () returned 0x130000 [0051.473] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1 [0051.473] GetProcessHeap () returned 0x130000 [0051.473] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0051.473] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0051.473] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0051.473] GetProcessHeap () returned 0x130000 [0051.473] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0051.473] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0051.474] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1 [0051.474] GetProcessHeap () returned 0x130000 [0051.474] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0051.474] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.474] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0051.474] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0051.474] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0051.474] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0051.474] GetProcessHeap () returned 0x130000 [0051.474] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.474] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1 [0051.474] GetProcessHeap () returned 0x130000 [0051.474] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x19fdb8 [0051.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0051.475] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0051.476] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0051.476] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.477] GetProcessHeap () returned 0x130000 [0051.477] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x19fdb8 | out: hHeap=0x130000) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0051.477] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0051.478] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0051.479] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0051.479] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0051.479] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0051.479] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0051.479] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0051.479] GetProcessHeap () returned 0x130000 [0051.479] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.480] FindNextFileW (in: hFindFile=0x18fad8, lpFindFileData=0x347f4f0 | out: lpFindFileData=0x347f4f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11f572a, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0051.480] GetProcessHeap () returned 0x130000 [0051.480] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0051.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0051.652] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0051.652] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1 [0051.653] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0051.653] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0051.653] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0051.653] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0051.653] GetProcessHeap () returned 0x130000 [0051.653] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.654] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.654] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.654] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.654] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.654] GetProcessHeap () returned 0x130000 [0051.654] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.654] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0051.654] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0051.654] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0051.654] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0051.654] GetProcessHeap () returned 0x130000 [0051.654] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0051.655] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.655] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.655] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.655] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.655] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0051.659] GetProcessHeap () returned 0x130000 [0051.659] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.659] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="da-DK", cAlternateFileName="")) returned 1 [0051.659] GetProcessHeap () returned 0x130000 [0051.659] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.672] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.672] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.672] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.672] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.672] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.672] GetProcessHeap () returned 0x130000 [0051.672] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.672] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="de-DE", cAlternateFileName="")) returned 1 [0051.672] GetProcessHeap () returned 0x130000 [0051.673] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0051.673] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.673] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.673] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.673] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.673] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0051.673] GetProcessHeap () returned 0x130000 [0051.673] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.673] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="el-GR", cAlternateFileName="")) returned 1 [0051.673] GetProcessHeap () returned 0x130000 [0051.673] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0051.675] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.675] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.675] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.675] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.675] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0051.675] GetProcessHeap () returned 0x130000 [0051.675] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.675] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="en-GB", cAlternateFileName="")) returned 1 [0051.675] GetProcessHeap () returned 0x130000 [0051.675] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0051.679] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.679] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.679] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.679] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0051.679] GetProcessHeap () returned 0x130000 [0051.679] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.680] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.680] GetProcessHeap () returned 0x130000 [0051.680] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.680] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.680] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.680] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.680] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.680] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.680] GetProcessHeap () returned 0x130000 [0051.680] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.680] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="es-ES", cAlternateFileName="")) returned 1 [0051.680] GetProcessHeap () returned 0x130000 [0051.680] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0051.681] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.681] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.681] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.681] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.681] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0051.681] GetProcessHeap () returned 0x130000 [0051.681] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.681] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="es-MX", cAlternateFileName="")) returned 1 [0051.682] GetProcessHeap () returned 0x130000 [0051.682] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0051.682] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.682] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.682] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.682] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0051.682] GetProcessHeap () returned 0x130000 [0051.683] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.683] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="et-EE", cAlternateFileName="")) returned 1 [0051.683] GetProcessHeap () returned 0x130000 [0051.683] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0051.683] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.683] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.683] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.683] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0051.683] GetProcessHeap () returned 0x130000 [0051.683] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.683] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0051.683] GetProcessHeap () returned 0x130000 [0051.683] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0051.684] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.684] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.684] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.684] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.684] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0051.684] GetProcessHeap () returned 0x130000 [0051.684] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.684] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Fonts", cAlternateFileName="")) returned 1 [0051.684] GetProcessHeap () returned 0x130000 [0051.684] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0051.687] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0051.687] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0051.688] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0051.688] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0051.689] GetProcessHeap () returned 0x130000 [0051.689] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.689] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0051.689] GetProcessHeap () returned 0x130000 [0051.689] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb98 [0051.690] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.690] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.690] FindNextFileW (in: hFindFile=0x18fb98, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.690] FindClose (in: hFindFile=0x18fb98 | out: hFindFile=0x18fb98) returned 1 [0051.690] GetProcessHeap () returned 0x130000 [0051.690] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.690] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0051.690] GetProcessHeap () returned 0x130000 [0051.690] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0051.690] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.690] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.690] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.691] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.691] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0051.691] GetProcessHeap () returned 0x130000 [0051.691] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.691] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0051.691] GetProcessHeap () returned 0x130000 [0051.691] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0051.691] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.691] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.692] FindClose (in: hFindFile=0x18f998 | out: hFindFile=0x18f998) returned 1 [0051.692] GetProcessHeap () returned 0x130000 [0051.692] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0051.692] GetProcessHeap () returned 0x130000 [0051.692] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0051.692] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.692] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0051.692] GetProcessHeap () returned 0x130000 [0051.692] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.692] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="it-IT", cAlternateFileName="")) returned 1 [0051.692] GetProcessHeap () returned 0x130000 [0051.692] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.693] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.693] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.694] GetProcessHeap () returned 0x130000 [0051.694] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0051.694] GetProcessHeap () returned 0x130000 [0051.694] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.694] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.694] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.695] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0051.695] GetProcessHeap () returned 0x130000 [0051.695] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.695] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0051.695] GetProcessHeap () returned 0x130000 [0051.695] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0051.696] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0051.696] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0051.696] GetProcessHeap () returned 0x130000 [0051.696] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0051.696] GetProcessHeap () returned 0x130000 [0051.696] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.696] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.696] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0051.696] GetProcessHeap () returned 0x130000 [0051.696] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.696] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0051.697] GetProcessHeap () returned 0x130000 [0051.697] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0051.697] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.697] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0051.697] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0051.697] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0051.697] GetProcessHeap () returned 0x130000 [0051.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.698] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0051.698] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0051.698] GetProcessHeap () returned 0x130000 [0051.698] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0051.700] GetProcessHeap () returned 0x130000 [0051.700] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.700] GetProcessHeap () returned 0x130000 [0051.700] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0051.700] GetProcessHeap () returned 0x130000 [0051.700] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.700] GetProcessHeap () returned 0x130000 [0051.700] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0051.701] GetProcessHeap () returned 0x130000 [0051.701] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.701] GetProcessHeap () returned 0x130000 [0051.701] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0051.701] GetProcessHeap () returned 0x130000 [0051.701] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0051.701] GetProcessHeap () returned 0x130000 [0051.702] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0051.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0052.012] GetProcessHeap () returned 0x130000 [0052.012] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.013] GetProcessHeap () returned 0x130000 [0052.013] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0052.014] GetProcessHeap () returned 0x130000 [0052.014] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.014] GetProcessHeap () returned 0x130000 [0052.014] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0052.014] GetProcessHeap () returned 0x130000 [0052.014] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7e3760 [0052.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0052.015] GetProcessHeap () returned 0x130000 [0052.015] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7e3760 | out: hHeap=0x130000) returned 1 [0052.015] GetProcessHeap () returned 0x130000 [0052.015] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.016] GetProcessHeap () returned 0x130000 [0052.016] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0052.016] GetProcessHeap () returned 0x130000 [0052.016] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.016] GetProcessHeap () returned 0x130000 [0052.016] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0052.016] GetProcessHeap () returned 0x130000 [0052.016] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.016] GetProcessHeap () returned 0x130000 [0052.016] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb98 [0052.016] GetProcessHeap () returned 0x130000 [0052.016] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb98 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.017] GetProcessHeap () returned 0x130000 [0052.017] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.018] GetProcessHeap () returned 0x130000 [0052.018] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x18fdb0 [0052.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0052.019] GetProcessHeap () returned 0x130000 [0052.019] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x18fdb0 | out: hHeap=0x130000) returned 1 [0052.019] GetProcessHeap () returned 0x130000 [0052.019] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0052.019] GetProcessHeap () returned 0x130000 [0052.019] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0052.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0052.019] GetProcessHeap () returned 0x130000 [0052.019] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0052.019] GetProcessHeap () returned 0x130000 [0052.019] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0052.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0052.867] GetProcessHeap () returned 0x130000 [0052.867] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0052.956] GetProcessHeap () returned 0x130000 [0052.956] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0052.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0052.960] GetProcessHeap () returned 0x130000 [0052.960] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7d2750 | out: hHeap=0x130000) returned 1 [0052.960] GetProcessHeap () returned 0x130000 [0052.960] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7d2750 [0052.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0x18f998 [0052.960] GetProcessHeap () returned 0x130000 [0052.960] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0052.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0052.963] GetProcessHeap () returned 0x130000 [0052.963] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0052.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0052.963] GetProcessHeap () returned 0x130000 [0052.964] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0052.964] GetProcessHeap () returned 0x130000 [0052.964] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0052.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0052.964] GetProcessHeap () returned 0x130000 [0052.964] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0052.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0052.974] GetProcessHeap () returned 0x130000 [0052.974] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0052.974] GetProcessHeap () returned 0x130000 [0052.974] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0052.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0052.974] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.974] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0052.975] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0052.975] GetProcessHeap () returned 0x130000 [0052.975] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0052.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0052.977] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.977] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.977] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.977] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0052.977] GetProcessHeap () returned 0x130000 [0052.977] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0052.977] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0052.977] GetProcessHeap () returned 0x130000 [0052.978] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0052.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0052.978] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.978] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.978] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.978] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0052.978] GetProcessHeap () returned 0x130000 [0052.978] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0052.978] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0052.978] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0052.978] GetProcessHeap () returned 0x130000 [0052.978] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0052.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0052.978] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.978] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.979] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0052.979] GetProcessHeap () returned 0x130000 [0052.979] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0052.979] GetProcessHeap () returned 0x130000 [0052.979] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0052.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0052.979] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.979] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0052.979] GetProcessHeap () returned 0x130000 [0052.979] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0052.979] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.979] GetProcessHeap () returned 0x130000 [0052.979] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0052.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0052.982] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.982] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.025] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.025] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0053.026] GetProcessHeap () returned 0x130000 [0053.026] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.026] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0053.026] GetProcessHeap () returned 0x130000 [0053.026] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.026] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.026] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.026] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.026] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0053.026] GetProcessHeap () returned 0x130000 [0053.026] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.026] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0053.026] GetProcessHeap () returned 0x130000 [0053.026] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.027] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.027] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.027] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.027] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.027] GetProcessHeap () returned 0x130000 [0053.027] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.027] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0053.027] GetProcessHeap () returned 0x130000 [0053.028] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.030] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0053.033] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0053.034] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.035] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0053.035] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0053.035] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.036] GetProcessHeap () returned 0x130000 [0053.036] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.036] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0053.036] GetProcessHeap () returned 0x130000 [0053.036] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.037] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.037] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.037] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.040] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0053.040] GetProcessHeap () returned 0x130000 [0053.040] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.040] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0053.040] GetProcessHeap () returned 0x130000 [0053.040] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.040] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.040] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.040] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.040] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0053.040] GetProcessHeap () returned 0x130000 [0053.040] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.040] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0053.040] GetProcessHeap () returned 0x130000 [0053.040] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.041] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.041] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0053.041] GetProcessHeap () returned 0x130000 [0053.041] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0053.041] GetProcessHeap () returned 0x130000 [0053.041] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.041] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.041] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0053.041] GetProcessHeap () returned 0x130000 [0053.041] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0053.041] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0053.041] GetProcessHeap () returned 0x130000 [0053.042] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0053.042] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.042] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.042] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.044] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0053.044] GetProcessHeap () returned 0x130000 [0053.045] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.045] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0053.045] GetProcessHeap () returned 0x130000 [0053.045] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.045] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.045] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.045] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.045] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0053.045] GetProcessHeap () returned 0x130000 [0053.045] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.045] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0053.045] GetProcessHeap () returned 0x130000 [0053.045] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0053.046] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.046] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0053.046] GetProcessHeap () returned 0x130000 [0053.046] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0053.048] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.048] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0053.048] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0053.049] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0053.049] GetProcessHeap () returned 0x130000 [0053.049] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.049] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0053.049] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1 [0053.049] GetProcessHeap () returned 0x130000 [0053.049] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.050] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.050] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0053.050] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0053.053] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0053.053] GetProcessHeap () returned 0x130000 [0053.053] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.053] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0053.053] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0053.053] GetProcessHeap () returned 0x130000 [0053.053] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.053] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.053] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0053.053] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0053.053] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0053.053] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0053.053] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.054] GetProcessHeap () returned 0x130000 [0053.054] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0053.054] GetProcessHeap () returned 0x130000 [0053.054] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0053.054] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0053.054] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0053.055] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0053.055] GetProcessHeap () returned 0x130000 [0053.055] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0053.055] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0053.055] GetProcessHeap () returned 0x130000 [0053.055] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.056] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.056] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0053.056] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0053.056] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0053.056] GetProcessHeap () returned 0x130000 [0053.056] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.056] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0053.056] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0053.056] GetProcessHeap () returned 0x130000 [0053.056] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.057] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0053.057] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0053.057] GetProcessHeap () returned 0x130000 [0053.057] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1 [0053.057] GetProcessHeap () returned 0x130000 [0053.057] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.057] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0053.058] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.058] GetProcessHeap () returned 0x130000 [0053.058] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0053.058] GetProcessHeap () returned 0x130000 [0053.058] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0053.058] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0053.058] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0053.058] GetProcessHeap () returned 0x130000 [0053.058] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0053.058] GetProcessHeap () returned 0x130000 [0053.059] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0053.059] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.059] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0053.059] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0053.059] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0053.059] GetProcessHeap () returned 0x130000 [0053.059] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.059] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0053.059] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0053.059] GetProcessHeap () returned 0x130000 [0053.059] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.060] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0053.060] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0053.060] GetProcessHeap () returned 0x130000 [0053.060] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0053.060] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0053.060] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0053.061] GetProcessHeap () returned 0x130000 [0053.061] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.062] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0053.062] GetProcessHeap () returned 0x130000 [0053.062] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.062] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.062] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.063] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.063] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.063] GetProcessHeap () returned 0x130000 [0053.063] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.063] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0053.063] GetProcessHeap () returned 0x130000 [0053.063] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0053.063] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.063] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.063] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.063] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0053.063] GetProcessHeap () returned 0x130000 [0053.063] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.063] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0053.063] GetProcessHeap () returned 0x130000 [0053.063] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.064] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.064] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0053.064] GetProcessHeap () returned 0x130000 [0053.064] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0053.064] GetProcessHeap () returned 0x130000 [0053.064] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0053.064] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.064] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0053.064] GetProcessHeap () returned 0x130000 [0053.064] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0053.067] GetProcessHeap () returned 0x130000 [0053.067] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.290] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.345] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.345] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.347] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0053.349] GetProcessHeap () returned 0x130000 [0053.349] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0053.349] GetProcessHeap () returned 0x130000 [0053.349] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.349] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.349] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0053.349] GetProcessHeap () returned 0x130000 [0053.349] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0053.350] GetProcessHeap () returned 0x130000 [0053.350] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0053.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.350] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.352] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.353] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.355] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0053.355] GetProcessHeap () returned 0x130000 [0053.355] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0053.355] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0053.356] GetProcessHeap () returned 0x130000 [0053.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0053.356] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.356] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0053.356] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0053.356] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0053.356] GetProcessHeap () returned 0x130000 [0053.356] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.356] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0053.357] GetProcessHeap () returned 0x130000 [0053.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.357] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.357] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.357] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.357] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0053.357] GetProcessHeap () returned 0x130000 [0053.357] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.357] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0053.357] GetProcessHeap () returned 0x130000 [0053.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.357] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.357] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.357] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.357] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0053.358] GetProcessHeap () returned 0x130000 [0053.358] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0053.358] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0053.359] GetProcessHeap () returned 0x130000 [0053.359] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0053.359] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.359] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0053.359] GetProcessHeap () returned 0x130000 [0053.359] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0053.359] GetProcessHeap () returned 0x130000 [0053.359] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.359] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.359] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0053.359] GetProcessHeap () returned 0x130000 [0053.359] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.359] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.360] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.360] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.360] GetProcessHeap () returned 0x130000 [0053.360] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.361] GetProcessHeap () returned 0x130000 [0053.361] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.362] GetProcessHeap () returned 0x130000 [0053.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.363] GetProcessHeap () returned 0x130000 [0053.363] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.363] GetProcessHeap () returned 0x130000 [0053.363] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.363] GetProcessHeap () returned 0x130000 [0053.363] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.363] GetProcessHeap () returned 0x130000 [0053.363] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0053.363] GetProcessHeap () returned 0x130000 [0053.363] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.363] GetProcessHeap () returned 0x130000 [0053.363] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0053.364] GetProcessHeap () returned 0x130000 [0053.364] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0053.365] GetProcessHeap () returned 0x130000 [0053.365] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.365] GetProcessHeap () returned 0x130000 [0053.365] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.365] GetProcessHeap () returned 0x130000 [0053.365] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.366] GetProcessHeap () returned 0x130000 [0053.366] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.366] GetProcessHeap () returned 0x130000 [0053.366] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.368] GetProcessHeap () returned 0x130000 [0053.368] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.368] GetProcessHeap () returned 0x130000 [0053.368] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.368] GetProcessHeap () returned 0x130000 [0053.368] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.369] GetProcessHeap () returned 0x130000 [0053.369] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.370] GetProcessHeap () returned 0x130000 [0053.370] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.370] GetProcessHeap () returned 0x130000 [0053.370] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.370] GetProcessHeap () returned 0x130000 [0053.370] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0053.371] GetProcessHeap () returned 0x130000 [0053.371] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0053.372] GetProcessHeap () returned 0x130000 [0053.372] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.372] GetProcessHeap () returned 0x130000 [0053.372] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.372] GetProcessHeap () returned 0x130000 [0053.372] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.373] GetProcessHeap () returned 0x130000 [0053.374] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.374] GetProcessHeap () returned 0x130000 [0053.374] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.374] GetProcessHeap () returned 0x130000 [0053.374] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.374] GetProcessHeap () returned 0x130000 [0053.374] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.374] GetProcessHeap () returned 0x130000 [0053.374] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.377] GetProcessHeap () returned 0x130000 [0053.377] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0053.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0053.381] GetProcessHeap () returned 0x130000 [0053.381] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0053.381] GetProcessHeap () returned 0x130000 [0053.381] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.382] GetProcessHeap () returned 0x130000 [0053.382] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.382] GetProcessHeap () returned 0x130000 [0053.382] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0053.383] GetProcessHeap () returned 0x130000 [0053.383] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0053.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.383] GetProcessHeap () returned 0x130000 [0053.384] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0053.384] GetProcessHeap () returned 0x130000 [0053.384] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0053.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0053.384] GetProcessHeap () returned 0x130000 [0053.384] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0053.386] GetProcessHeap () returned 0x130000 [0053.386] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.386] GetProcessHeap () returned 0x130000 [0053.386] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.386] GetProcessHeap () returned 0x130000 [0053.386] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.386] GetProcessHeap () returned 0x130000 [0053.386] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0053.387] GetProcessHeap () returned 0x130000 [0053.387] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.387] GetProcessHeap () returned 0x130000 [0053.387] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0053.626] GetProcessHeap () returned 0x130000 [0053.626] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0053.627] GetProcessHeap () returned 0x130000 [0053.627] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.627] GetProcessHeap () returned 0x130000 [0053.627] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.627] GetProcessHeap () returned 0x130000 [0053.627] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0053.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0053.628] GetProcessHeap () returned 0x130000 [0053.628] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0053.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0053.628] GetProcessHeap () returned 0x130000 [0053.628] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0053.628] GetProcessHeap () returned 0x130000 [0053.628] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0053.629] GetProcessHeap () returned 0x130000 [0053.629] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.295] GetProcessHeap () returned 0x130000 [0054.295] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0054.295] GetProcessHeap () returned 0x130000 [0054.295] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0054.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0054.296] GetProcessHeap () returned 0x130000 [0054.296] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0054.296] GetProcessHeap () returned 0x130000 [0054.296] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.296] GetProcessHeap () returned 0x130000 [0054.296] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0054.296] GetProcessHeap () returned 0x130000 [0054.296] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.296] GetProcessHeap () returned 0x130000 [0054.296] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0054.299] GetProcessHeap () returned 0x130000 [0054.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.299] GetProcessHeap () returned 0x130000 [0054.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0054.300] GetProcessHeap () returned 0x130000 [0054.300] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0054.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0054.300] GetProcessHeap () returned 0x130000 [0054.300] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0054.301] GetProcessHeap () returned 0x130000 [0054.301] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0054.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0054.302] GetProcessHeap () returned 0x130000 [0054.302] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0054.304] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0054.304] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0054.304] GetProcessHeap () returned 0x130000 [0054.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0054.304] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0054.305] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0054.306] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0054.306] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0054.306] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0054.306] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0054.306] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0054.308] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0054.309] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0054.309] GetProcessHeap () returned 0x130000 [0054.309] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0054.310] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0054.310] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0054.310] GetProcessHeap () returned 0x130000 [0054.310] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0054.310] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0054.311] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0054.311] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0054.311] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0054.311] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0054.311] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="server", cAlternateFileName="")) returned 1 [0054.311] GetProcessHeap () returned 0x130000 [0054.311] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0054.312] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x866c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0054.312] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0054.312] GetProcessHeap () returned 0x130000 [0054.312] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8ba40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21240, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0054.312] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e440, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13840, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ae40, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-64.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0054.313] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0054.313] GetProcessHeap () returned 0x130000 [0054.313] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0054.313] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0054.313] GetProcessHeap () returned 0x130000 [0054.313] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0054.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0054.315] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.316] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0054.317] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0054.317] GetProcessHeap () returned 0x130000 [0054.317] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0054.318] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.318] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0054.318] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0054.318] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0054.318] GetProcessHeap () returned 0x130000 [0054.318] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0054.319] GetProcessHeap () returned 0x130000 [0054.319] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0054.319] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0054.319] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0054.319] GetProcessHeap () returned 0x130000 [0054.319] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0054.320] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0054.320] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0054.320] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0054.320] GetProcessHeap () returned 0x130000 [0054.320] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0054.320] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.320] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0054.321] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0054.321] GetProcessHeap () returned 0x130000 [0054.321] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0054.321] GetProcessHeap () returned 0x130000 [0054.321] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_sv.properties", cAlternateFileName="ME0541~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_CN.properties", cAlternateFileName="ME40CD~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_HK.properties", cAlternateFileName="MEB8B5~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_TW.properties", cAlternateFileName="MECC18~1.PRO")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x218e, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif", cAlternateFileName="")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash@2x.gif", cAlternateFileName="SPLASH~1.GIF")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11-lic.gif", cAlternateFileName="SPLASH~2.GIF")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 1 [0054.324] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 0 [0054.324] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0054.325] GetProcessHeap () returned 0x130000 [0054.325] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.325] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0054.325] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ext", cAlternateFileName="")) returned 1 [0054.325] GetProcessHeap () returned 0x130000 [0054.325] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2de78, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-64.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3ae816, dwReserved0=0x0, dwReserved1=0x0, cFileName="cldrdata.jar", cAlternateFileName="")) returned 1 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xade4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1166a99, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0054.327] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8546b2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa8546b2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21a46d, dwReserved0=0x0, dwReserved1=0x0, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1edd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nashorn.jar", cAlternateFileName="")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44661, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7fbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d5bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0054.328] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 0 [0054.328] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0054.329] GetProcessHeap () returned 0x130000 [0054.329] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.329] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0054.329] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeba, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0054.329] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2948, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0054.329] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fonts", cAlternateFileName="")) returned 1 [0054.329] GetProcessHeap () returned 0x130000 [0054.329] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiItalic.ttf", cAlternateFileName="LUCIDA~2.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightItalic.ttf", cAlternateFileName="LUCIDA~3.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5434c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightRegular.ttf", cAlternateFileName="LUCIDA~4.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d9c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansDemiBold.ttf", cAlternateFileName="LU38C7~1.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaa77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansRegular.ttf", cAlternateFileName="LU761B~1.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39254, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterBold.ttf", cAlternateFileName="LUE73B~1.TTF")) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 1 [0054.332] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 0 [0054.332] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0054.332] GetProcessHeap () returned 0x130000 [0054.332] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.332] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0054.332] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0054.332] GetProcessHeap () returned 0x130000 [0054.332] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0054.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0054.333] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.333] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0054.333] GetProcessHeap () returned 0x130000 [0054.333] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0054.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="invalid32x32.gif", cAlternateFileName="INVALI~1.GIF")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyDrop32x32.gif", cAlternateFileName="WIN32_~1.GIF")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyNoDrop32x32.gif", cAlternateFileName="WIN32_~2.GIF")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkDrop32x32.gif", cAlternateFileName="WIN32_~3.GIF")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkNoDrop32x32.gif", cAlternateFileName="WIN32_~4.GIF")) returned 1 [0054.578] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveDrop32x32.gif", cAlternateFileName="WI06CF~1.GIF")) returned 1 [0054.579] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 1 [0054.579] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 0 [0054.579] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0054.579] GetProcessHeap () returned 0x130000 [0054.579] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0054.580] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 0 [0054.580] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0054.580] GetProcessHeap () returned 0x130000 [0054.580] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0054.580] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0054.580] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8e66d0e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe6827, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0054.580] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0054.580] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr", cAlternateFileName="")) returned 1 [0054.581] GetProcessHeap () returned 0x130000 [0054.581] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0054.581] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.581] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 0 [0054.582] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0054.582] GetProcessHeap () returned 0x130000 [0054.582] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x848c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxswt.jar", cAlternateFileName="")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa76f896, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0054.582] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0054.582] GetProcessHeap () returned 0x130000 [0054.582] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0054.584] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.584] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0054.584] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0054.584] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0054.584] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0054.584] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 0 [0054.584] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0054.585] GetProcessHeap () returned 0x130000 [0054.585] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.585] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0054.585] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0054.585] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0054.585] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8df45fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d588b, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0054.585] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0054.585] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0054.586] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x354add, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0054.586] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0054.586] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0054.586] GetProcessHeap () returned 0x130000 [0054.586] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklisted.certs", cAlternateFileName="BLACKL~1.CER")) returned 1 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c0eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cacerts", cAlternateFileName="")) returned 1 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0054.588] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0054.589] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0054.589] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0054.589] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0054.589] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 0 [0054.589] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0054.589] GetProcessHeap () returned 0x130000 [0054.589] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.589] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0054.590] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x19c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzdb.dat", cAlternateFileName="")) returned 1 [0054.590] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0054.590] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 0 [0054.590] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0054.590] GetProcessHeap () returned 0x130000 [0054.590] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0054.590] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0054.590] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0054.590] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x210, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0054.591] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0054.591] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2371c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0054.591] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0054.591] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0054.591] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0054.591] GetProcessHeap () returned 0x130000 [0054.591] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.592] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28834f30, ftCreationTime.dwHighDateTime=0x1d59e64, ftLastAccessTime.dwLowDateTime=0x1001a130, ftLastAccessTime.dwHighDateTime=0x1d5e6e1, ftLastWriteTime.dwLowDateTime=0x1001a130, ftLastWriteTime.dwHighDateTime=0x1d5e6e1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 1 [0054.592] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56032a40, ftCreationTime.dwHighDateTime=0x1d59ea8, ftLastAccessTime.dwLowDateTime=0x3baf2870, ftLastAccessTime.dwHighDateTime=0x1d5884a, ftLastWriteTime.dwLowDateTime=0x3baf2870, ftLastWriteTime.dwHighDateTime=0x1d5884a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0054.593] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56032a40, ftCreationTime.dwHighDateTime=0x1d59ea8, ftLastAccessTime.dwLowDateTime=0x3baf2870, ftLastAccessTime.dwHighDateTime=0x1d5884a, ftLastWriteTime.dwLowDateTime=0x3baf2870, ftLastWriteTime.dwHighDateTime=0x1d5884a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 0 [0054.593] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0054.593] GetProcessHeap () returned 0x130000 [0054.593] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0054.593] FindNextFileW (in: hFindFile=0x18f998, lpFindFileData=0x347f268 | out: lpFindFileData=0x347f268*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0054.593] GetProcessHeap () returned 0x130000 [0054.593] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0054.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0054.593] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.593] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7252e530, ftCreationTime.dwHighDateTime=0x1d5a0f3, ftLastAccessTime.dwLowDateTime=0x3ef974d0, ftLastAccessTime.dwHighDateTime=0x1d58602, ftLastWriteTime.dwLowDateTime=0x3ef974d0, ftLastWriteTime.dwHighDateTime=0x1d58602, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="afr38.exe", cAlternateFileName="")) returned 1 [0054.593] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0054.593] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSystemMetadata.xml", cAlternateFileName="FILESY~1.XML")) returned 1 [0054.593] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 1 [0054.593] GetProcessHeap () returned 0x130000 [0054.593] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0054.594] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.594] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x2a9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0054.594] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ea17a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x17103, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0054.594] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0054.595] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x8df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0054.595] GetProcessHeap () returned 0x130000 [0054.595] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.595] GetProcessHeap () returned 0x130000 [0054.595] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0054.602] GetProcessHeap () returned 0x130000 [0054.602] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0054.602] GetProcessHeap () returned 0x130000 [0054.602] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0054.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0054.602] GetProcessHeap () returned 0x130000 [0054.603] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0054.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0054.607] GetProcessHeap () returned 0x130000 [0054.607] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0054.607] GetProcessHeap () returned 0x130000 [0054.607] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0054.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0054.609] GetProcessHeap () returned 0x130000 [0054.609] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0054.894] GetProcessHeap () returned 0x130000 [0054.894] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.895] GetProcessHeap () returned 0x130000 [0054.895] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0054.898] GetProcessHeap () returned 0x130000 [0054.898] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0054.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0054.901] GetProcessHeap () returned 0x130000 [0054.901] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0054.901] GetProcessHeap () returned 0x130000 [0054.901] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.902] GetProcessHeap () returned 0x130000 [0054.902] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0054.902] GetProcessHeap () returned 0x130000 [0054.902] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0054.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0054.905] GetProcessHeap () returned 0x130000 [0054.905] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0054.907] GetProcessHeap () returned 0x130000 [0054.907] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.907] GetProcessHeap () returned 0x130000 [0054.907] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0054.910] GetProcessHeap () returned 0x130000 [0054.910] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.910] GetProcessHeap () returned 0x130000 [0054.910] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0054.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0054.914] GetProcessHeap () returned 0x130000 [0054.914] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0054.914] GetProcessHeap () returned 0x130000 [0054.914] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0054.914] GetProcessHeap () returned 0x130000 [0054.914] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0054.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0055.201] GetProcessHeap () returned 0x130000 [0055.201] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0055.201] GetProcessHeap () returned 0x130000 [0055.201] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0055.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0055.216] GetProcessHeap () returned 0x130000 [0055.216] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0055.216] GetProcessHeap () returned 0x130000 [0055.216] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0055.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0055.244] GetProcessHeap () returned 0x130000 [0055.244] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0055.244] GetProcessHeap () returned 0x130000 [0055.244] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0055.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0055.891] GetProcessHeap () returned 0x130000 [0055.891] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0055.891] GetProcessHeap () returned 0x130000 [0055.891] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0055.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0055.895] GetProcessHeap () returned 0x130000 [0055.895] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0055.895] GetProcessHeap () returned 0x130000 [0055.895] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0055.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0055.898] GetProcessHeap () returned 0x130000 [0055.898] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0055.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0055.902] GetProcessHeap () returned 0x130000 [0055.903] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0055.903] GetProcessHeap () returned 0x130000 [0055.903] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0055.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0055.903] GetProcessHeap () returned 0x130000 [0055.903] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0055.904] GetProcessHeap () returned 0x130000 [0055.904] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0055.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0055.904] GetProcessHeap () returned 0x130000 [0055.904] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0055.904] GetProcessHeap () returned 0x130000 [0055.905] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0055.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0055.909] GetProcessHeap () returned 0x130000 [0055.909] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0055.909] GetProcessHeap () returned 0x130000 [0055.909] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0055.909] GetProcessHeap () returned 0x130000 [0055.909] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0055.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0055.914] GetProcessHeap () returned 0x130000 [0055.914] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0055.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0055.916] GetProcessHeap () returned 0x130000 [0055.916] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0055.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0055.917] GetProcessHeap () returned 0x130000 [0055.917] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0055.917] GetProcessHeap () returned 0x130000 [0055.917] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0055.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x99937c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99937c0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0056.107] GetProcessHeap () returned 0x130000 [0056.107] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0056.117] GetProcessHeap () returned 0x130000 [0056.117] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0056.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0056.122] GetProcessHeap () returned 0x130000 [0056.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0056.123] GetProcessHeap () returned 0x130000 [0056.123] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0056.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0056.130] GetProcessHeap () returned 0x130000 [0056.130] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0056.130] GetProcessHeap () returned 0x130000 [0056.130] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0056.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0056.133] GetProcessHeap () returned 0x130000 [0056.133] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0056.147] GetProcessHeap () returned 0x130000 [0056.147] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0056.148] GetProcessHeap () returned 0x130000 [0056.148] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0056.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0056.149] GetProcessHeap () returned 0x130000 [0056.149] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0056.150] GetProcessHeap () returned 0x130000 [0056.150] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0056.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0056.150] GetProcessHeap () returned 0x130000 [0056.150] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0056.150] GetProcessHeap () returned 0x130000 [0056.150] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0056.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0056.151] GetProcessHeap () returned 0x130000 [0056.151] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0056.151] GetProcessHeap () returned 0x130000 [0056.151] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0056.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1335b74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1335b74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0056.154] GetProcessHeap () returned 0x130000 [0056.154] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0056.154] GetProcessHeap () returned 0x130000 [0056.154] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0056.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0056.156] GetProcessHeap () returned 0x130000 [0056.156] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0056.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0056.158] GetProcessHeap () returned 0x130000 [0056.158] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0056.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0056.397] GetProcessHeap () returned 0x130000 [0056.397] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0056.416] GetProcessHeap () returned 0x130000 [0056.416] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.416] GetProcessHeap () returned 0x130000 [0056.416] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0056.419] GetProcessHeap () returned 0x130000 [0056.419] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.419] GetProcessHeap () returned 0x130000 [0056.419] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0056.423] GetProcessHeap () returned 0x130000 [0056.423] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.423] GetProcessHeap () returned 0x130000 [0056.423] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0056.426] GetProcessHeap () returned 0x130000 [0056.426] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.426] GetProcessHeap () returned 0x130000 [0056.426] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0056.436] GetProcessHeap () returned 0x130000 [0056.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.436] GetProcessHeap () returned 0x130000 [0056.436] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0056.439] GetProcessHeap () returned 0x130000 [0056.439] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.440] GetProcessHeap () returned 0x130000 [0056.440] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0056.442] GetProcessHeap () returned 0x130000 [0056.442] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.442] GetProcessHeap () returned 0x130000 [0056.442] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0056.446] GetProcessHeap () returned 0x130000 [0056.446] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.447] GetProcessHeap () returned 0x130000 [0056.447] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0056.449] GetProcessHeap () returned 0x130000 [0056.449] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.450] GetProcessHeap () returned 0x130000 [0056.450] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0056.905] GetProcessHeap () returned 0x130000 [0056.906] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.906] GetProcessHeap () returned 0x130000 [0056.906] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0056.908] GetProcessHeap () returned 0x130000 [0056.908] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.909] GetProcessHeap () returned 0x130000 [0056.909] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0056.911] GetProcessHeap () returned 0x130000 [0056.912] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.912] GetProcessHeap () returned 0x130000 [0056.912] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0056.914] GetProcessHeap () returned 0x130000 [0056.914] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.914] GetProcessHeap () returned 0x130000 [0056.914] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0056.917] GetProcessHeap () returned 0x130000 [0056.917] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.917] GetProcessHeap () returned 0x130000 [0056.917] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0056.920] GetProcessHeap () returned 0x130000 [0056.920] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.920] GetProcessHeap () returned 0x130000 [0056.920] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0056.923] GetProcessHeap () returned 0x130000 [0056.923] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.923] GetProcessHeap () returned 0x130000 [0056.923] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0056.925] GetProcessHeap () returned 0x130000 [0056.926] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.926] GetProcessHeap () returned 0x130000 [0056.926] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0056.930] GetProcessHeap () returned 0x130000 [0056.930] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.930] GetProcessHeap () returned 0x130000 [0056.930] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0056.935] GetProcessHeap () returned 0x130000 [0056.935] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.935] GetProcessHeap () returned 0x130000 [0056.935] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0056.938] GetProcessHeap () returned 0x130000 [0056.938] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.938] GetProcessHeap () returned 0x130000 [0056.938] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0056.941] GetProcessHeap () returned 0x130000 [0056.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.941] GetProcessHeap () returned 0x130000 [0056.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0056.944] GetProcessHeap () returned 0x130000 [0056.944] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0056.944] GetProcessHeap () returned 0x130000 [0056.944] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0056.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0057.259] GetProcessHeap () returned 0x130000 [0057.259] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.259] GetProcessHeap () returned 0x130000 [0057.259] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0057.262] GetProcessHeap () returned 0x130000 [0057.262] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.263] GetProcessHeap () returned 0x130000 [0057.263] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ms\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0057.266] GetProcessHeap () returned 0x130000 [0057.266] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.266] GetProcessHeap () returned 0x130000 [0057.266] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\nl\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0057.270] GetProcessHeap () returned 0x130000 [0057.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.271] GetProcessHeap () returned 0x130000 [0057.271] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\no\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0057.274] GetProcessHeap () returned 0x130000 [0057.274] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.274] GetProcessHeap () returned 0x130000 [0057.274] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pl\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0057.277] GetProcessHeap () returned 0x130000 [0057.277] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.277] GetProcessHeap () returned 0x130000 [0057.277] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-BR\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0057.280] GetProcessHeap () returned 0x130000 [0057.280] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.280] GetProcessHeap () returned 0x130000 [0057.280] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-pt\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0057.282] GetProcessHeap () returned 0x130000 [0057.282] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.282] GetProcessHeap () returned 0x130000 [0057.283] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ro\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0057.285] GetProcessHeap () returned 0x130000 [0057.285] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.285] GetProcessHeap () returned 0x130000 [0057.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ru\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0057.288] GetProcessHeap () returned 0x130000 [0057.288] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.288] GetProcessHeap () returned 0x130000 [0057.288] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0057.291] GetProcessHeap () returned 0x130000 [0057.291] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.291] GetProcessHeap () returned 0x130000 [0057.291] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sl\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0057.294] GetProcessHeap () returned 0x130000 [0057.294] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.294] GetProcessHeap () returned 0x130000 [0057.294] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Cyrl\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0057.296] GetProcessHeap () returned 0x130000 [0057.296] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.297] GetProcessHeap () returned 0x130000 [0057.297] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0057.299] GetProcessHeap () returned 0x130000 [0057.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.299] GetProcessHeap () returned 0x130000 [0057.299] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0057.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn-CS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0057.993] GetProcessHeap () returned 0x130000 [0057.993] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0057.995] GetProcessHeap () returned 0x130000 [0057.995] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0057.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sv\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0058.047] GetProcessHeap () returned 0x130000 [0058.047] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.047] GetProcessHeap () returned 0x130000 [0058.047] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0058.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\th\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1860d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0058.086] GetProcessHeap () returned 0x130000 [0058.086] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.086] GetProcessHeap () returned 0x130000 [0058.086] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0058.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\tr\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0058.092] GetProcessHeap () returned 0x130000 [0058.092] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.092] GetProcessHeap () returned 0x130000 [0058.092] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0058.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\uk\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0058.095] GetProcessHeap () returned 0x130000 [0058.095] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.095] GetProcessHeap () returned 0x130000 [0058.095] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0058.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\vi\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0058.098] GetProcessHeap () returned 0x130000 [0058.098] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.098] GetProcessHeap () returned 0x130000 [0058.098] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0058.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0058.101] GetProcessHeap () returned 0x130000 [0058.101] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.101] GetProcessHeap () returned 0x130000 [0058.101] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0058.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANT\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0058.103] GetProcessHeap () returned 0x130000 [0058.103] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0058.104] GetProcessHeap () returned 0x130000 [0058.104] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0058.104] GetProcessHeap () returned 0x130000 [0058.105] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.105] GetProcessHeap () returned 0x130000 [0058.105] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0058.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0058.108] GetProcessHeap () returned 0x130000 [0058.108] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0058.108] GetProcessHeap () returned 0x130000 [0058.108] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0058.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0058.112] GetProcessHeap () returned 0x130000 [0058.112] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0058.115] GetProcessHeap () returned 0x130000 [0058.115] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.115] GetProcessHeap () returned 0x130000 [0058.115] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0058.117] GetProcessHeap () returned 0x130000 [0058.117] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.117] GetProcessHeap () returned 0x130000 [0058.117] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0058.497] GetProcessHeap () returned 0x130000 [0058.497] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.497] GetProcessHeap () returned 0x130000 [0058.497] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0058.572] GetProcessHeap () returned 0x130000 [0058.572] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.572] GetProcessHeap () returned 0x130000 [0058.572] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0058.594] GetProcessHeap () returned 0x130000 [0058.594] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.594] GetProcessHeap () returned 0x130000 [0058.594] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0058.710] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.711] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x44a38de, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x44a38de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.711] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37acc11, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.711] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.711] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x91adba5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91d3da7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.711] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133f40a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x502f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.de.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.711] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133f40a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x502f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.de.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.711] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0058.712] GetProcessHeap () returned 0x130000 [0058.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.712] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0058.712] GetProcessHeap () returned 0x130000 [0058.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0058.748] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.748] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf46b8986, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.749] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.749] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e5cc4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.749] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.749] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15365236, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.el.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.749] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15365236, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.el.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.749] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0058.750] GetProcessHeap () returned 0x130000 [0058.750] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.750] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0058.750] GetProcessHeap () returned 0x130000 [0058.750] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0058.755] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.756] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf75a8fbb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf75a8fbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x153fdb85, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.756] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x38b7c4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38b7c4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.757] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb654e78, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb654e78, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb654e78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.757] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x29f7370, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x29f7370, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4918, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.757] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1395164b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f18d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.es.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.757] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1395164b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f18d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.es.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.757] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0058.758] GetProcessHeap () returned 0x130000 [0058.758] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.758] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0058.758] GetProcessHeap () returned 0x130000 [0058.758] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b3bafd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b3bafd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b0f72e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b0f72e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d04716, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d04716, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d04716, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc72b8a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc72b8a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6af8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e9db, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.et.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.790] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e9db, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.et.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.790] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0058.791] GetProcessHeap () returned 0x130000 [0058.791] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.791] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0058.791] GetProcessHeap () returned 0x130000 [0058.791] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7c5d9c5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7c5d9c5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37f90ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d2a978, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d2a978, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4edc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.eu.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.794] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1341a2e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4edc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.eu.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.794] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0058.795] GetProcessHeap () returned 0x130000 [0058.795] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.795] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0058.795] GetProcessHeap () returned 0x130000 [0058.795] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf18f9628, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x13977942, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa5581c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa68949f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c1f8d1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c1f8d1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c45b55, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6aee686, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6aee686, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x138defa8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13bd9da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.fi.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.798] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x138defa8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13bd9da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.fi.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.798] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0058.799] GetProcessHeap () returned 0x130000 [0058.799] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.799] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0058.799] GetProcessHeap () returned 0x130000 [0058.799] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7582db3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5127e7d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5127e7d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5127e7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x50b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.fr.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.802] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13440553, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.fr.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.803] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0058.803] GetProcessHeap () returned 0x130000 [0058.803] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.803] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0058.803] GetProcessHeap () returned 0x130000 [0058.803] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbe3ab3a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbe3ab3a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbe3ab3a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ac3a61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4caf7cd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4caf7cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4caf7cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4918, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13aced2b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f09b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.gl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.806] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13aced2b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f09b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.gl.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.806] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0058.807] GetProcessHeap () returned 0x130000 [0058.807] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.807] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0058.807] GetProcessHeap () returned 0x130000 [0058.807] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c6bda4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x13bb3be0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3440, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6bae279, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bd443f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4a98712, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4abe91a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61b1409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61b1409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13a8299e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aa8b23, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.he.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.809] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13a8299e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aa8b23, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.he.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.810] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0058.810] GetProcessHeap () returned 0x130000 [0058.810] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.810] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0058.810] GetProcessHeap () returned 0x130000 [0058.810] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1466e4fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa806c3d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc3c8ab, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc3c8ab, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6866e01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1428e945, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x142b4b24, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.hi.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1428e945, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x142b4b24, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.hi.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0058.813] FindClose (in: hFindFile=0x18fa58 | out: hFindFile=0x18fa58) returned 1 [0058.814] GetProcessHeap () returned 0x130000 [0058.814] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0058.814] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0058.814] GetProcessHeap () returned 0x130000 [0058.814] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0058.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0059.038] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.038] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14268686, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc40d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.039] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf07af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf07af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.039] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.039] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e310c7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e310c7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e7d566, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.039] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13b67741, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f598, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.hr.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.039] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x13b67741, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f598, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.hr.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.039] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0059.040] GetProcessHeap () returned 0x130000 [0059.040] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.040] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0059.040] GetProcessHeap () returned 0x130000 [0059.040] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0059.042] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.042] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5eb74f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5eb74f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.042] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa937f07, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.042] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6164f96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.042] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x54ef2e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x54ef2e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x575324, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.043] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14648313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1466e4fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d09, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.hu.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.043] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14648313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1466e4fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d09, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.hu.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.043] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0059.043] GetProcessHeap () returned 0x130000 [0059.043] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.043] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0059.044] GetProcessHeap () returned 0x130000 [0059.044] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2ff666, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2ff666, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1466e4fb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf43e3cb7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4409f1c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf18f9628, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf18f9628, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1434d390, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14589889, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4df89, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.id.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.046] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1434d390, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14589889, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4df89, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.id.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.046] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0059.047] GetProcessHeap () returned 0x130000 [0059.047] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.047] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0059.047] GetProcessHeap () returned 0x130000 [0059.047] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6840bbc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6840bbc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152f2ade, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x865a7d2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf964b3dd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14969496, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14a01eaa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f0e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.it.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14969496, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14a01eaa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f0e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.it.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.049] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0059.050] GetProcessHeap () returned 0x130000 [0059.050] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.050] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0059.050] GetProcessHeap () returned 0x130000 [0059.050] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.052] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.053] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1498f816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc1c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.053] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4bc999b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.053] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x680214, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.053] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf311d3eb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf311d3eb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf311d3eb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x50a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.053] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x146e0bdc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50074, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ja.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.053] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x146e0bdc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50074, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ja.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.053] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0059.054] GetProcessHeap () returned 0x130000 [0059.054] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.054] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0059.054] GetProcessHeap () returned 0x130000 [0059.054] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc34bb5b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc34bb5b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14bf1c4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae6f174, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb8dd674, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb8dd674, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14b330aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x515e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.kk.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.056] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14b330aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x515e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.kk.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.056] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0059.057] GetProcessHeap () returned 0x130000 [0059.057] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.057] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0059.057] GetProcessHeap () returned 0x130000 [0059.057] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.061] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.061] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc18a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a04f26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b15891, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5e43de4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14ac0994, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14bcb9e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ko.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.062] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x14ac0994, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14bcb9e3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ko.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.062] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0059.063] GetProcessHeap () returned 0x130000 [0059.063] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.063] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0059.063] GetProcessHeap () returned 0x130000 [0059.063] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb6089d0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb6089d0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x152f2ade, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc42c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5101cbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9992797, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9992797, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9992797, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b78b8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b78b8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b9ee02, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4918, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x152a6704, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f98b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.lt.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.065] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x152a6704, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f98b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.lt.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.065] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0059.066] GetProcessHeap () returned 0x130000 [0059.066] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.066] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0059.066] GetProcessHeap () returned 0x130000 [0059.066] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0059.068] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.068] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf035e09d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.068] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0dcc568, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.068] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.068] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf475131d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.068] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f891, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.lv.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.069] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f891, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.lv.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.069] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0059.069] GetProcessHeap () returned 0x130000 [0059.069] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1525a179, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3fa6c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap", cAlternateFileName="MICROS~1.XAP")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22a9f7a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Reporting.Common.dll", cAlternateFileName="MIB9B1~1.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x670f8d9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c478, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.dll", cAlternateFileName="MID48A~1.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7d7750, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7d7750, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7d7750, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaac403, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaac403, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x860e337, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x860e337, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Authorization.dll", cAlternateFileName="MIBBB9~1.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c3d17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c3d17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c63313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Interfaces.dll", cAlternateFileName="MI2DB2~1.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7641936, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7641936, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5556e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ProgressiveProcessing.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.070] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0059.070] GetProcessHeap () returned 0x130000 [0059.070] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8719376, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x61fe8c4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x61fe8c4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ab259c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ad884b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e046, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ms.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.073] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ab259c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ad884b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e046, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ms.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.073] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0059.074] GetProcessHeap () returned 0x130000 [0059.074] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.074] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0059.074] GetProcessHeap () returned 0x130000 [0059.074] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0059.076] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.076] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4d48116, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4d48116, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc46b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.076] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x718b80, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x718b80, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x718b80, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x718b80, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18d43c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18d43c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1920897, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15a3fea8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f5cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.nl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15a3fea8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f5cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.nl.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.077] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0059.078] GetProcessHeap () returned 0x130000 [0059.078] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.078] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0059.078] GetProcessHeap () returned 0x130000 [0059.078] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0059.079] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.079] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf18f9628, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15b9737d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.079] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf458770a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45d3b76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.079] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8719376, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x97efe5f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.079] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc43098a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x70b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.079] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b71118, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e5d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.no.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.080] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b71118, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e5d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.no.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.080] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0059.080] GetProcessHeap () returned 0x130000 [0059.080] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.080] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0059.080] GetProcessHeap () returned 0x130000 [0059.080] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.220] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.220] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7c83c72, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7c83c72, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15b9737d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.221] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4620012, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.221] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44c8b33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44c8b33, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.221] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x231c662, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x231c662, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x231c662, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b30, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.221] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b24c93, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b4aee2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x505dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.pl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.221] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15b24c93, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b4aee2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x505dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.pl.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.221] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0059.222] GetProcessHeap () returned 0x130000 [0059.222] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.222] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0059.222] GetProcessHeap () returned 0x130000 [0059.223] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0059.233] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.233] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc32591f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc32591f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1624bdaa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.234] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4cd4a32, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cd4a32, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cd4a32, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.234] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x443f20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x443f20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.234] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.234] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15bbd5ad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15cc8628, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f281, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.pt.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.234] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15bbd5ad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15cc8628, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f281, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.pt.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.234] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0059.235] GetProcessHeap () returned 0x130000 [0059.235] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.235] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0059.235] GetProcessHeap () returned 0x130000 [0059.235] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0059.237] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.237] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc46c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.237] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x29f7370, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x29f7370, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.237] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.237] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf475131d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.238] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15be380c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.pt-PT.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.238] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15be380c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.pt-PT.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.238] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0059.238] GetProcessHeap () returned 0x130000 [0059.238] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.238] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0059.239] GetProcessHeap () returned 0x130000 [0059.239] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aa3169, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aa3169, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6aee686, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6aee686, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaac403, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaac403, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x98ae9c2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x98ae9c2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x98ae9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d3adab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d871e6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fd7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ro.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.241] FindNextFileW (in: hFindFile=0x18f858, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d3adab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d871e6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4fd7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ro.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.241] FindClose (in: hFindFile=0x18f858 | out: hFindFile=0x18f858) returned 1 [0059.242] GetProcessHeap () returned 0x130000 [0059.242] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.242] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0059.242] GetProcessHeap () returned 0x130000 [0059.242] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d50bdc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d50bdc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45d3b76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45f9db0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0e95c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0e95c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefe00baf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00d5872, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d14b21, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x530d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ru.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.244] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15d14b21, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x530d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.ru.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.244] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0059.245] GetProcessHeap () returned 0x130000 [0059.245] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.245] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0059.245] GetProcessHeap () returned 0x130000 [0059.245] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c6bda4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb86af90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb86af90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb86af90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e92299, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15eb84b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50264, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sk.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.248] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e92299, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15eb84b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50264, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sk.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.248] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0059.249] GetProcessHeap () returned 0x130000 [0059.249] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.249] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0059.249] GetProcessHeap () returned 0x130000 [0059.249] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0059.251] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.251] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b359a5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4868, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.251] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42d8c51, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.251] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd09866, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd09866, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.252] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f4ff2d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f4ff2d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.252] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e45dad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e6c018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.252] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e45dad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e6c018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sl.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.252] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0059.252] GetProcessHeap () returned 0x130000 [0059.252] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.252] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0059.253] GetProcessHeap () returned 0x130000 [0059.253] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0059.257] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.257] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a2a905, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1600fa20, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc40a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0059.257] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5ab1579, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5ab1579, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0059.258] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d05722, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0059.258] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d50bdc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d50bdc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d50bdc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0059.258] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15f04999, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f9d2e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-cyrl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0059.258] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15f04999, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f9d2e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-cyrl.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0059.258] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0059.258] GetProcessHeap () returned 0x130000 [0059.258] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.259] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0059.259] GetProcessHeap () returned 0x130000 [0059.259] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0059.264] GetProcessHeap () returned 0x130000 [0059.264] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.264] GetProcessHeap () returned 0x130000 [0059.264] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0059.267] GetProcessHeap () returned 0x130000 [0059.267] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.267] GetProcessHeap () returned 0x130000 [0059.267] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.270] GetProcessHeap () returned 0x130000 [0059.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.270] GetProcessHeap () returned 0x130000 [0059.270] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0059.490] GetProcessHeap () returned 0x130000 [0059.490] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.490] GetProcessHeap () returned 0x130000 [0059.490] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0059.494] GetProcessHeap () returned 0x130000 [0059.494] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.494] GetProcessHeap () returned 0x130000 [0059.494] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0059.497] GetProcessHeap () returned 0x130000 [0059.497] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.497] GetProcessHeap () returned 0x130000 [0059.497] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0059.499] GetProcessHeap () returned 0x130000 [0059.499] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.500] GetProcessHeap () returned 0x130000 [0059.500] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0059.502] GetProcessHeap () returned 0x130000 [0059.502] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.502] GetProcessHeap () returned 0x130000 [0059.502] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0059.504] GetProcessHeap () returned 0x130000 [0059.504] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.505] GetProcessHeap () returned 0x130000 [0059.505] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0059.506] GetProcessHeap () returned 0x130000 [0059.506] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0059.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0059.512] GetProcessHeap () returned 0x130000 [0059.512] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0059.519] GetProcessHeap () returned 0x130000 [0059.519] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.519] GetProcessHeap () returned 0x130000 [0059.519] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0059.523] GetProcessHeap () returned 0x130000 [0059.523] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.523] GetProcessHeap () returned 0x130000 [0059.523] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0059.527] GetProcessHeap () returned 0x130000 [0059.527] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.527] GetProcessHeap () returned 0x130000 [0059.527] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0059.532] GetProcessHeap () returned 0x130000 [0059.532] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0059.532] GetProcessHeap () returned 0x130000 [0059.532] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0059.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0060.091] GetProcessHeap () returned 0x130000 [0060.091] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.091] GetProcessHeap () returned 0x130000 [0060.091] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.095] GetProcessHeap () returned 0x130000 [0060.095] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.095] GetProcessHeap () returned 0x130000 [0060.095] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.098] GetProcessHeap () returned 0x130000 [0060.098] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.099] GetProcessHeap () returned 0x130000 [0060.099] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.102] GetProcessHeap () returned 0x130000 [0060.102] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.102] GetProcessHeap () returned 0x130000 [0060.102] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.106] GetProcessHeap () returned 0x130000 [0060.106] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.106] GetProcessHeap () returned 0x130000 [0060.106] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0060.110] GetProcessHeap () returned 0x130000 [0060.110] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.110] GetProcessHeap () returned 0x130000 [0060.110] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0060.113] GetProcessHeap () returned 0x130000 [0060.113] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.113] GetProcessHeap () returned 0x130000 [0060.113] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0060.116] GetProcessHeap () returned 0x130000 [0060.117] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.117] GetProcessHeap () returned 0x130000 [0060.117] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0060.119] GetProcessHeap () returned 0x130000 [0060.119] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.119] GetProcessHeap () returned 0x130000 [0060.120] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0060.123] GetProcessHeap () returned 0x130000 [0060.123] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.123] GetProcessHeap () returned 0x130000 [0060.123] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0060.126] GetProcessHeap () returned 0x130000 [0060.126] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.126] GetProcessHeap () returned 0x130000 [0060.126] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0060.130] GetProcessHeap () returned 0x130000 [0060.130] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.130] GetProcessHeap () returned 0x130000 [0060.130] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0060.133] GetProcessHeap () returned 0x130000 [0060.133] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.133] GetProcessHeap () returned 0x130000 [0060.134] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0060.471] GetProcessHeap () returned 0x130000 [0060.471] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.471] GetProcessHeap () returned 0x130000 [0060.471] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0060.475] GetProcessHeap () returned 0x130000 [0060.475] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.475] GetProcessHeap () returned 0x130000 [0060.475] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0060.479] GetProcessHeap () returned 0x130000 [0060.479] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.479] GetProcessHeap () returned 0x130000 [0060.479] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0060.483] GetProcessHeap () returned 0x130000 [0060.483] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.483] GetProcessHeap () returned 0x130000 [0060.483] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.497] GetProcessHeap () returned 0x130000 [0060.497] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.497] GetProcessHeap () returned 0x130000 [0060.497] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0060.501] GetProcessHeap () returned 0x130000 [0060.501] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.501] GetProcessHeap () returned 0x130000 [0060.501] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0060.505] GetProcessHeap () returned 0x130000 [0060.505] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.505] GetProcessHeap () returned 0x130000 [0060.505] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0060.509] GetProcessHeap () returned 0x130000 [0060.509] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.509] GetProcessHeap () returned 0x130000 [0060.509] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0060.512] GetProcessHeap () returned 0x130000 [0060.512] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.513] GetProcessHeap () returned 0x130000 [0060.513] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0060.519] GetProcessHeap () returned 0x130000 [0060.519] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.519] GetProcessHeap () returned 0x130000 [0060.519] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0060.525] GetProcessHeap () returned 0x130000 [0060.525] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.525] GetProcessHeap () returned 0x130000 [0060.525] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0060.841] GetProcessHeap () returned 0x130000 [0060.841] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.841] GetProcessHeap () returned 0x130000 [0060.842] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.845] GetProcessHeap () returned 0x130000 [0060.845] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.845] GetProcessHeap () returned 0x130000 [0060.845] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0060.849] GetProcessHeap () returned 0x130000 [0060.849] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.849] GetProcessHeap () returned 0x130000 [0060.849] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0060.853] GetProcessHeap () returned 0x130000 [0060.853] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0060.853] GetProcessHeap () returned 0x130000 [0060.853] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0060.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0060.855] GetProcessHeap () returned 0x130000 [0060.856] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf145ad52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.856] GetProcessHeap () returned 0x130000 [0060.856] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.856] GetProcessHeap () returned 0x130000 [0060.856] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.857] GetProcessHeap () returned 0x130000 [0060.857] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.857] GetProcessHeap () returned 0x130000 [0060.857] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.857] GetProcessHeap () returned 0x130000 [0060.857] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.857] GetProcessHeap () returned 0x130000 [0060.858] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0060.858] GetProcessHeap () returned 0x130000 [0060.858] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.859] GetProcessHeap () returned 0x130000 [0060.859] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0060.860] GetProcessHeap () returned 0x130000 [0060.860] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.860] GetProcessHeap () returned 0x130000 [0060.860] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.861] GetProcessHeap () returned 0x130000 [0060.861] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.861] GetProcessHeap () returned 0x130000 [0060.861] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.862] GetProcessHeap () returned 0x130000 [0060.862] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.862] GetProcessHeap () returned 0x130000 [0060.862] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.863] GetProcessHeap () returned 0x130000 [0060.863] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.863] GetProcessHeap () returned 0x130000 [0060.863] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0060.865] GetProcessHeap () returned 0x130000 [0060.865] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.865] GetProcessHeap () returned 0x130000 [0060.865] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0060.865] GetProcessHeap () returned 0x130000 [0060.865] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.865] GetProcessHeap () returned 0x130000 [0060.865] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.867] GetProcessHeap () returned 0x130000 [0060.867] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.867] GetProcessHeap () returned 0x130000 [0060.867] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0060.868] GetProcessHeap () returned 0x130000 [0060.868] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.868] GetProcessHeap () returned 0x130000 [0060.868] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0060.869] GetProcessHeap () returned 0x130000 [0060.869] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.869] GetProcessHeap () returned 0x130000 [0060.869] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.870] GetProcessHeap () returned 0x130000 [0060.870] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.870] GetProcessHeap () returned 0x130000 [0060.870] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0060.871] GetProcessHeap () returned 0x130000 [0060.871] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.871] GetProcessHeap () returned 0x130000 [0060.872] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.872] GetProcessHeap () returned 0x130000 [0060.872] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.873] GetProcessHeap () returned 0x130000 [0060.873] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.873] GetProcessHeap () returned 0x130000 [0060.873] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.873] GetProcessHeap () returned 0x130000 [0060.873] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.874] GetProcessHeap () returned 0x130000 [0060.874] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.875] GetProcessHeap () returned 0x130000 [0060.875] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0060.875] GetProcessHeap () returned 0x130000 [0060.875] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.875] GetProcessHeap () returned 0x130000 [0060.876] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.876] GetProcessHeap () returned 0x130000 [0060.876] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.876] GetProcessHeap () returned 0x130000 [0060.876] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0060.877] GetProcessHeap () returned 0x130000 [0060.877] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.877] GetProcessHeap () returned 0x130000 [0060.877] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0060.878] GetProcessHeap () returned 0x130000 [0060.878] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.878] GetProcessHeap () returned 0x130000 [0060.878] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0060.879] GetProcessHeap () returned 0x130000 [0060.879] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.879] GetProcessHeap () returned 0x130000 [0060.879] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0060.880] GetProcessHeap () returned 0x130000 [0060.880] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.880] GetProcessHeap () returned 0x130000 [0060.880] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0060.880] GetProcessHeap () returned 0x130000 [0060.880] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.880] GetProcessHeap () returned 0x130000 [0060.880] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.881] GetProcessHeap () returned 0x130000 [0060.881] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.881] GetProcessHeap () returned 0x130000 [0060.881] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0060.882] GetProcessHeap () returned 0x130000 [0060.882] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.882] GetProcessHeap () returned 0x130000 [0060.882] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.883] GetProcessHeap () returned 0x130000 [0060.883] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.883] GetProcessHeap () returned 0x130000 [0060.883] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0060.884] GetProcessHeap () returned 0x130000 [0060.884] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.884] GetProcessHeap () returned 0x130000 [0060.884] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0060.885] GetProcessHeap () returned 0x130000 [0060.885] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.885] GetProcessHeap () returned 0x130000 [0060.885] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.886] GetProcessHeap () returned 0x130000 [0060.886] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.886] GetProcessHeap () returned 0x130000 [0060.886] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0060.887] GetProcessHeap () returned 0x130000 [0060.887] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.887] GetProcessHeap () returned 0x130000 [0060.887] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0060.888] GetProcessHeap () returned 0x130000 [0060.888] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.888] GetProcessHeap () returned 0x130000 [0060.888] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0060.889] GetProcessHeap () returned 0x130000 [0060.889] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0060.889] GetProcessHeap () returned 0x130000 [0060.889] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0060.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0061.054] GetProcessHeap () returned 0x130000 [0061.054] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.054] GetProcessHeap () returned 0x130000 [0061.054] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0061.058] GetProcessHeap () returned 0x130000 [0061.058] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.058] GetProcessHeap () returned 0x130000 [0061.058] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0061.059] GetProcessHeap () returned 0x130000 [0061.060] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.060] GetProcessHeap () returned 0x130000 [0061.060] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0061.060] GetProcessHeap () returned 0x130000 [0061.060] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.061] GetProcessHeap () returned 0x130000 [0061.061] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0061.061] GetProcessHeap () returned 0x130000 [0061.061] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.061] GetProcessHeap () returned 0x130000 [0061.061] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0061.062] GetProcessHeap () returned 0x130000 [0061.062] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.062] GetProcessHeap () returned 0x130000 [0061.062] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0061.063] GetProcessHeap () returned 0x130000 [0061.063] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.063] GetProcessHeap () returned 0x130000 [0061.063] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0061.064] GetProcessHeap () returned 0x130000 [0061.064] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.064] GetProcessHeap () returned 0x130000 [0061.064] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0061.065] GetProcessHeap () returned 0x130000 [0061.065] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.065] GetProcessHeap () returned 0x130000 [0061.065] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0061.066] GetProcessHeap () returned 0x130000 [0061.066] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.066] GetProcessHeap () returned 0x130000 [0061.066] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0061.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0061.067] GetProcessHeap () returned 0x130000 [0061.067] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0061.067] GetProcessHeap () returned 0x130000 [0061.067] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.068] GetProcessHeap () returned 0x130000 [0061.068] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0061.072] GetProcessHeap () returned 0x130000 [0061.072] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.072] GetProcessHeap () returned 0x130000 [0061.072] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0061.076] GetProcessHeap () returned 0x130000 [0061.076] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.076] GetProcessHeap () returned 0x130000 [0061.076] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0061.083] GetProcessHeap () returned 0x130000 [0061.083] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.083] GetProcessHeap () returned 0x130000 [0061.083] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0061.095] GetProcessHeap () returned 0x130000 [0061.095] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.095] GetProcessHeap () returned 0x130000 [0061.095] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0061.098] GetProcessHeap () returned 0x130000 [0061.098] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.099] GetProcessHeap () returned 0x130000 [0061.099] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0061.102] GetProcessHeap () returned 0x130000 [0061.102] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.102] GetProcessHeap () returned 0x130000 [0061.102] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0061.106] GetProcessHeap () returned 0x130000 [0061.106] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.106] GetProcessHeap () returned 0x130000 [0061.106] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f858 [0061.110] GetProcessHeap () returned 0x130000 [0061.110] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.110] GetProcessHeap () returned 0x130000 [0061.110] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0061.250] GetProcessHeap () returned 0x130000 [0061.251] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.251] GetProcessHeap () returned 0x130000 [0061.251] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0061.254] GetProcessHeap () returned 0x130000 [0061.254] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.254] GetProcessHeap () returned 0x130000 [0061.254] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0061.258] GetProcessHeap () returned 0x130000 [0061.258] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.258] GetProcessHeap () returned 0x130000 [0061.258] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0061.261] GetProcessHeap () returned 0x130000 [0061.261] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.261] GetProcessHeap () returned 0x130000 [0061.261] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0061.266] GetProcessHeap () returned 0x130000 [0061.266] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.267] GetProcessHeap () returned 0x130000 [0061.267] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0061.270] GetProcessHeap () returned 0x130000 [0061.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.270] GetProcessHeap () returned 0x130000 [0061.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.272] GetProcessHeap () returned 0x130000 [0061.272] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.274] GetProcessHeap () returned 0x130000 [0061.274] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17728794, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17728794, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0061.276] GetProcessHeap () returned 0x130000 [0061.276] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x176dc2d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0061.278] GetProcessHeap () returned 0x130000 [0061.278] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.278] GetProcessHeap () returned 0x130000 [0061.278] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0061.281] GetProcessHeap () returned 0x130000 [0061.281] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.281] GetProcessHeap () returned 0x130000 [0061.281] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.281] GetProcessHeap () returned 0x130000 [0061.281] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0061.285] GetProcessHeap () returned 0x130000 [0061.285] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.285] GetProcessHeap () returned 0x130000 [0061.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1774e9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1774e9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0061.288] GetProcessHeap () returned 0x130000 [0061.288] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.289] GetProcessHeap () returned 0x130000 [0061.289] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0061.291] GetProcessHeap () returned 0x130000 [0061.291] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cd4a32, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0061.431] GetProcessHeap () returned 0x130000 [0061.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.431] GetProcessHeap () returned 0x130000 [0061.431] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.432] GetProcessHeap () returned 0x130000 [0061.432] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0061.433] GetProcessHeap () returned 0x130000 [0061.433] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0061.434] GetProcessHeap () returned 0x130000 [0061.434] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0061.435] GetProcessHeap () returned 0x130000 [0061.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.435] GetProcessHeap () returned 0x130000 [0061.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.436] GetProcessHeap () returned 0x130000 [0061.436] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.445] GetProcessHeap () returned 0x130000 [0061.445] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca90ec5a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca90ec5a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0061.446] GetProcessHeap () returned 0x130000 [0061.446] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0061.452] GetProcessHeap () returned 0x130000 [0061.452] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.452] GetProcessHeap () returned 0x130000 [0061.452] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.453] GetProcessHeap () returned 0x130000 [0061.453] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0061.456] GetProcessHeap () returned 0x130000 [0061.456] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ff3259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x186355ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x186355ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0061.456] GetProcessHeap () returned 0x130000 [0061.456] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0061.458] GetProcessHeap () returned 0x130000 [0061.458] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0061.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18aadbcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18aadbcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18aadbcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0061.459] GetProcessHeap () returned 0x130000 [0061.459] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0061.460] GetProcessHeap () returned 0x130000 [0061.460] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0061.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0061.464] GetProcessHeap () returned 0x130000 [0061.464] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0061.464] GetProcessHeap () returned 0x130000 [0061.464] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0061.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0061.465] GetProcessHeap () returned 0x130000 [0061.465] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0061.465] GetProcessHeap () returned 0x130000 [0061.465] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.465] GetProcessHeap () returned 0x130000 [0061.465] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0061.465] GetProcessHeap () returned 0x130000 [0061.465] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0061.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0061.469] GetProcessHeap () returned 0x130000 [0061.469] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0061.469] GetProcessHeap () returned 0x130000 [0061.469] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.469] GetProcessHeap () returned 0x130000 [0061.469] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.471] GetProcessHeap () returned 0x130000 [0061.471] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0061.471] GetProcessHeap () returned 0x130000 [0061.472] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0061.737] GetProcessHeap () returned 0x130000 [0061.737] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.737] GetProcessHeap () returned 0x130000 [0061.737] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0061.786] GetProcessHeap () returned 0x130000 [0061.786] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.786] GetProcessHeap () returned 0x130000 [0061.786] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0061.826] GetProcessHeap () returned 0x130000 [0061.826] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.826] GetProcessHeap () returned 0x130000 [0061.826] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.827] GetProcessHeap () returned 0x130000 [0061.827] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0061.836] GetProcessHeap () returned 0x130000 [0061.836] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.836] GetProcessHeap () returned 0x130000 [0061.836] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0061.837] GetProcessHeap () returned 0x130000 [0061.837] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0061.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0061.838] GetProcessHeap () returned 0x130000 [0061.838] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0061.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0061.843] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.846] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~1.JPG")) returned 1 [0061.846] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_AutoMask.bmp", cAlternateFileName="ALERTI~1.BMP")) returned 1 [0061.846] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3356, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHigh.jpg", cAlternateFileName="AL8858~1.JPG")) returned 1 [0061.846] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHighMask.bmp", cAlternateFileName="AL2220~1.BMP")) returned 1 [0061.846] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLow.jpg", cAlternateFileName="ALERTI~4.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLowMask.bmp", cAlternateFileName="AL1F1D~1.BMP")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHigh.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x197cab56, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197cab56, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHighMask.bmp", cAlternateFileName="ALERTI~2.BMP")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x46de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOff.jpg", cAlternateFileName="AL97F4~1.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOffMask.bmp", cAlternateFileName="ALERTI~4.BMP")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_High.jpg", cAlternateFileName="ALERTI~2.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_HighMask.bmp", cAlternateFileName="ALERTI~3.BMP")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x41de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Medium.jpg", cAlternateFileName="ALF33C~1.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_MediumMAsk.bmp", cAlternateFileName="AL441A~1.BMP")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Off.jpg", cAlternateFileName="AL0F2A~1.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_OffMask.bmp", cAlternateFileName="ALA9A1~1.BMP")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2256, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImage.jpg", cAlternateFileName="COMMSI~1.JPG")) returned 1 [0061.847] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMask.bmp", cAlternateFileName="COMMSI~1.BMP")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMaskSmall.bmp", cAlternateFileName="COMMSI~2.BMP")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageSmall.jpg", cAlternateFileName="COMMSI~2.JPG")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImage.jpg", cAlternateFileName="COMMSO~1.JPG")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19817013, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19817013, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19817013, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMask.bmp", cAlternateFileName="COMMSO~1.BMP")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198afa29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMaskSmall.bmp", cAlternateFileName="COMMSO~2.BMP")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageSmall.jpg", cAlternateFileName="COMMSO~2.JPG")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2798, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0061.848] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIcon.jpg", cAlternateFileName="UNREAD~2.JPG")) returned 1 [0061.849] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImages.jpg", cAlternateFileName="UNREAD~1.JPG")) returned 1 [0061.849] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 1 [0061.849] FindNextFileW (in: hFindFile=0x18fbd8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 0 [0061.849] FindClose (in: hFindFile=0x18fbd8 | out: hFindFile=0x18fbd8) returned 1 [0061.850] GetProcessHeap () returned 0x130000 [0061.850] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0061.850] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0061.850] GetProcessHeap () returned 0x130000 [0061.850] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0061.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0061.851] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198634b7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 0 [0061.851] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0061.851] GetProcessHeap () returned 0x130000 [0061.851] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0061.851] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0061.851] GetProcessHeap () returned 0x130000 [0061.851] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0061.851] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0061.852] GetProcessHeap () returned 0x130000 [0061.852] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.853] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0061.853] GetProcessHeap () returned 0x130000 [0061.853] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0061.862] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.862] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x59cc74e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59cc74e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0061.862] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc34bb5b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc34bb5b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc34bb5b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbdc8437, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbdc8437, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdee689, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactSelector.ico", cAlternateFileName="CONTAC~1.ICO")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b9ee02, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7bc5054, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f7aa31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0df27d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e572fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e572fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e7d566, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxalert.ico", cAlternateFileName="MESSAG~3.ICO")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x765018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x765018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x765018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxerror.ico", cAlternateFileName="MESSAG~2.ICO")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a9d821, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a9d821, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxinfo.ico", cAlternateFileName="MESSAG~1.ICO")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModifiedTelespace.ico", cAlternateFileName="MODIFI~1.ICO")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO", cAlternateFileName="")) returned 1 [0061.863] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e5cc4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO", cAlternateFileName="")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fed144, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fed144, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fed144, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico", cAlternateFileName="ONLINE~2.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf263c7d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf263c7d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2f2d53e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico", cAlternateFileName="ONLINE~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x765018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x765018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x78b299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico", cAlternateFileName="OUTDOM~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c63313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c63313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c63313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO", cAlternateFileName="")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e5cc4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico", cAlternateFileName="OUTSYN~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalContact.ico", cAlternateFileName="PERSON~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffd6924a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd6924a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd6924a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionMember.ico", cAlternateFileName="SESSIO~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionOwner.ico", cAlternateFileName="SESSIO~2.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69980f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69be349, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpaceSelector.ico", cAlternateFileName="SPACES~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf073ddf4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf073ddf4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico", cAlternateFileName="STATUS~1.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41f3e26, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41f3e26, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusDoNotDisturb.ico", cAlternateFileName="STATUS~2.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusOnline.ico", cAlternateFileName="STATUS~3.ICO")) returned 1 [0061.864] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO", cAlternateFileName="")) returned 1 [0061.865] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO", cAlternateFileName="")) returned 1 [0061.865] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x637c06e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x637c06e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x637c06e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 1 [0061.865] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x637c06e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x637c06e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x637c06e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 0 [0061.865] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0061.866] GetProcessHeap () returned 0x130000 [0061.866] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0061.866] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0061.866] GetProcessHeap () returned 0x130000 [0061.866] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.VisualElementsManifest.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f46636, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x211278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f2f, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="HeaderPatterns.xml", cAlternateFileName="HEADER~1.XML")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4e2564e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8da50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc316698e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc316698e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc33c8ea0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x478a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee295a70, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0f0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5f4be42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc5f4be42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd95d6d40, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xabb640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="IGX.DLL", cAlternateFileName="")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Installed_resources16.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Installed_schemas16.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3226418, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x658f8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Interceptor.dll", cAlternateFileName="INTERC~1.DLL")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2b97d2d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2b97d2d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2d87bf9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbb60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Interceptor.tlb", cAlternateFileName="INTERC~1.TLB")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2a40778, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2a40778, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2be41af, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x312a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="JitV.dll", cAlternateFileName="")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4e2564e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xa1658, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0061.867] GetProcessHeap () returned 0x130000 [0061.868] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0061.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0061.868] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.868] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0061.868] GetProcessHeap () returned 0x130000 [0061.868] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0061.870] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.870] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12b7378, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaf54f91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ce40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0061.870] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf54f91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf54f91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xaf54f91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0061.870] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf7b1fc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf7b1fc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x279af, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0061.870] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf54f91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf54f91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb16b0a3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf030, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0061.870] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaf54f91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaf54f91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb16b0a3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf030, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 0 [0061.870] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0061.871] GetProcessHeap () returned 0x130000 [0061.871] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0061.871] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0061.871] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0061.871] GetProcessHeap () returned 0x130000 [0061.871] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0061.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\SOLVER\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0062.255] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.255] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xafa146a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb16b0a3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe8dfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0062.255] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x35438, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0062.255] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x35438, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 0 [0062.255] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0062.255] GetProcessHeap () returned 0x130000 [0062.255] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.255] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0062.255] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0062.255] GetProcessHeap () returned 0x130000 [0062.255] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0062.255] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0062.255] GetProcessHeap () returned 0x130000 [0062.255] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0062.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0062.258] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198fbe19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-black_scale-100.png", cAlternateFileName="EXDF79~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198afa29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-black_scale-140.png", cAlternateFileName="EX9DAA~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198d5bc7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-black_scale-180.png", cAlternateFileName="EXD3EA~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198d5bc7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-black_scale-80.png", cAlternateFileName="EX9BE5~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198afa29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-white_scale-100.png", cAlternateFileName="EXC172~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-white_scale-140.png", cAlternateFileName="EXCELL~3.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-white_scale-180.png", cAlternateFileName="EX529E~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.contrast-white_scale-80.png", cAlternateFileName="EXCELL~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198afa29, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x929, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.scale-100.png", cAlternateFileName="EXCELL~4.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.scale-140.png", cAlternateFileName="EXCELL~2.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.scale-180.png", cAlternateFileName="EX5FD7~1.PNG")) returned 1 [0062.262] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198d5bc7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x839, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogo.scale-80.png", cAlternateFileName="EXDA38~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a8c7801, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a8c7801, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a8c7801, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-black_scale-100.png", cAlternateFileName="EX71FE~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-black_scale-140.png", cAlternateFileName="EXCE73~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-black_scale-180.png", cAlternateFileName="EX8CA4~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198fbe19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-black_scale-80.png", cAlternateFileName="EX98BE~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198fbe19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x725, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-white_scale-100.png", cAlternateFileName="EX82AE~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198d5bc7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-white_scale-140.png", cAlternateFileName="EXB07C~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198d5bc7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-white_scale-180.png", cAlternateFileName="EX0EF0~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198d5bc7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198d5bc7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198d5bc7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.contrast-white_scale-80.png", cAlternateFileName="EX8CE6~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x79d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.scale-100.png", cAlternateFileName="EX3CF4~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x870, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.scale-140.png", cAlternateFileName="EX3590~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.scale-180.png", cAlternateFileName="EXE70C~1.PNG")) returned 1 [0062.263] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLogoSmall.scale-80.png", cAlternateFileName="EX97E8~1.PNG")) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-black_scale-100.png", cAlternateFileName="FIRSTR~4.PNG")) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198fbe19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-black_scale-140.png", cAlternateFileName="FIRSTR~3.PNG")) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa81, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-black_scale-180.png", cAlternateFileName="FI9FD2~1.PNG")) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-black_scale-80.png", cAlternateFileName="FI357C~1.PNG")) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198fbe19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-white_scale-100.png", cAlternateFileName="FIRSTR~2.PNG")) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x198fbe19, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198fbe19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198fbe19, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-white_scale-140.png", cAlternateFileName="FIRSTR~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-white_scale-180.png", cAlternateFileName="FI8E23~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.contrast-white_scale-80.png", cAlternateFileName="FI4144~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.scale-100.png", cAlternateFileName="FI1EC9~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.scale-140.png", cAlternateFileName="FIBF57~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.scale-180.png", cAlternateFileName="FI9277~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x649, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogo.scale-80.png", cAlternateFileName="FI8090~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-black_scale-100.png", cAlternateFileName="FI5507~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x698, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-black_scale-140.png", cAlternateFileName="FI782A~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992206f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992206f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992206f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-black_scale-180.png", cAlternateFileName="FID9A4~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x552, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-black_scale-80.png", cAlternateFileName="FI5606~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199947e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-white_scale-100.png", cAlternateFileName="FID3BA~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199947e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-white_scale-140.png", cAlternateFileName="FI1689~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199947e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x84d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-white_scale-180.png", cAlternateFileName="FIB7A7~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199947e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.contrast-white_scale-80.png", cAlternateFileName="FI5C4C~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.scale-100.png", cAlternateFileName="FI2DF7~1.PNG")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.scale-140.png", cAlternateFileName="FIFE2A~1.PNG")) returned 1 [0062.268] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.scale-180.png", cAlternateFileName="FIA1A5~1.PNG")) returned 1 [0062.270] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x537, dwReserved0=0x0, dwReserved1=0x0, cFileName="FirstRunLogoSmall.scale-80.png", cAlternateFileName="FIED60~1.PNG")) returned 1 [0062.270] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-black_scale-100.png", cAlternateFileName="GROOVE~1.PNG")) returned 1 [0062.270] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1996e644, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1996e644, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1996e644, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-black_scale-140.png", cAlternateFileName="GROOVE~2.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199e0c45, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199e0c45, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-black_scale-180.png", cAlternateFileName="GRA3AD~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199ba9ea, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199ba9ea, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x768, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-black_scale-80.png", cAlternateFileName="GR0C5F~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199ba9ea, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199ba9ea, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-white_scale-100.png", cAlternateFileName="GRADA3~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199ba9ea, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199ba9ea, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc16, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-white_scale-140.png", cAlternateFileName="GR7FD5~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199947e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199947e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-white_scale-180.png", cAlternateFileName="GR2251~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199947e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199947e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199947e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x79a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.contrast-white_scale-80.png", cAlternateFileName="GROOVE~3.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199947e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199947e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199ba9ea, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.scale-100.png", cAlternateFileName="GR37CD~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199947e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199947e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199ba9ea, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.scale-140.png", cAlternateFileName="GR3AC7~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199947e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199947e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199ba9ea, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1add, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.scale-180.png", cAlternateFileName="GR7C96~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x199947e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x199947e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x199947e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb09, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogo.scale-80.png", cAlternateFileName="GROOVE~4.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6192e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-black_scale-100.png", cAlternateFileName="GRF89D~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6192e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x81a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-black_scale-140.png", cAlternateFileName="GR4622~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa56, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-black_scale-180.png", cAlternateFileName="GRBAC6~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6192e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-black_scale-80.png", cAlternateFileName="GR3641~1.PNG")) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6df, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-white_scale-100.png", cAlternateFileName="GR7AE9~1.PNG")) returned 1 [0062.272] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-white_scale-140.png", cAlternateFileName="GRF6AB~1.PNG")) returned 1 [0062.272] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-white_scale-180.png", cAlternateFileName="GRC8DD~1.PNG")) returned 1 [0062.272] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.contrast-white_scale-80.png", cAlternateFileName="GRE586~1.PNG")) returned 1 [0062.272] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa56, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.scale-100.png", cAlternateFileName="GREDEF~1.PNG")) returned 1 [0062.272] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19a06e8b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.scale-140.png", cAlternateFileName="GR1CBD~1.PNG")) returned 1 [0062.272] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.scale-180.png", cAlternateFileName="GR6942~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a63f068, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a63f068, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x850, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLogoSmall.scale-80.png", cAlternateFileName="GR3369~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a63f068, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a63f068, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-black_scale-100.png", cAlternateFileName="MS0237~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a63f068, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a63f068, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-black_scale-140.png", cAlternateFileName="MS6F5E~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a63f068, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a63f068, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-black_scale-180.png", cAlternateFileName="MSA13D~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19a06e8b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19a06e8b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a63f068, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-black_scale-80.png", cAlternateFileName="MSACCE~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a63f068, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a63f068, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a63f068, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-white_scale-100.png", cAlternateFileName="MS13E6~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6192e9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6192e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a63f068, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-white_scale-140.png", cAlternateFileName="MSACCE~4.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6192e9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6192e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a63f068, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x132f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-white_scale-180.png", cAlternateFileName="MSACCE~3.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6192e9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6192e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6192e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.contrast-white_scale-80.png", cAlternateFileName="MSACCE~2.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc35, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.scale-100.png", cAlternateFileName="MS31C8~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.scale-140.png", cAlternateFileName="MS30DC~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.scale-180.png", cAlternateFileName="MS72AB~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogo.scale-80.png", cAlternateFileName="MS2629~1.PNG")) returned 1 [0062.275] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x91b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-black_scale-100.png", cAlternateFileName="MS631D~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-black_scale-140.png", cAlternateFileName="MS214E~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd17, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-black_scale-180.png", cAlternateFileName="MS7EC2~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x730, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-black_scale-80.png", cAlternateFileName="MS389C~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-white_scale-100.png", cAlternateFileName="MS74CC~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a665235, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-white_scale-140.png", cAlternateFileName="MSA29A~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd17, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-white_scale-180.png", cAlternateFileName="MSFF1F~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.contrast-white_scale-80.png", cAlternateFileName="MSE33B~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.scale-100.png", cAlternateFileName="MSBF6D~1.PNG")) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb43, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.scale-140.png", cAlternateFileName="MS1EB3~1.PNG")) returned 1 [0062.279] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.scale-180.png", cAlternateFileName="MSDBE4~1.PNG")) returned 1 [0062.279] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x79f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsAccessLogoSmall.scale-80.png", cAlternateFileName="MSF5B2~1.PNG")) returned 1 [0062.279] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-black_scale-100.png", cAlternateFileName="MSPUBL~4.PNG")) returned 1 [0062.279] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xad5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-black_scale-140.png", cAlternateFileName="MSPUBL~3.PNG")) returned 1 [0062.279] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a68b471, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a68b471, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd19, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-black_scale-180.png", cAlternateFileName="MSPUBL~2.PNG")) returned 1 [0062.279] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a665235, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a665235, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a68b471, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-black_scale-80.png", cAlternateFileName="MSPUBL~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x88a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-white_scale-100.png", cAlternateFileName="MSF61D~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-white_scale-140.png", cAlternateFileName="MS39EB~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-white_scale-180.png", cAlternateFileName="MSEB57~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.contrast-white_scale-80.png", cAlternateFileName="MS7453~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x892, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.scale-100.png", cAlternateFileName="MSAA06~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.scale-140.png", cAlternateFileName="MSD8D3~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.scale-180.png", cAlternateFileName="MS2668~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogo.scale-80.png", cAlternateFileName="MS75BF~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-black_scale-100.png", cAlternateFileName="MSD973~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6b16ff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-black_scale-140.png", cAlternateFileName="MS97A4~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-black_scale-180.png", cAlternateFileName="MSE439~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x637, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-black_scale-80.png", cAlternateFileName="MSE1AD~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x717, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-white_scale-100.png", cAlternateFileName="MS5BCF~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-white_scale-140.png", cAlternateFileName="MSA854~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-white_scale-180.png", cAlternateFileName="MSD622~1.PNG")) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.contrast-white_scale-80.png", cAlternateFileName="MS6539~1.PNG")) returned 1 [0062.281] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.scale-100.png", cAlternateFileName="MSA9CC~1.PNG")) returned 1 [0062.281] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.scale-140.png", cAlternateFileName="MSD79A~1.PNG")) returned 1 [0062.283] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.scale-180.png", cAlternateFileName="MS99FA~1.PNG")) returned 1 [0062.283] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6b16ff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6b16ff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsPubLogoSmall.scale-80.png", cAlternateFileName="MSC667~1.PNG")) returned 1 [0062.283] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x89b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-black_scale-100.png", cAlternateFileName="ONAFA7~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-black_scale-140.png", cAlternateFileName="ON5141~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-black_scale-180.png", cAlternateFileName="ON04BC~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-black_scale-80.png", cAlternateFileName="ONBA8A~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x896, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-white_scale-100.png", cAlternateFileName="ON2104~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-white_scale-140.png", cAlternateFileName="ONENOT~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-white_scale-180.png", cAlternateFileName="ON8260~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x806, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.contrast-white_scale-80.png", cAlternateFileName="ONENOT~4.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.scale-100.png", cAlternateFileName="ONENOT~3.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6d794e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6d794e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6d794e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xae7, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.scale-140.png", cAlternateFileName="ONENOT~2.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd46, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.scale-180.png", cAlternateFileName="ON52BA~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x80d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogo.scale-80.png", cAlternateFileName="ONF020~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x73a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-black_scale-100.png", cAlternateFileName="ON193B~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-black_scale-140.png", cAlternateFileName="ON585A~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-black_scale-180.png", cAlternateFileName="ON9A29~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x605, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-black_scale-80.png", cAlternateFileName="ON3426~1.PNG")) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x73a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-white_scale-100.png", cAlternateFileName="ON2492~1.PNG")) returned 1 [0062.285] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-white_scale-140.png", cAlternateFileName="OND60E~1.PNG")) returned 1 [0062.285] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-white_scale-180.png", cAlternateFileName="ON19DC~1.PNG")) returned 1 [0062.285] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a6fdbb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a6fdbb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a6fdbb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.contrast-white_scale-80.png", cAlternateFileName="ONB09A~1.PNG")) returned 1 [0062.285] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x782, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.scale-100.png", cAlternateFileName="ON8AF0~1.PNG")) returned 1 [0062.285] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.scale-140.png", cAlternateFileName="ON4822~1.PNG")) returned 1 [0062.288] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.scale-180.png", cAlternateFileName="ON95B6~1.PNG")) returned 1 [0062.288] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a723def, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1a723def, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1a723def, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x64e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteLogoSmall.scale-80.png", cAlternateFileName="ON8B9B~1.PNG")) returned 1 [0062.304] GetProcessHeap () returned 0x130000 [0062.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0062.306] GetProcessHeap () returned 0x130000 [0062.306] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0062.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b22ac67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b22ac67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.548] GetProcessHeap () returned 0x130000 [0062.548] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0062.561] GetProcessHeap () returned 0x130000 [0062.561] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0062.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b3a83c3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b3a83c3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0062.563] GetProcessHeap () returned 0x130000 [0062.563] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ar\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0062.563] GetProcessHeap () returned 0x130000 [0062.563] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.564] GetProcessHeap () returned 0x130000 [0062.564] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\bg\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0062.564] GetProcessHeap () returned 0x130000 [0062.564] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.564] GetProcessHeap () returned 0x130000 [0062.564] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0062.565] GetProcessHeap () returned 0x130000 [0062.565] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.565] GetProcessHeap () returned 0x130000 [0062.565] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\cs\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0062.566] GetProcessHeap () returned 0x130000 [0062.566] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.566] GetProcessHeap () returned 0x130000 [0062.566] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\da\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.567] GetProcessHeap () returned 0x130000 [0062.567] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.567] GetProcessHeap () returned 0x130000 [0062.567] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\de\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.568] GetProcessHeap () returned 0x130000 [0062.568] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.568] GetProcessHeap () returned 0x130000 [0062.568] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\el\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0062.569] GetProcessHeap () returned 0x130000 [0062.569] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.569] GetProcessHeap () returned 0x130000 [0062.569] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\en-us\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0062.570] GetProcessHeap () returned 0x130000 [0062.570] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.570] GetProcessHeap () returned 0x130000 [0062.570] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\es\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0062.570] GetProcessHeap () returned 0x130000 [0062.570] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.570] GetProcessHeap () returned 0x130000 [0062.570] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\et\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0062.571] GetProcessHeap () returned 0x130000 [0062.571] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.571] GetProcessHeap () returned 0x130000 [0062.571] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\eu\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.572] GetProcessHeap () returned 0x130000 [0062.572] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.572] GetProcessHeap () returned 0x130000 [0062.572] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fi\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0062.573] GetProcessHeap () returned 0x130000 [0062.573] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.573] GetProcessHeap () returned 0x130000 [0062.573] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fr\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0062.573] GetProcessHeap () returned 0x130000 [0062.573] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.573] GetProcessHeap () returned 0x130000 [0062.573] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\gl\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0062.574] GetProcessHeap () returned 0x130000 [0062.574] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.574] GetProcessHeap () returned 0x130000 [0062.574] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0062.575] GetProcessHeap () returned 0x130000 [0062.575] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.575] GetProcessHeap () returned 0x130000 [0062.575] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hi\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0062.576] GetProcessHeap () returned 0x130000 [0062.576] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.576] GetProcessHeap () returned 0x130000 [0062.576] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hr\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.577] GetProcessHeap () returned 0x130000 [0062.577] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.577] GetProcessHeap () returned 0x130000 [0062.577] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hu\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0062.577] GetProcessHeap () returned 0x130000 [0062.577] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.578] GetProcessHeap () returned 0x130000 [0062.578] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\id\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0062.578] GetProcessHeap () returned 0x130000 [0062.579] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.579] GetProcessHeap () returned 0x130000 [0062.579] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\it\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b433, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59b433, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59b433, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0062.579] GetProcessHeap () returned 0x130000 [0062.579] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.579] GetProcessHeap () returned 0x130000 [0062.579] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ja\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0062.580] GetProcessHeap () returned 0x130000 [0062.580] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.580] GetProcessHeap () returned 0x130000 [0062.580] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\kk\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0062.581] GetProcessHeap () returned 0x130000 [0062.581] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.581] GetProcessHeap () returned 0x130000 [0062.581] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ko\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0062.582] GetProcessHeap () returned 0x130000 [0062.582] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.582] GetProcessHeap () returned 0x130000 [0062.582] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lt\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0062.582] GetProcessHeap () returned 0x130000 [0062.582] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.582] GetProcessHeap () returned 0x130000 [0062.582] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lv\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0062.583] GetProcessHeap () returned 0x130000 [0062.583] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.583] GetProcessHeap () returned 0x130000 [0062.583] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ms\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0062.584] GetProcessHeap () returned 0x130000 [0062.584] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.584] GetProcessHeap () returned 0x130000 [0062.584] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\nl\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf2dd35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf2dd35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0062.585] GetProcessHeap () returned 0x130000 [0062.585] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.585] GetProcessHeap () returned 0x130000 [0062.585] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\no\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.586] GetProcessHeap () returned 0x130000 [0062.586] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.586] GetProcessHeap () returned 0x130000 [0062.586] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pl\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0062.587] GetProcessHeap () returned 0x130000 [0062.587] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.587] GetProcessHeap () returned 0x130000 [0062.587] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0062.587] GetProcessHeap () returned 0x130000 [0062.587] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.588] GetProcessHeap () returned 0x130000 [0062.588] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt-BR\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0062.594] GetProcessHeap () returned 0x130000 [0062.594] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.594] GetProcessHeap () returned 0x130000 [0062.594] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ro\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0062.595] GetProcessHeap () returned 0x130000 [0062.595] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.595] GetProcessHeap () returned 0x130000 [0062.595] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ru\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0062.596] GetProcessHeap () returned 0x130000 [0062.596] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.596] GetProcessHeap () returned 0x130000 [0062.596] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sk\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0062.597] GetProcessHeap () returned 0x130000 [0062.597] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.597] GetProcessHeap () returned 0x130000 [0062.597] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sl\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0062.597] GetProcessHeap () returned 0x130000 [0062.597] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.597] GetProcessHeap () returned 0x130000 [0062.597] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-BA\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0062.597] GetProcessHeap () returned 0x130000 [0062.597] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.597] GetProcessHeap () returned 0x130000 [0062.597] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-CS\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0062.598] GetProcessHeap () returned 0x130000 [0062.598] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.598] GetProcessHeap () returned 0x130000 [0062.598] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Latn-CS\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0062.599] GetProcessHeap () returned 0x130000 [0062.599] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.599] GetProcessHeap () returned 0x130000 [0062.599] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sv\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0062.599] GetProcessHeap () returned 0x130000 [0062.599] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.599] GetProcessHeap () returned 0x130000 [0062.599] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\th\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0062.600] GetProcessHeap () returned 0x130000 [0062.600] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.600] GetProcessHeap () returned 0x130000 [0062.600] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\tr\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0062.600] GetProcessHeap () returned 0x130000 [0062.600] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.600] GetProcessHeap () returned 0x130000 [0062.600] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\uk\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0062.601] GetProcessHeap () returned 0x130000 [0062.601] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.601] GetProcessHeap () returned 0x130000 [0062.601] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\vi\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0062.602] GetProcessHeap () returned 0x130000 [0062.602] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.602] GetProcessHeap () returned 0x130000 [0062.602] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-CN\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0062.603] GetProcessHeap () returned 0x130000 [0062.603] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.603] GetProcessHeap () returned 0x130000 [0062.603] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0062.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-TW\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0062.604] GetProcessHeap () returned 0x130000 [0062.604] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0062.604] GetProcessHeap () returned 0x130000 [0062.604] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0062.608] GetProcessHeap () returned 0x130000 [0062.608] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0062.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0062.611] GetProcessHeap () returned 0x130000 [0062.611] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0062.612] GetProcessHeap () returned 0x130000 [0062.612] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0062.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0063.126] GetProcessHeap () returned 0x130000 [0063.127] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0063.127] GetProcessHeap () returned 0x130000 [0063.127] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0063.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0063.668] GetProcessHeap () returned 0x130000 [0063.668] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0063.668] GetProcessHeap () returned 0x130000 [0063.668] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0063.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0064.885] GetProcessHeap () returned 0x130000 [0064.885] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0064.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0064.911] GetProcessHeap () returned 0x130000 [0064.911] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0064.911] GetProcessHeap () returned 0x130000 [0064.911] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0064.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1036\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0065.208] GetProcessHeap () returned 0x130000 [0065.208] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0065.209] GetProcessHeap () returned 0x130000 [0065.209] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0065.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\3082\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fbd8 [0065.209] GetProcessHeap () returned 0x130000 [0065.209] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0065.209] GetProcessHeap () returned 0x130000 [0065.209] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0065.210] GetProcessHeap () returned 0x130000 [0065.210] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd00050 [0065.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0065.245] GetProcessHeap () returned 0x130000 [0065.245] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd00050 | out: hHeap=0x130000) returned 1 [0066.496] GetProcessHeap () returned 0x130000 [0066.496] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0066.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc3bb225, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x241382dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x241382dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0067.577] GetProcessHeap () returned 0x130000 [0067.577] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0067.578] GetProcessHeap () returned 0x130000 [0067.578] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0067.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\QUERIES\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0067.578] GetProcessHeap () returned 0x130000 [0067.578] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0067.579] GetProcessHeap () returned 0x130000 [0067.579] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0067.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0067.579] GetProcessHeap () returned 0x130000 [0067.579] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0067.590] GetProcessHeap () returned 0x130000 [0067.590] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0067.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\STARTUP\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0067.591] GetProcessHeap () returned 0x130000 [0067.591] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0067.597] GetProcessHeap () returned 0x130000 [0067.598] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0067.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0xa326fd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xa326fd, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0067.599] GetProcessHeap () returned 0x130000 [0067.599] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0067.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0068.401] GetProcessHeap () returned 0x130000 [0068.401] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0068.401] GetProcessHeap () returned 0x130000 [0068.401] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0068.402] GetProcessHeap () returned 0x130000 [0068.402] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0068.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\XLSTART\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0068.403] GetProcessHeap () returned 0x130000 [0068.403] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0068.403] GetProcessHeap () returned 0x130000 [0068.404] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0068.405] GetProcessHeap () returned 0x130000 [0068.405] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0068.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\rsod\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0068.430] GetProcessHeap () returned 0x130000 [0068.430] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0068.430] GetProcessHeap () returned 0x130000 [0068.430] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0068.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0068.431] GetProcessHeap () returned 0x130000 [0068.431] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0068.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0068.435] GetProcessHeap () returned 0x130000 [0068.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0068.435] GetProcessHeap () returned 0x130000 [0068.435] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0068.436] GetProcessHeap () returned 0x130000 [0068.436] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0068.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0068.437] GetProcessHeap () returned 0x130000 [0068.437] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0068.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb571036, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0069.059] GetProcessHeap () returned 0x130000 [0069.059] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb5bd4f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb5bd4f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0069.061] GetProcessHeap () returned 0x130000 [0069.061] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb62fbf7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0069.064] GetProcessHeap () returned 0x130000 [0069.064] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.064] GetProcessHeap () returned 0x130000 [0069.064] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0069.106] GetProcessHeap () returned 0x130000 [0069.106] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.106] GetProcessHeap () returned 0x130000 [0069.106] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.107] GetProcessHeap () returned 0x130000 [0069.107] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\GettingStarted16\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e332373, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e332373, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e332373, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0069.178] GetProcessHeap () returned 0x130000 [0069.178] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.194] GetProcessHeap () returned 0x130000 [0069.194] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0069.203] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.203] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 1 [0069.203] GetProcessHeap () returned 0x130000 [0069.203] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0069.204] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.205] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0069.205] GetProcessHeap () returned 0x130000 [0069.205] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Notebook Templates\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0069.208] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.209] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x490b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0069.209] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x490b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 0 [0069.209] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0069.209] GetProcessHeap () returned 0x130000 [0069.209] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.209] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0069.209] GetProcessHeap () returned 0x130000 [0069.209] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0069.209] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.209] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0069.210] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b428, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLANK.ONE", cAlternateFileName="")) returned 1 [0069.210] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb7d35ea, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e630, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUSINESS.ONE", cAlternateFileName="")) returned 1 [0069.210] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb7ad38b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3182e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER.ONE", cAlternateFileName="")) returned 1 [0069.210] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLANNERS.ONE", cAlternateFileName="")) returned 1 [0069.210] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x37b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLANNERS.ONE", cAlternateFileName="")) returned 0 [0069.210] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0069.210] GetProcessHeap () returned 0x130000 [0069.210] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.210] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0069.210] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0069.210] GetProcessHeap () returned 0x130000 [0069.210] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0069.211] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0069.211] GetProcessHeap () returned 0x130000 [0069.211] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb7f98f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7f98f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59f49, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginReport.Dotx", cAlternateFileName="ORIGIN~2.DOT")) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb7f98f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7f98f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb7f98f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginResume.Dotx", cAlternateFileName="ORIGIN~1.DOT")) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalMonthlyBudget.xltx", cAlternateFileName="PERSON~1.XLT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb7f98f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7f98f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb7f98f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pitchbook.potx", cAlternateFileName="PITCHB~1.POT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b9607ff, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3b42, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJPLAN.XLTX", cAlternateFileName="PROJPL~1.XLT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8921ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8921ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8921ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17697, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuizShow.potx", cAlternateFileName="QUIZSH~1.POT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb86bf6b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb86bf6b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8921ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcdbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedAndBlackLetter.dotx", cAlternateFileName="REDAND~2.DOT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b56a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedAndBlackReport.dotx", cAlternateFileName="REDAND~1.DOT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb845d09, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb845d09, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb86bf6b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa8ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="SalesReport.xltx", cAlternateFileName="SALESR~1.XLT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8921ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8921ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8921ae, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9fc51, dwReserved0=0x0, dwReserved1=0x0, cFileName="StudentReport.dotx", cAlternateFileName="STUDEN~1.DOT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c2c3dcb, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x2aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKLIST.XLTX", cAlternateFileName="TASKLI~1.XLT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8b847f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8b847f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimeCard.xltx", cAlternateFileName="TIMECA~1.XLT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8921ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8921ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf18, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimelessLetter.dotx", cAlternateFileName="TIMELE~2.DOT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8921ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8921ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43753, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimelessReport.dotx", cAlternateFileName="TIMELE~3.DOT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8921ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8921ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb8b847f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbe72, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimelessResume.dotx", cAlternateFileName="TIMELE~1.DOT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb8921ae, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb8921ae, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12f35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Training.potx", cAlternateFileName="TRAINI~1.POT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2df34, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidescreenPresentation.potx", cAlternateFileName="WIDESC~1.POT")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2010 look.dotx", cAlternateFileName="WORD20~1.DOT")) returned 1 [0069.213] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb976f98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2010 look.dotx", cAlternateFileName="WORD20~1.DOT")) returned 0 [0069.213] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0069.213] GetProcessHeap () returned 0x130000 [0069.213] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0069.213] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0069.213] GetProcessHeap () returned 0x130000 [0069.213] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0069.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0069.242] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.242] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0069.242] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 0 [0069.242] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0069.242] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0069.242] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0069.242] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFS", cAlternateFileName="")) returned 1 [0069.242] GetProcessHeap () returned 0x130000 [0069.242] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0069.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0069.243] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.243] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common AppData", cAlternateFileName="COMMON~2")) returned 1 [0069.243] GetProcessHeap () returned 0x130000 [0069.243] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0069.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0069.276] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.276] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~2")) returned 1 [0069.276] GetProcessHeap () returned 0x130000 [0069.276] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0069.279] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.279] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0069.279] GetProcessHeap () returned 0x130000 [0069.279] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0069.283] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.283] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa937f07, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0069.283] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9f15ef0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9f15ef0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0069.283] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heartbeat", cAlternateFileName="HEARTB~1")) returned 1 [0069.283] GetProcessHeap () returned 0x130000 [0069.283] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\Heartbeat\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0069.284] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.284] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.284] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0069.284] GetProcessHeap () returned 0x130000 [0069.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.284] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0069.284] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc3c8ab, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc3c8ab, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0069.284] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0069.284] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fa0ca2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fa0ca2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fa0ca2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0069.284] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fa0ca2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fa0ca2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fa0ca2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 0 [0069.284] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0069.284] GetProcessHeap () returned 0x130000 [0069.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.285] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0069.285] GetProcessHeap () returned 0x130000 [0069.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\VISIO\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0069.556] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.556] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.556] FindClose (in: hFindFile=0x18fcd8 | out: hFindFile=0x18fcd8) returned 1 [0069.556] GetProcessHeap () returned 0x130000 [0069.556] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.556] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0069.556] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0069.556] GetProcessHeap () returned 0x130000 [0069.556] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.557] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0069.557] GetProcessHeap () returned 0x130000 [0069.557] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0069.574] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45c4958, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.DATABASECOMPARE.16.1033.hxn", cAlternateFileName="MSDATA~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf455209f, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.16.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4315e64, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.16.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf455209f, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.16.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.LYNC.16.1033.hxn", cAlternateFileName="MSLYNC~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.LYNC_BASIC.16.1033.hxn", cAlternateFileName="MSLYNC~2.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.LYNC_ONLINE.16.1033.hxn", cAlternateFileName="MSLYNC~3.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4610c9d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.16.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4315e64, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.16.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0069.584] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3f5c319, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.16.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42efb5b, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.16.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf401af21, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.16.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3f825df, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.16.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4315e64, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.16.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SKYPEFB.16.1033.hxn", cAlternateFileName="MSSKYP~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SKYPEFB_BASIC.16.1033.hxn", cAlternateFileName="MSSKYP~2.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SKYPEFB_ONLINE.16.1033.hxn", cAlternateFileName="MSSKYP~3.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed552881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed552881, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44471a3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SKYPEFB_ONLINEG.16.1033.hxn", cAlternateFileName="MSSKYP~4.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45c4958, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SPREADSHEETCOMPARE.16.1033.hxn", cAlternateFileName="MSSPRE~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xf3e9d89c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.16.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xf3e9d89c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.16.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xf3e9d89c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.16.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x3b809370, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.16.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x3b809370, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ_STD.16.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0069.585] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3e2b07e, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.16.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0069.586] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3b85588b, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0069.586] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3b85588b, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0069.586] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0069.586] GetProcessHeap () returned 0x130000 [0069.586] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.586] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0069.587] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0069.587] GetProcessHeap () returned 0x130000 [0069.587] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0069.587] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0069.587] GetProcessHeap () returned 0x130000 [0069.587] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0069.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0069.591] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245644bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245644bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245644bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245644bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0069.592] GetProcessHeap () returned 0x130000 [0069.592] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0069.604] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Server 2016 Accounts.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x730, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 1 [0069.605] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0 [0069.605] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0069.606] GetProcessHeap () returned 0x130000 [0069.606] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.606] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0069.606] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2466f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2466f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2466f613, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 1 [0069.606] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2466f613, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2466f613, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24695725, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 1 [0069.606] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x246bb96e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 1 [0069.606] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3c29db74, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x6ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project 2016.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0069.607] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x246bb96e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 1 [0069.607] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x246bb96e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0069.607] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5277b31, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5277b31, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5277b31, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x6f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0069.607] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x246bb96e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 1 [0069.607] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x246bb96e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0069.607] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0069.607] GetProcessHeap () returned 0x130000 [0069.607] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0069.608] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0069.608] GetProcessHeap () returned 0x130000 [0069.608] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0069.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0069.608] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.608] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="private", cAlternateFileName="")) returned 1 [0069.609] GetProcessHeap () returned 0x130000 [0069.609] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0069.620] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868d297b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xecf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGENCYB.TTF", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a9c5a1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe628, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGENCYR.TTF", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALGER.TTF", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x24dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANTQUAB.TTF", cAlternateFileName="")) returned 1 [0069.620] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x24b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANTQUABI.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x24664, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANTQUAI.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2af54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARIALN.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a9c5a1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c204, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARIALNB.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2bf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARIALNBI.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c384, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARIALNI.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb0cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARLRDBD.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASKVILL.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xba1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAUHS93.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BELL.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14294, dwReserved0=0x0, dwReserved1=0x0, cFileName="BELLB.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86d24d65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14110, dwReserved0=0x0, dwReserved1=0x0, cFileName="BELLI.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BERNHC.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x25f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="BKANT.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x122c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_B.TTF", cAlternateFileName="")) returned 1 [0069.621] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_BI.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14768, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_BLAI.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_BLAR.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1216c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_CB.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_CBI.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_CI.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8875ec88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_CR.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_I.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x165c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_PSTC.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f14c12, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f14c12, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8875ec88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOD_R.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8875ec88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x274ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOKOS.TTF", cAlternateFileName="")) returned 1 [0069.622] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x25bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOKOSB.TTF", cAlternateFileName="")) returned 1 [0069.623] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27a9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOKOSBI.TTF", cAlternateFileName="")) returned 1 [0069.623] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x883a5225, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x274fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOKOSI.TTF", cAlternateFileName="")) returned 1 [0069.623] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRADHITC.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRITANIC.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRLNSB.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87a8e187, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRLNSDB.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87910bb6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17c04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRLNSR.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87910bb6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xebd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROADW.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87910bb6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRUSHSCI.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSSYM7.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb91b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalibriL.ttf", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd4070, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalibriLI.ttf", cAlternateFileName="CALIBR~1.TTF")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALIFB.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x181bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALIFI.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALIFR.TTF", cAlternateFileName="")) returned 1 [0069.624] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86eee9a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86eee9a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89ddda54, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13914, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALIST.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f3ae6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f3ae6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALISTB.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14be0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALISTBI.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALISTI.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASTELAR.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27a4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CENSCBK.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14348, dwReserved0=0x0, dwReserved1=0x0, cFileName="CENTAUR.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28580, dwReserved0=0x0, dwReserved1=0x0, cFileName="CENTURY.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87805b03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x178c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHILLER.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="COLONNA.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="COOPBL.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf070, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPRGTB.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPRGTL.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURLZ___.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc9c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEPHNT.TTF", cAlternateFileName="")) returned 1 [0069.625] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8763be45, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd434, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEPHNTI.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc268, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGR.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe0a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERASBD.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f610cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86f610cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87282225, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xea5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERASDEMI.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x895d1c90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERASLGHT.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xed64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERASMD.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8909a9cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FELIXTI.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x879f59bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x879f59bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf150, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORTE.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x879f59bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x879f59bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2547c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRABK.TTF", cAlternateFileName="")) returned 1 [0069.626] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x885bb26a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x885bb26a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x894a08cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29694, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRABKIT.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x885bb26a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x885bb26a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22e54, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRADM.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x885bb26a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x885bb26a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c8cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRADMCN.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x885bb26a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x885bb26a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x212e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRADMIT.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x885bb26a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x885bb26a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22088, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAHV.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c7c1e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c7c1e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2547c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAHVIT.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8910d01a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8910d01a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAMDCN.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x896442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x110f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREESCPT.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x895d1c90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRSCRIPT.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x895f7d89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1467c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FTLTLT.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x896442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b88e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GABRIOLA.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86e2fdc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86e2fdc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86ff9a7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x337e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GADUGI.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x896442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3328c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GADUGIB.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x305b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GARA.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8910d01a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8910d01a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x30c5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GARABD.TTF", cAlternateFileName="")) returned 1 [0069.627] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86e2fdc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86e2fdc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86ff9a7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e418, dwReserved0=0x0, dwReserved1=0x0, cFileName="GARAIT.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8913323b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22af8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIGI.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x879f59bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x879f59bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8829a0da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11748, dwReserved0=0x0, dwReserved1=0x0, cFileName="GILBI___.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x879f59bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x879f59bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87b4cd70, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GILB____.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87a8e187, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87a8e187, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8829a0da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GILC____.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ab4411, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ab4411, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8829a0da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GILI____.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x87feb6a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GILLUBCD.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8909a9cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GILSANUB.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86eee9a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86eee9a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10758, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIL_____.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x894a08cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11be4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GLECB.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86e2fdc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86e2fdc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86f3ae6b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GLSNECB.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87ada680, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x87ada680, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8947a735, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x21960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOTHIC.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86a762bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOTHICB.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x21f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOTHICBI.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x24428, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOTHICI.TTF", cAlternateFileName="")) returned 1 [0069.628] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOUDOS.TTF", cAlternateFileName="")) returned 1 [0069.629] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a29e47, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a29e47, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86e09b78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1436c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOUDOSB.TTF", cAlternateFileName="")) returned 1 [0069.629] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x885bb26a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x885bb26a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13998, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOUDOSI.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c72585, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c72585, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89690720, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xda94, dwReserved0=0x0, dwReserved1=0x0, cFileName="GOUDYSTO.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xdd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="HARLOWSI.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11328, dwReserved0=0x0, dwReserved1=0x0, cFileName="HARNGTON.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86e2fdc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86e2fdc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a878, dwReserved0=0x0, dwReserved1=0x0, cFileName="HATTEN.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTOWERT.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x123d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTOWERTI.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xec48, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPRISHA.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x124d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFROMAN.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x20514, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITCBLKAD.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x889e7568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x889e7568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITCEDSCR.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITCKRIST.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11078, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOKERMAN.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89395811, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUICE___.TTF", cAlternateFileName="")) returned 1 [0069.630] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KUNSTLER.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaf18, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATINWD.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x894a08cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1145c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LBRITE.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x894a08cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x104a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LBRITED.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8936f68c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11720, dwReserved0=0x0, dwReserved1=0x0, cFileName="LBRITEDI.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88c79ac7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88c79ac7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8966a531, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11558, dwReserved0=0x0, dwReserved1=0x0, cFileName="LBRITEI.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86e2fdc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86e2fdc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86ff9a7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LCALLIG.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x88a0d71e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88a0d71e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c3a0a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEELAWAD.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86eee9a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86eee9a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x89c602ef, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16e8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEELAWDB.TTF", cAlternateFileName="")) returned 1 [0069.631] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86eee9a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86eee9a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8829a0da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LFAX.TTF", cAlternateFileName="")) returned 1 [0069.645] GetProcessHeap () returned 0x130000 [0069.645] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.645] GetProcessHeap () returned 0x130000 [0069.645] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0069.645] GetProcessHeap () returned 0x130000 [0069.645] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0069.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0069.646] GetProcessHeap () returned 0x130000 [0069.646] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb975fdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb975fdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb975fdf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0069.837] GetProcessHeap () returned 0x130000 [0069.837] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0069.837] GetProcessHeap () returned 0x130000 [0069.837] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0069.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0069.837] GetProcessHeap () returned 0x130000 [0069.837] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0069.875] GetProcessHeap () returned 0x130000 [0069.875] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf47e9c8f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0069.876] GetProcessHeap () returned 0x130000 [0069.876] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.876] GetProcessHeap () returned 0x130000 [0069.876] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.876] GetProcessHeap () returned 0x130000 [0069.876] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0069.904] GetProcessHeap () returned 0x130000 [0069.904] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4620012, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0069.905] GetProcessHeap () returned 0x130000 [0069.905] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.905] GetProcessHeap () returned 0x130000 [0069.905] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.906] GetProcessHeap () returned 0x130000 [0069.906] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EURO\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0069.907] GetProcessHeap () returned 0x130000 [0069.907] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.907] GetProcessHeap () returned 0x130000 [0069.907] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0069.908] GetProcessHeap () returned 0x130000 [0069.908] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.908] GetProcessHeap () returned 0x130000 [0069.908] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0069.911] GetProcessHeap () returned 0x130000 [0069.911] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.911] GetProcessHeap () returned 0x130000 [0069.911] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0069.914] GetProcessHeap () returned 0x130000 [0069.914] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.914] GetProcessHeap () returned 0x130000 [0069.914] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0069.915] GetProcessHeap () returned 0x130000 [0069.915] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.915] GetProcessHeap () returned 0x130000 [0069.915] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0069.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0069.916] GetProcessHeap () returned 0x130000 [0069.916] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc541ed37, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0069.921] GetProcessHeap () returned 0x130000 [0069.921] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.921] GetProcessHeap () returned 0x130000 [0069.921] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc461cf97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc461cf97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc461cf97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0069.921] GetProcessHeap () returned 0x130000 [0069.921] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.921] GetProcessHeap () returned 0x130000 [0069.921] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0069.924] GetProcessHeap () returned 0x130000 [0069.924] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0069.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0069.927] GetProcessHeap () returned 0x130000 [0069.927] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0069.927] GetProcessHeap () returned 0x130000 [0069.927] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0069.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0069.927] GetProcessHeap () returned 0x130000 [0069.928] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0069.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\*", lpFindFileData=0x347dba0 | out: lpFindFileData=0x347dba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0069.936] GetProcessHeap () returned 0x130000 [0069.936] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0069.936] GetProcessHeap () returned 0x130000 [0069.936] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0069.936] GetProcessHeap () returned 0x130000 [0069.936] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.936] GetProcessHeap () returned 0x130000 [0069.936] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0069.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0069.936] GetProcessHeap () returned 0x130000 [0069.936] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0069.936] GetProcessHeap () returned 0x130000 [0069.936] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0069.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef915def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef915def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0069.937] GetProcessHeap () returned 0x130000 [0069.937] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0069.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0069.937] GetProcessHeap () returned 0x130000 [0069.937] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0069.937] GetProcessHeap () returned 0x130000 [0069.937] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0069.937] GetProcessHeap () returned 0x130000 [0069.938] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0069.939] GetProcessHeap () returned 0x130000 [0069.939] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0069.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0069.941] GetProcessHeap () returned 0x130000 [0069.941] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0069.941] GetProcessHeap () returned 0x130000 [0069.941] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0069.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.188] GetProcessHeap () returned 0x130000 [0070.188] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf07b04e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf07b04e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.189] GetProcessHeap () returned 0x130000 [0070.189] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.189] GetProcessHeap () returned 0x130000 [0070.189] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.190] GetProcessHeap () returned 0x130000 [0070.190] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0070.190] GetProcessHeap () returned 0x130000 [0070.190] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.190] GetProcessHeap () returned 0x130000 [0070.190] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.191] GetProcessHeap () returned 0x130000 [0070.191] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.192] GetProcessHeap () returned 0x130000 [0070.192] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.193] GetProcessHeap () returned 0x130000 [0070.193] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.193] GetProcessHeap () returned 0x130000 [0070.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.193] GetProcessHeap () returned 0x130000 [0070.193] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.193] GetProcessHeap () returned 0x130000 [0070.193] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0070.196] GetProcessHeap () returned 0x130000 [0070.196] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.198] GetProcessHeap () returned 0x130000 [0070.198] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.198] GetProcessHeap () returned 0x130000 [0070.198] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0070.198] GetProcessHeap () returned 0x130000 [0070.198] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.198] GetProcessHeap () returned 0x130000 [0070.198] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.198] GetProcessHeap () returned 0x130000 [0070.198] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.198] GetProcessHeap () returned 0x130000 [0070.198] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.199] GetProcessHeap () returned 0x130000 [0070.199] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.199] GetProcessHeap () returned 0x130000 [0070.199] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.200] GetProcessHeap () returned 0x130000 [0070.200] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.200] GetProcessHeap () returned 0x130000 [0070.200] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.201] GetProcessHeap () returned 0x130000 [0070.201] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.201] GetProcessHeap () returned 0x130000 [0070.201] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0070.201] GetProcessHeap () returned 0x130000 [0070.201] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.201] GetProcessHeap () returned 0x130000 [0070.201] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.202] GetProcessHeap () returned 0x130000 [0070.202] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.202] GetProcessHeap () returned 0x130000 [0070.202] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0070.202] GetProcessHeap () returned 0x130000 [0070.202] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.202] GetProcessHeap () returned 0x130000 [0070.202] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0070.203] GetProcessHeap () returned 0x130000 [0070.203] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.203] GetProcessHeap () returned 0x130000 [0070.203] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.204] GetProcessHeap () returned 0x130000 [0070.204] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.204] GetProcessHeap () returned 0x130000 [0070.204] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.204] GetProcessHeap () returned 0x130000 [0070.204] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.204] GetProcessHeap () returned 0x130000 [0070.204] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.205] GetProcessHeap () returned 0x130000 [0070.205] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.205] GetProcessHeap () returned 0x130000 [0070.205] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.206] GetProcessHeap () returned 0x130000 [0070.206] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.206] GetProcessHeap () returned 0x130000 [0070.206] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0070.206] GetProcessHeap () returned 0x130000 [0070.206] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.206] GetProcessHeap () returned 0x130000 [0070.206] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.207] GetProcessHeap () returned 0x130000 [0070.207] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.207] GetProcessHeap () returned 0x130000 [0070.207] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.208] GetProcessHeap () returned 0x130000 [0070.208] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.208] GetProcessHeap () returned 0x130000 [0070.208] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.208] GetProcessHeap () returned 0x130000 [0070.208] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.208] GetProcessHeap () returned 0x130000 [0070.208] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.209] GetProcessHeap () returned 0x130000 [0070.209] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.209] GetProcessHeap () returned 0x130000 [0070.209] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.209] GetProcessHeap () returned 0x130000 [0070.209] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.209] GetProcessHeap () returned 0x130000 [0070.209] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.210] GetProcessHeap () returned 0x130000 [0070.210] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.210] GetProcessHeap () returned 0x130000 [0070.210] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0070.211] GetProcessHeap () returned 0x130000 [0070.211] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.211] GetProcessHeap () returned 0x130000 [0070.211] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.211] GetProcessHeap () returned 0x130000 [0070.211] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.211] GetProcessHeap () returned 0x130000 [0070.211] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.212] GetProcessHeap () returned 0x130000 [0070.212] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.212] GetProcessHeap () returned 0x130000 [0070.212] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.212] GetProcessHeap () returned 0x130000 [0070.212] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.212] GetProcessHeap () returned 0x130000 [0070.212] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.213] GetProcessHeap () returned 0x130000 [0070.213] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.213] GetProcessHeap () returned 0x130000 [0070.213] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.213] GetProcessHeap () returned 0x130000 [0070.213] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.214] GetProcessHeap () returned 0x130000 [0070.214] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.214] GetProcessHeap () returned 0x130000 [0070.214] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.214] GetProcessHeap () returned 0x130000 [0070.214] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.214] GetProcessHeap () returned 0x130000 [0070.214] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.214] GetProcessHeap () returned 0x130000 [0070.215] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.215] GetProcessHeap () returned 0x130000 [0070.215] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.215] GetProcessHeap () returned 0x130000 [0070.215] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.216] GetProcessHeap () returned 0x130000 [0070.216] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.216] GetProcessHeap () returned 0x130000 [0070.216] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.217] GetProcessHeap () returned 0x130000 [0070.217] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.217] GetProcessHeap () returned 0x130000 [0070.217] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.218] GetProcessHeap () returned 0x130000 [0070.218] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.218] GetProcessHeap () returned 0x130000 [0070.218] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.218] GetProcessHeap () returned 0x130000 [0070.218] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.218] GetProcessHeap () returned 0x130000 [0070.218] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.219] GetProcessHeap () returned 0x130000 [0070.219] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.219] GetProcessHeap () returned 0x130000 [0070.219] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.220] GetProcessHeap () returned 0x130000 [0070.220] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.220] GetProcessHeap () returned 0x130000 [0070.220] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.220] GetProcessHeap () returned 0x130000 [0070.220] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.220] GetProcessHeap () returned 0x130000 [0070.220] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.221] GetProcessHeap () returned 0x130000 [0070.221] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.221] GetProcessHeap () returned 0x130000 [0070.221] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.222] GetProcessHeap () returned 0x130000 [0070.222] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.222] GetProcessHeap () returned 0x130000 [0070.222] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.222] GetProcessHeap () returned 0x130000 [0070.222] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.222] GetProcessHeap () returned 0x130000 [0070.222] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0070.223] GetProcessHeap () returned 0x130000 [0070.223] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.223] GetProcessHeap () returned 0x130000 [0070.223] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0070.228] GetProcessHeap () returned 0x130000 [0070.229] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.229] GetProcessHeap () returned 0x130000 [0070.229] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.229] GetProcessHeap () returned 0x130000 [0070.229] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.229] GetProcessHeap () returned 0x130000 [0070.229] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0070.230] GetProcessHeap () returned 0x130000 [0070.230] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.230] GetProcessHeap () returned 0x130000 [0070.230] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.231] GetProcessHeap () returned 0x130000 [0070.231] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.231] GetProcessHeap () returned 0x130000 [0070.231] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.231] GetProcessHeap () returned 0x130000 [0070.231] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.233] GetProcessHeap () returned 0x130000 [0070.233] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc85db99, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc85db99, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.234] GetProcessHeap () returned 0x130000 [0070.234] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.234] GetProcessHeap () returned 0x130000 [0070.234] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.234] GetProcessHeap () returned 0x130000 [0070.234] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.234] GetProcessHeap () returned 0x130000 [0070.234] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.535] GetProcessHeap () returned 0x130000 [0070.535] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.536] GetProcessHeap () returned 0x130000 [0070.536] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.540] GetProcessHeap () returned 0x130000 [0070.540] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.541] GetProcessHeap () returned 0x130000 [0070.541] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.541] GetProcessHeap () returned 0x130000 [0070.541] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.541] GetProcessHeap () returned 0x130000 [0070.541] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.542] GetProcessHeap () returned 0x130000 [0070.542] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecf3682d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.542] GetProcessHeap () returned 0x130000 [0070.542] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.542] GetProcessHeap () returned 0x130000 [0070.543] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.543] GetProcessHeap () returned 0x130000 [0070.543] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.543] GetProcessHeap () returned 0x130000 [0070.543] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0070.543] GetProcessHeap () returned 0x130000 [0070.543] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.547] GetProcessHeap () returned 0x130000 [0070.547] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.547] GetProcessHeap () returned 0x130000 [0070.547] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.547] GetProcessHeap () returned 0x130000 [0070.547] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.547] GetProcessHeap () returned 0x130000 [0070.547] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.547] GetProcessHeap () returned 0x130000 [0070.547] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0070.547] GetProcessHeap () returned 0x130000 [0070.547] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0070.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\*", lpFindFileData=0x347dba0 | out: lpFindFileData=0x347dba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0070.548] GetProcessHeap () returned 0x130000 [0070.548] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0070.548] GetProcessHeap () returned 0x130000 [0070.548] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.548] GetProcessHeap () returned 0x130000 [0070.548] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.549] GetProcessHeap () returned 0x130000 [0070.549] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.549] GetProcessHeap () returned 0x130000 [0070.549] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.550] GetProcessHeap () returned 0x130000 [0070.550] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.551] GetProcessHeap () returned 0x130000 [0070.551] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\Data Sources\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.551] GetProcessHeap () returned 0x130000 [0070.551] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.551] GetProcessHeap () returned 0x130000 [0070.551] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.552] GetProcessHeap () returned 0x130000 [0070.552] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.552] GetProcessHeap () returned 0x130000 [0070.552] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0070.553] GetProcessHeap () returned 0x130000 [0070.553] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0070.554] GetProcessHeap () returned 0x130000 [0070.554] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.554] GetProcessHeap () returned 0x130000 [0070.554] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.554] GetProcessHeap () returned 0x130000 [0070.554] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\ole db\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0070.555] GetProcessHeap () returned 0x130000 [0070.555] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.555] GetProcessHeap () returned 0x130000 [0070.555] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.556] GetProcessHeap () returned 0x130000 [0070.556] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0070.556] GetProcessHeap () returned 0x130000 [0070.556] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0070.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0070.556] GetProcessHeap () returned 0x130000 [0070.556] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0070.558] GetProcessHeap () returned 0x130000 [0070.558] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.562] GetProcessHeap () returned 0x130000 [0070.562] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.562] GetProcessHeap () returned 0x130000 [0070.562] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.566] GetProcessHeap () returned 0x130000 [0070.566] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1028\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12dd5ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.568] GetProcessHeap () returned 0x130000 [0070.568] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.568] GetProcessHeap () returned 0x130000 [0070.568] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1031\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0070.569] GetProcessHeap () returned 0x130000 [0070.569] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.569] GetProcessHeap () returned 0x130000 [0070.569] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.570] GetProcessHeap () returned 0x130000 [0070.570] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.570] GetProcessHeap () returned 0x130000 [0070.570] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1036\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0070.570] GetProcessHeap () returned 0x130000 [0070.570] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.570] GetProcessHeap () returned 0x130000 [0070.570] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1040\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.571] GetProcessHeap () returned 0x130000 [0070.571] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.571] GetProcessHeap () returned 0x130000 [0070.571] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1041\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.572] GetProcessHeap () returned 0x130000 [0070.572] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.572] GetProcessHeap () returned 0x130000 [0070.572] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1042\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.573] GetProcessHeap () returned 0x130000 [0070.573] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.573] GetProcessHeap () returned 0x130000 [0070.573] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1046\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.574] GetProcessHeap () returned 0x130000 [0070.574] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.574] GetProcessHeap () returned 0x130000 [0070.574] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1049\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0070.574] GetProcessHeap () returned 0x130000 [0070.574] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.574] GetProcessHeap () returned 0x130000 [0070.574] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\2052\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.575] GetProcessHeap () returned 0x130000 [0070.575] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.575] GetProcessHeap () returned 0x130000 [0070.575] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\3082\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.575] GetProcessHeap () returned 0x130000 [0070.575] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.576] GetProcessHeap () returned 0x130000 [0070.576] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.576] GetProcessHeap () returned 0x130000 [0070.576] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0070.867] GetProcessHeap () returned 0x130000 [0070.867] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4512fb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd4512fb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0070.867] GetProcessHeap () returned 0x130000 [0070.867] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.867] GetProcessHeap () returned 0x130000 [0070.867] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc436e5a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc436e5a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc436e5a6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0070.868] GetProcessHeap () returned 0x130000 [0070.868] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.868] GetProcessHeap () returned 0x130000 [0070.868] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0070.869] GetProcessHeap () returned 0x130000 [0070.869] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.869] GetProcessHeap () returned 0x130000 [0070.869] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.869] GetProcessHeap () returned 0x130000 [0070.869] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.869] GetProcessHeap () returned 0x130000 [0070.869] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.869] GetProcessHeap () returned 0x130000 [0070.869] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.869] GetProcessHeap () returned 0x130000 [0070.869] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.870] GetProcessHeap () returned 0x130000 [0070.870] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0070.871] GetProcessHeap () returned 0x130000 [0070.871] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0070.871] GetProcessHeap () returned 0x130000 [0070.871] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.872] GetProcessHeap () returned 0x130000 [0070.872] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0070.872] GetProcessHeap () returned 0x130000 [0070.872] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.875] GetProcessHeap () returned 0x130000 [0070.875] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.875] GetProcessHeap () returned 0x130000 [0070.875] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.875] GetProcessHeap () returned 0x130000 [0070.875] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.875] GetProcessHeap () returned 0x130000 [0070.875] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0070.876] GetProcessHeap () returned 0x130000 [0070.876] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0070.876] GetProcessHeap () returned 0x130000 [0070.876] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.877] GetProcessHeap () returned 0x130000 [0070.877] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.877] GetProcessHeap () returned 0x130000 [0070.877] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.877] GetProcessHeap () returned 0x130000 [0070.877] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.877] GetProcessHeap () returned 0x130000 [0070.877] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.878] GetProcessHeap () returned 0x130000 [0070.878] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0070.879] GetProcessHeap () returned 0x130000 [0070.879] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\ole db\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.880] GetProcessHeap () returned 0x130000 [0070.880] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.880] GetProcessHeap () returned 0x130000 [0070.880] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.880] GetProcessHeap () returned 0x130000 [0070.880] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0070.880] GetProcessHeap () returned 0x130000 [0070.880] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0070.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0070.882] GetProcessHeap () returned 0x130000 [0070.882] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0070.883] GetProcessHeap () returned 0x130000 [0070.883] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0070.883] GetProcessHeap () returned 0x130000 [0070.883] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0070.885] GetProcessHeap () returned 0x130000 [0070.885] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2aebe60a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2aebe60a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0070.891] GetProcessHeap () returned 0x130000 [0070.891] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.891] GetProcessHeap () returned 0x130000 [0070.891] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0070.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0070.891] GetProcessHeap () returned 0x130000 [0070.891] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0070.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x347dba0 | out: lpFindFileData=0x347dba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.891] GetProcessHeap () returned 0x130000 [0070.891] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0070.893] GetProcessHeap () returned 0x130000 [0070.893] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0070.893] GetProcessHeap () returned 0x130000 [0070.893] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.894] GetProcessHeap () returned 0x130000 [0070.894] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.894] GetProcessHeap () returned 0x130000 [0070.894] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.894] GetProcessHeap () returned 0x130000 [0070.894] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.895] GetProcessHeap () returned 0x130000 [0070.895] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.895] GetProcessHeap () returned 0x130000 [0070.895] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0070.896] GetProcessHeap () returned 0x130000 [0070.896] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0070.897] GetProcessHeap () returned 0x130000 [0070.897] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0070.898] GetProcessHeap () returned 0x130000 [0070.898] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.898] GetProcessHeap () returned 0x130000 [0070.898] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.898] GetProcessHeap () returned 0x130000 [0070.898] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.899] GetProcessHeap () returned 0x130000 [0070.899] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0070.900] GetProcessHeap () returned 0x130000 [0070.900] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0070.901] GetProcessHeap () returned 0x130000 [0070.901] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0070.902] GetProcessHeap () returned 0x130000 [0070.902] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0070.902] GetProcessHeap () returned 0x130000 [0070.902] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0070.902] GetProcessHeap () returned 0x130000 [0070.902] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0070.903] GetProcessHeap () returned 0x130000 [0070.904] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0070.904] GetProcessHeap () returned 0x130000 [0070.904] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0070.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0070.905] GetProcessHeap () returned 0x130000 [0070.905] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0070.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0070.907] GetProcessHeap () returned 0x130000 [0070.907] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0070.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0070.907] GetProcessHeap () returned 0x130000 [0070.907] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0070.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0071.247] GetProcessHeap () returned 0x130000 [0071.247] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0071.253] GetProcessHeap () returned 0x130000 [0071.253] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.253] GetProcessHeap () returned 0x130000 [0071.253] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0071.254] GetProcessHeap () returned 0x130000 [0071.254] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x843f98 [0071.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x347dba0 | out: lpFindFileData=0x347dba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0071.254] GetProcessHeap () returned 0x130000 [0071.254] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x843f98 | out: hHeap=0x130000) returned 1 [0071.254] GetProcessHeap () returned 0x130000 [0071.254] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.254] GetProcessHeap () returned 0x130000 [0071.254] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.255] GetProcessHeap () returned 0x130000 [0071.255] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.255] GetProcessHeap () returned 0x130000 [0071.255] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.256] GetProcessHeap () returned 0x130000 [0071.256] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0071.257] GetProcessHeap () returned 0x130000 [0071.257] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0071.286] GetProcessHeap () returned 0x130000 [0071.286] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd43957d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca99edb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e1424f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.289] GetProcessHeap () returned 0x130000 [0071.290] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.291] GetProcessHeap () returned 0x130000 [0071.291] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.295] GetProcessHeap () returned 0x130000 [0071.295] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\1033\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0071.296] GetProcessHeap () returned 0x130000 [0071.296] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.296] GetProcessHeap () returned 0x130000 [0071.296] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0071.299] GetProcessHeap () returned 0x130000 [0071.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.300] GetProcessHeap () returned 0x130000 [0071.300] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.300] GetProcessHeap () returned 0x130000 [0071.300] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.301] GetProcessHeap () returned 0x130000 [0071.301] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.301] GetProcessHeap () returned 0x130000 [0071.301] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.302] GetProcessHeap () returned 0x130000 [0071.302] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0071.302] GetProcessHeap () returned 0x130000 [0071.302] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0071.303] GetProcessHeap () returned 0x130000 [0071.303] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.304] GetProcessHeap () returned 0x130000 [0071.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.304] GetProcessHeap () returned 0x130000 [0071.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.305] GetProcessHeap () returned 0x130000 [0071.305] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.305] GetProcessHeap () returned 0x130000 [0071.305] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.306] GetProcessHeap () returned 0x130000 [0071.306] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0071.307] GetProcessHeap () returned 0x130000 [0071.307] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.307] GetProcessHeap () returned 0x130000 [0071.307] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.308] GetProcessHeap () returned 0x130000 [0071.308] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.309] GetProcessHeap () returned 0x130000 [0071.309] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0071.310] GetProcessHeap () returned 0x130000 [0071.310] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0071.311] GetProcessHeap () returned 0x130000 [0071.311] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.311] GetProcessHeap () returned 0x130000 [0071.311] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.311] GetProcessHeap () returned 0x130000 [0071.311] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0071.311] GetProcessHeap () returned 0x130000 [0071.311] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0071.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.313] GetProcessHeap () returned 0x130000 [0071.313] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0071.313] GetProcessHeap () returned 0x130000 [0071.313] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0071.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0071.318] GetProcessHeap () returned 0x130000 [0071.318] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0071.318] GetProcessHeap () returned 0x130000 [0071.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0071.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0071.318] GetProcessHeap () returned 0x130000 [0071.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0071.536] GetProcessHeap () returned 0x130000 [0071.536] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0071.538] GetProcessHeap () returned 0x130000 [0071.538] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.539] GetProcessHeap () returned 0x130000 [0071.539] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0071.539] GetProcessHeap () returned 0x130000 [0071.539] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.539] GetProcessHeap () returned 0x130000 [0071.539] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.539] GetProcessHeap () returned 0x130000 [0071.539] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.540] GetProcessHeap () returned 0x130000 [0071.540] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.543] GetProcessHeap () returned 0x130000 [0071.543] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0071.552] GetProcessHeap () returned 0x130000 [0071.552] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0071.553] GetProcessHeap () returned 0x130000 [0071.553] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.553] GetProcessHeap () returned 0x130000 [0071.553] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.553] GetProcessHeap () returned 0x130000 [0071.553] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0071.554] GetProcessHeap () returned 0x130000 [0071.554] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.554] GetProcessHeap () returned 0x130000 [0071.554] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.554] GetProcessHeap () returned 0x130000 [0071.554] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.555] GetProcessHeap () returned 0x130000 [0071.555] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0071.555] GetProcessHeap () returned 0x130000 [0071.555] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0071.556] GetProcessHeap () returned 0x130000 [0071.556] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.556] GetProcessHeap () returned 0x130000 [0071.556] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.556] GetProcessHeap () returned 0x130000 [0071.556] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.557] GetProcessHeap () returned 0x130000 [0071.557] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0071.557] GetProcessHeap () returned 0x130000 [0071.557] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.558] GetProcessHeap () returned 0x130000 [0071.558] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.558] GetProcessHeap () returned 0x130000 [0071.558] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.559] GetProcessHeap () returned 0x130000 [0071.559] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0071.559] GetProcessHeap () returned 0x130000 [0071.559] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.559] GetProcessHeap () returned 0x130000 [0071.559] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.559] GetProcessHeap () returned 0x130000 [0071.559] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0071.559] GetProcessHeap () returned 0x130000 [0071.559] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x833f90 [0071.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x347de28 | out: lpFindFileData=0x347de28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.560] GetProcessHeap () returned 0x130000 [0071.560] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x833f90 | out: hHeap=0x130000) returned 1 [0071.560] GetProcessHeap () returned 0x130000 [0071.560] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.560] GetProcessHeap () returned 0x130000 [0071.560] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.561] GetProcessHeap () returned 0x130000 [0071.561] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.561] GetProcessHeap () returned 0x130000 [0071.561] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.561] GetProcessHeap () returned 0x130000 [0071.561] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.561] GetProcessHeap () returned 0x130000 [0071.561] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0071.561] GetProcessHeap () returned 0x130000 [0071.561] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc434832e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0071.562] GetProcessHeap () returned 0x130000 [0071.562] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.562] GetProcessHeap () returned 0x130000 [0071.562] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0071.562] GetProcessHeap () returned 0x130000 [0071.562] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.562] GetProcessHeap () returned 0x130000 [0071.562] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.563] GetProcessHeap () returned 0x130000 [0071.563] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.563] GetProcessHeap () returned 0x130000 [0071.563] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.564] GetProcessHeap () returned 0x130000 [0071.564] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.564] GetProcessHeap () returned 0x130000 [0071.564] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0071.566] GetProcessHeap () returned 0x130000 [0071.566] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.566] GetProcessHeap () returned 0x130000 [0071.566] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.567] GetProcessHeap () returned 0x130000 [0071.567] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.567] GetProcessHeap () returned 0x130000 [0071.567] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0071.568] GetProcessHeap () returned 0x130000 [0071.568] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0071.569] GetProcessHeap () returned 0x130000 [0071.569] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.569] GetProcessHeap () returned 0x130000 [0071.569] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0071.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x347e0b0 | out: lpFindFileData=0x347e0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0071.569] GetProcessHeap () returned 0x130000 [0071.569] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0071.569] GetProcessHeap () returned 0x130000 [0071.569] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.569] GetProcessHeap () returned 0x130000 [0071.569] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.570] GetProcessHeap () returned 0x130000 [0071.571] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0071.571] GetProcessHeap () returned 0x130000 [0071.571] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.571] GetProcessHeap () returned 0x130000 [0071.571] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0071.572] GetProcessHeap () returned 0x130000 [0071.572] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.572] GetProcessHeap () returned 0x130000 [0071.572] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.573] GetProcessHeap () returned 0x130000 [0071.573] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0071.574] GetProcessHeap () returned 0x130000 [0071.574] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6a2f1b6, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a2f1b6, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0071.574] GetProcessHeap () returned 0x130000 [0071.574] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.574] GetProcessHeap () returned 0x130000 [0071.574] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.575] GetProcessHeap () returned 0x130000 [0071.575] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.575] GetProcessHeap () returned 0x130000 [0071.575] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0071.593] GetProcessHeap () returned 0x130000 [0071.593] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb0da723, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xece35df2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xece35df2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0071.595] GetProcessHeap () returned 0x130000 [0071.595] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb40aac, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb40aac, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0071.596] GetProcessHeap () returned 0x130000 [0071.596] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.596] GetProcessHeap () returned 0x130000 [0071.596] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\features\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0071.697] GetProcessHeap () returned 0x130000 [0071.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.697] GetProcessHeap () returned 0x130000 [0071.697] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0071.697] GetProcessHeap () returned 0x130000 [0071.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.697] GetProcessHeap () returned 0x130000 [0071.697] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.699] GetProcessHeap () returned 0x130000 [0071.699] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec080216, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.700] GetProcessHeap () returned 0x130000 [0071.700] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0071.701] GetProcessHeap () returned 0x130000 [0071.701] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.701] GetProcessHeap () returned 0x130000 [0071.701] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.702] GetProcessHeap () returned 0x130000 [0071.702] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.702] GetProcessHeap () returned 0x130000 [0071.703] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.703] GetProcessHeap () returned 0x130000 [0071.703] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\fonts\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0f2926, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecbad561, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecbad561, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.703] GetProcessHeap () returned 0x130000 [0071.703] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.703] GetProcessHeap () returned 0x130000 [0071.703] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecaee98b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecaee98b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0071.704] GetProcessHeap () returned 0x130000 [0071.704] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0071.705] GetProcessHeap () returned 0x130000 [0071.705] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.705] GetProcessHeap () returned 0x130000 [0071.705] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.705] GetProcessHeap () returned 0x130000 [0071.705] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9d2ec34, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef639ad2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef639ad2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0071.708] GetProcessHeap () returned 0x130000 [0071.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.708] GetProcessHeap () returned 0x130000 [0071.708] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.708] GetProcessHeap () returned 0x130000 [0071.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe6a7b68f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a7b68f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0071.708] GetProcessHeap () returned 0x130000 [0071.708] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0071.708] GetProcessHeap () returned 0x130000 [0071.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0071.709] GetProcessHeap () returned 0x130000 [0071.709] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0071.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0071.710] GetProcessHeap () returned 0x130000 [0071.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0071.711] GetProcessHeap () returned 0x130000 [0071.711] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0071.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0071.711] GetProcessHeap () returned 0x130000 [0071.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0071.711] GetProcessHeap () returned 0x130000 [0071.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.711] GetProcessHeap () returned 0x130000 [0071.711] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.712] GetProcessHeap () returned 0x130000 [0071.712] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.712] GetProcessHeap () returned 0x130000 [0071.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe6bd2adf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bd2adf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0071.712] GetProcessHeap () returned 0x130000 [0071.712] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.713] GetProcessHeap () returned 0x130000 [0071.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0071.713] GetProcessHeap () returned 0x130000 [0071.713] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0071.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0071.716] GetProcessHeap () returned 0x130000 [0071.716] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0071.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0071.717] GetProcessHeap () returned 0x130000 [0071.717] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0071.717] GetProcessHeap () returned 0x130000 [0071.717] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0071.717] GetProcessHeap () returned 0x130000 [0071.717] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0071.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.721] GetProcessHeap () returned 0x130000 [0071.721] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0071.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0071.722] GetProcessHeap () returned 0x130000 [0071.722] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0071.722] GetProcessHeap () returned 0x130000 [0071.722] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0071.722] GetProcessHeap () returned 0x130000 [0071.722] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0071.722] GetProcessHeap () returned 0x130000 [0071.722] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.723] GetProcessHeap () returned 0x130000 [0071.723] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.723] GetProcessHeap () returned 0x130000 [0071.723] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa73e1bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8390c831, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0071.724] GetProcessHeap () returned 0x130000 [0071.724] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\Logs\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0071.757] GetProcessHeap () returned 0x130000 [0071.757] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0071.757] GetProcessHeap () returned 0x130000 [0071.757] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.757] GetProcessHeap () returned 0x130000 [0071.757] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0071.758] GetProcessHeap () returned 0x130000 [0071.758] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0071.758] GetProcessHeap () returned 0x130000 [0071.758] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0071.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xe69bc7dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69bc7dd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0071.758] GetProcessHeap () returned 0x130000 [0071.758] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0071.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0071.758] GetProcessHeap () returned 0x130000 [0071.758] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0071.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0071.759] GetProcessHeap () returned 0x130000 [0071.759] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0071.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0071.760] GetProcessHeap () returned 0x130000 [0071.760] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0071.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0071.760] GetProcessHeap () returned 0x130000 [0071.760] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0071.760] GetProcessHeap () returned 0x130000 [0071.760] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.760] GetProcessHeap () returned 0x130000 [0071.760] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0071.761] GetProcessHeap () returned 0x130000 [0071.761] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.761] GetProcessHeap () returned 0x130000 [0071.761] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0071.761] GetProcessHeap () returned 0x130000 [0071.761] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.761] GetProcessHeap () returned 0x130000 [0071.761] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0071.761] GetProcessHeap () returned 0x130000 [0071.761] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.761] GetProcessHeap () returned 0x130000 [0071.761] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.762] GetProcessHeap () returned 0x130000 [0071.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.762] GetProcessHeap () returned 0x130000 [0071.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0071.762] GetProcessHeap () returned 0x130000 [0071.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.762] GetProcessHeap () returned 0x130000 [0071.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0071.762] GetProcessHeap () returned 0x130000 [0071.762] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.762] GetProcessHeap () returned 0x130000 [0071.762] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0071.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0071.763] GetProcessHeap () returned 0x130000 [0071.763] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0071.763] GetProcessHeap () returned 0x130000 [0072.090] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.090] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.090] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.090] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.090] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.090] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.090] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.090] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0072.091] GetProcessHeap () returned 0x130000 [0072.091] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0072.091] GetProcessHeap () returned 0x130000 [0072.091] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.091] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xe4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.091] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.091] GetProcessHeap () returned 0x130000 [0072.091] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.091] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0072.092] GetProcessHeap () returned 0x130000 [0072.092] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.092] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.092] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0072.092] GetProcessHeap () returned 0x130000 [0072.092] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0072.092] GetProcessHeap () returned 0x130000 [0072.092] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.092] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x923d, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.093] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0072.093] GetProcessHeap () returned 0x130000 [0072.093] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0072.093] GetProcessHeap () returned 0x130000 [0072.093] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.093] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9093, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x14d9d700, ftLastWriteTime.dwHighDateTime=0x1d29cb5, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.093] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.094] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0072.094] GetProcessHeap () returned 0x130000 [0072.094] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0072.094] GetProcessHeap () returned 0x130000 [0072.094] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0072.094] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.094] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.094] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0072.094] GetProcessHeap () returned 0x130000 [0072.095] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0072.095] GetProcessHeap () returned 0x130000 [0072.095] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.095] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.095] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0072.095] GetProcessHeap () returned 0x130000 [0072.095] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0072.095] GetProcessHeap () returned 0x130000 [0072.095] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.096] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.096] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0072.096] GetProcessHeap () returned 0x130000 [0072.096] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0072.096] GetProcessHeap () returned 0x130000 [0072.096] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.096] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.097] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.097] GetProcessHeap () returned 0x130000 [0072.097] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0072.097] GetProcessHeap () returned 0x130000 [0072.097] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.097] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.097] GetProcessHeap () returned 0x130000 [0072.097] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.097] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0072.098] GetProcessHeap () returned 0x130000 [0072.098] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.098] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.098] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0072.098] GetProcessHeap () returned 0x130000 [0072.098] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0072.098] GetProcessHeap () returned 0x130000 [0072.098] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.098] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.099] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0072.099] GetProcessHeap () returned 0x130000 [0072.099] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0072.099] GetProcessHeap () returned 0x130000 [0072.099] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0072.099] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.100] FindClose (in: hFindFile=0x18fa58 | out: hFindFile=0x18fa58) returned 1 [0072.100] GetProcessHeap () returned 0x130000 [0072.100] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0072.100] GetProcessHeap () returned 0x130000 [0072.100] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.100] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.100] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0072.100] GetProcessHeap () returned 0x130000 [0072.100] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0072.101] GetProcessHeap () returned 0x130000 [0072.101] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0072.101] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.101] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0072.101] GetProcessHeap () returned 0x130000 [0072.101] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0072.101] GetProcessHeap () returned 0x130000 [0072.101] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.101] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.102] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.102] GetProcessHeap () returned 0x130000 [0072.102] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0072.102] GetProcessHeap () returned 0x130000 [0072.102] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.102] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.103] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0072.103] GetProcessHeap () returned 0x130000 [0072.103] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0072.103] GetProcessHeap () returned 0x130000 [0072.103] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.103] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.103] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.103] GetProcessHeap () returned 0x130000 [0072.103] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0072.104] GetProcessHeap () returned 0x130000 [0072.104] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.104] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9f19, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.104] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0072.104] GetProcessHeap () returned 0x130000 [0072.104] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0072.104] GetProcessHeap () returned 0x130000 [0072.104] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0072.104] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.105] FindClose (in: hFindFile=0x18f7d8 | out: hFindFile=0x18f7d8) returned 1 [0072.105] GetProcessHeap () returned 0x130000 [0072.105] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0072.105] GetProcessHeap () returned 0x130000 [0072.105] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.105] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.106] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0072.106] GetProcessHeap () returned 0x130000 [0072.106] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0072.106] GetProcessHeap () returned 0x130000 [0072.106] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0072.106] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x94f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.106] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0072.107] GetProcessHeap () returned 0x130000 [0072.107] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0072.107] GetProcessHeap () returned 0x130000 [0072.107] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.107] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.107] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.107] GetProcessHeap () returned 0x130000 [0072.107] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0072.108] GetProcessHeap () returned 0x130000 [0072.108] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.108] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.108] FindClose (in: hFindFile=0x18f918 | out: hFindFile=0x18f918) returned 1 [0072.108] GetProcessHeap () returned 0x130000 [0072.108] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0072.108] GetProcessHeap () returned 0x130000 [0072.108] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0072.109] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.109] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0072.109] GetProcessHeap () returned 0x130000 [0072.109] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0072.109] GetProcessHeap () returned 0x130000 [0072.109] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0072.109] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa7a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.109] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.110] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0072.110] GetProcessHeap () returned 0x130000 [0072.110] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0072.110] GetProcessHeap () returned 0x130000 [0072.110] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0072.110] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.110] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.110] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0072.111] GetProcessHeap () returned 0x130000 [0072.111] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0072.111] GetProcessHeap () returned 0x130000 [0072.111] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.111] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.111] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.111] GetProcessHeap () returned 0x130000 [0072.111] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.111] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0072.111] GetProcessHeap () returned 0x130000 [0072.111] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.112] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.112] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0072.112] GetProcessHeap () returned 0x130000 [0072.112] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0072.112] GetProcessHeap () returned 0x130000 [0072.112] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.112] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.113] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.113] GetProcessHeap () returned 0x130000 [0072.113] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0072.113] GetProcessHeap () returned 0x130000 [0072.113] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.113] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.113] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.113] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0072.114] GetProcessHeap () returned 0x130000 [0072.114] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0072.114] GetProcessHeap () returned 0x130000 [0072.114] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.114] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.114] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0072.114] GetProcessHeap () returned 0x130000 [0072.114] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.114] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0072.114] GetProcessHeap () returned 0x130000 [0072.114] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.115] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.115] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.115] GetProcessHeap () returned 0x130000 [0072.115] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is-IS", cAlternateFileName="")) returned 1 [0072.115] GetProcessHeap () returned 0x130000 [0072.115] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.115] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.115] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.116] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0072.116] GetProcessHeap () returned 0x130000 [0072.116] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0072.116] GetProcessHeap () returned 0x130000 [0072.116] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.116] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x174, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0072.116] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0072.117] GetProcessHeap () returned 0x130000 [0072.117] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.117] FindNextFileW (in: hFindFile=0x18fcd8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0072.117] GetProcessHeap () returned 0x130000 [0072.117] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0072.117] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.117] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0072.117] FindNextFileW (in: hFindFile=0x18f7d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0072.118] GetProcessHeap () returned 0x130000 [0072.118] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.118] GetProcessHeap () returned 0x130000 [0072.118] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.119] GetProcessHeap () returned 0x130000 [0072.119] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.119] GetProcessHeap () returned 0x130000 [0072.119] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.119] GetProcessHeap () returned 0x130000 [0072.119] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.119] GetProcessHeap () returned 0x130000 [0072.119] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.119] GetProcessHeap () returned 0x130000 [0072.119] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.119] GetProcessHeap () returned 0x130000 [0072.119] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.120] GetProcessHeap () returned 0x130000 [0072.120] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.120] GetProcessHeap () returned 0x130000 [0072.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0072.121] GetProcessHeap () returned 0x130000 [0072.121] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.121] GetProcessHeap () returned 0x130000 [0072.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.121] GetProcessHeap () returned 0x130000 [0072.121] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.121] GetProcessHeap () returned 0x130000 [0072.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.121] GetProcessHeap () returned 0x130000 [0072.121] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.121] GetProcessHeap () returned 0x130000 [0072.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.122] GetProcessHeap () returned 0x130000 [0072.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.122] GetProcessHeap () returned 0x130000 [0072.122] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.122] GetProcessHeap () returned 0x130000 [0072.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.122] GetProcessHeap () returned 0x130000 [0072.122] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.271] GetProcessHeap () returned 0x130000 [0072.271] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.271] GetProcessHeap () returned 0x130000 [0072.271] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.271] GetProcessHeap () returned 0x130000 [0072.271] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.271] GetProcessHeap () returned 0x130000 [0072.271] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.271] GetProcessHeap () returned 0x130000 [0072.271] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.271] GetProcessHeap () returned 0x130000 [0072.272] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0072.272] GetProcessHeap () returned 0x130000 [0072.272] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.273] GetProcessHeap () returned 0x130000 [0072.273] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.273] GetProcessHeap () returned 0x130000 [0072.273] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.273] GetProcessHeap () returned 0x130000 [0072.273] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.273] GetProcessHeap () returned 0x130000 [0072.273] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.273] GetProcessHeap () returned 0x130000 [0072.273] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.274] GetProcessHeap () returned 0x130000 [0072.274] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.274] GetProcessHeap () returned 0x130000 [0072.275] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0072.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0072.275] GetProcessHeap () returned 0x130000 [0072.275] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0072.275] GetProcessHeap () returned 0x130000 [0072.275] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0072.276] GetProcessHeap () returned 0x130000 [0072.276] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0072.276] GetProcessHeap () returned 0x130000 [0072.276] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.277] GetProcessHeap () returned 0x130000 [0072.277] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.277] GetProcessHeap () returned 0x130000 [0072.277] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xb9e664f2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb9e664f2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0072.278] GetProcessHeap () returned 0x130000 [0072.278] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.278] GetProcessHeap () returned 0x130000 [0072.278] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.278] GetProcessHeap () returned 0x130000 [0072.278] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0072.279] GetProcessHeap () returned 0x130000 [0072.279] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0072.282] GetProcessHeap () returned 0x130000 [0072.282] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.282] GetProcessHeap () returned 0x130000 [0072.282] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0072.282] GetProcessHeap () returned 0x130000 [0072.282] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.282] GetProcessHeap () returned 0x130000 [0072.282] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.283] GetProcessHeap () returned 0x130000 [0072.283] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0072.283] GetProcessHeap () returned 0x130000 [0072.283] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.284] GetProcessHeap () returned 0x130000 [0072.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.284] GetProcessHeap () returned 0x130000 [0072.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.284] GetProcessHeap () returned 0x130000 [0072.284] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.284] GetProcessHeap () returned 0x130000 [0072.284] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.284] GetProcessHeap () returned 0x130000 [0072.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.284] GetProcessHeap () returned 0x130000 [0072.284] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.285] GetProcessHeap () returned 0x130000 [0072.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0072.287] GetProcessHeap () returned 0x130000 [0072.287] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.298] GetProcessHeap () returned 0x130000 [0072.298] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.298] GetProcessHeap () returned 0x130000 [0072.298] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0072.298] GetProcessHeap () returned 0x130000 [0072.298] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.298] GetProcessHeap () returned 0x130000 [0072.298] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0072.301] GetProcessHeap () returned 0x130000 [0072.301] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.301] GetProcessHeap () returned 0x130000 [0072.301] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0072.303] GetProcessHeap () returned 0x130000 [0072.303] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.303] GetProcessHeap () returned 0x130000 [0072.303] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0072.303] GetProcessHeap () returned 0x130000 [0072.303] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.303] GetProcessHeap () returned 0x130000 [0072.303] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0072.303] GetProcessHeap () returned 0x130000 [0072.303] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.303] GetProcessHeap () returned 0x130000 [0072.303] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.304] GetProcessHeap () returned 0x130000 [0072.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0072.304] GetProcessHeap () returned 0x130000 [0072.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.304] GetProcessHeap () returned 0x130000 [0072.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b3a1ae, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b3a1ae, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.304] GetProcessHeap () returned 0x130000 [0072.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0072.304] GetProcessHeap () returned 0x130000 [0072.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0072.305] GetProcessHeap () returned 0x130000 [0072.305] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.310] GetProcessHeap () returned 0x130000 [0072.310] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.310] GetProcessHeap () returned 0x130000 [0072.310] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0072.312] GetProcessHeap () returned 0x130000 [0072.312] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0072.313] GetProcessHeap () returned 0x130000 [0072.313] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.313] GetProcessHeap () returned 0x130000 [0072.313] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.313] GetProcessHeap () returned 0x130000 [0072.313] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.313] GetProcessHeap () returned 0x130000 [0072.313] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0072.315] GetProcessHeap () returned 0x130000 [0072.315] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0072.315] GetProcessHeap () returned 0x130000 [0072.315] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.315] GetProcessHeap () returned 0x130000 [0072.315] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.315] GetProcessHeap () returned 0x130000 [0072.315] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0072.315] GetProcessHeap () returned 0x130000 [0072.315] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.316] GetProcessHeap () returned 0x130000 [0072.316] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0072.316] GetProcessHeap () returned 0x130000 [0072.316] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.316] GetProcessHeap () returned 0x130000 [0072.316] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0072.317] GetProcessHeap () returned 0x130000 [0072.317] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.317] GetProcessHeap () returned 0x130000 [0072.317] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.317] GetProcessHeap () returned 0x130000 [0072.317] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.317] GetProcessHeap () returned 0x130000 [0072.317] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0072.318] GetProcessHeap () returned 0x130000 [0072.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0072.318] GetProcessHeap () returned 0x130000 [0072.318] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.318] GetProcessHeap () returned 0x130000 [0072.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.318] GetProcessHeap () returned 0x130000 [0072.318] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.318] GetProcessHeap () returned 0x130000 [0072.318] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xcf0048 | out: hHeap=0x130000) returned 1 [0072.319] GetProcessHeap () returned 0x130000 [0072.319] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xcf0048 [0072.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f918 [0072.491] GetProcessHeap () returned 0x130000 [0072.491] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x223c89ad, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93a9ec0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0072.494] GetProcessHeap () returned 0x130000 [0072.495] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93abe68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x228b384c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.496] GetProcessHeap () returned 0x130000 [0072.496] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.496] GetProcessHeap () returned 0x130000 [0072.496] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa94b581e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2310be20, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.504] GetProcessHeap () returned 0x130000 [0072.504] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0072.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95725d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a0ae1c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0072.714] GetProcessHeap () returned 0x130000 [0072.714] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0072.714] GetProcessHeap () returned 0x130000 [0072.714] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0072.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95a0375, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a572ca, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0072.732] GetProcessHeap () returned 0x130000 [0072.732] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0072.768] GetProcessHeap () returned 0x130000 [0072.768] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.769] GetProcessHeap () returned 0x130000 [0072.769] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967b88f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2313207f, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0072.772] GetProcessHeap () returned 0x130000 [0072.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.772] GetProcessHeap () returned 0x130000 [0072.772] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3002ee68, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967c915, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.774] GetProcessHeap () returned 0x130000 [0072.774] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.774] GetProcessHeap () returned 0x130000 [0072.774] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.774] GetProcessHeap () returned 0x130000 [0072.774] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0072.775] GetProcessHeap () returned 0x130000 [0072.775] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.775] GetProcessHeap () returned 0x130000 [0072.775] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0072.777] GetProcessHeap () returned 0x130000 [0072.777] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9730ad4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0072.777] GetProcessHeap () returned 0x130000 [0072.777] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.777] GetProcessHeap () returned 0x130000 [0072.777] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0072.779] GetProcessHeap () returned 0x130000 [0072.779] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0072.779] GetProcessHeap () returned 0x130000 [0072.779] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0072.780] GetProcessHeap () returned 0x130000 [0072.780] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0072.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0072.795] GetProcessHeap () returned 0x130000 [0072.795] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0072.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9785683, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0073.161] GetProcessHeap () returned 0x130000 [0073.171] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.179] GetProcessHeap () returned 0x130000 [0073.179] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa97d9a35, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0073.182] GetProcessHeap () returned 0x130000 [0073.182] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a3eee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970877d7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0073.186] GetProcessHeap () returned 0x130000 [0073.186] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.186] GetProcessHeap () returned 0x130000 [0073.186] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0073.186] GetProcessHeap () returned 0x130000 [0073.186] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0073.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a634d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0073.187] GetProcessHeap () returned 0x130000 [0073.187] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0073.187] GetProcessHeap () returned 0x130000 [0073.187] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0073.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.187] GetProcessHeap () returned 0x130000 [0073.187] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0073.187] GetProcessHeap () returned 0x130000 [0073.187] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.188] GetProcessHeap () returned 0x130000 [0073.188] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0073.216] GetProcessHeap () returned 0x130000 [0073.217] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.217] GetProcessHeap () returned 0x130000 [0073.217] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.217] GetProcessHeap () returned 0x130000 [0073.217] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.217] GetProcessHeap () returned 0x130000 [0073.217] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9987cd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0073.221] GetProcessHeap () returned 0x130000 [0073.221] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.221] GetProcessHeap () returned 0x130000 [0073.221] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998957e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972da738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.221] GetProcessHeap () returned 0x130000 [0073.221] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.221] GetProcessHeap () returned 0x130000 [0073.221] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998a0eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0073.222] GetProcessHeap () returned 0x130000 [0073.222] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0073.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a18213, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9739a738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.225] GetProcessHeap () returned 0x130000 [0073.225] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0073.225] GetProcessHeap () returned 0x130000 [0073.225] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0073.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0073.228] GetProcessHeap () returned 0x130000 [0073.228] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0073.228] GetProcessHeap () returned 0x130000 [0073.228] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.228] GetProcessHeap () returned 0x130000 [0073.228] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa16f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x975664ea, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0073.399] GetProcessHeap () returned 0x130000 [0073.399] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.399] GetProcessHeap () returned 0x130000 [0073.399] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0073.399] GetProcessHeap () returned 0x130000 [0073.399] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.399] GetProcessHeap () returned 0x130000 [0073.399] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b12d9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0073.402] GetProcessHeap () returned 0x130000 [0073.402] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.402] GetProcessHeap () returned 0x130000 [0073.402] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0073.404] GetProcessHeap () returned 0x130000 [0073.404] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0073.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976e822e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd111d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x977346e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0073.406] GetProcessHeap () returned 0x130000 [0073.406] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0073.406] GetProcessHeap () returned 0x130000 [0073.406] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.407] GetProcessHeap () returned 0x130000 [0073.407] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.407] GetProcessHeap () returned 0x130000 [0073.407] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd24bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.407] GetProcessHeap () returned 0x130000 [0073.407] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.407] GetProcessHeap () returned 0x130000 [0073.407] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0073.408] GetProcessHeap () returned 0x130000 [0073.408] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.408] GetProcessHeap () returned 0x130000 [0073.408] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0073.408] GetProcessHeap () returned 0x130000 [0073.409] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0073.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0073.410] GetProcessHeap () returned 0x130000 [0073.410] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cb9e99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0073.411] GetProcessHeap () returned 0x130000 [0073.411] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.411] GetProcessHeap () returned 0x130000 [0073.411] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cba947, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.412] GetProcessHeap () returned 0x130000 [0073.412] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.412] GetProcessHeap () returned 0x130000 [0073.412] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb4a05954, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0073.412] GetProcessHeap () returned 0x130000 [0073.412] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0073.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0073.765] GetProcessHeap () returned 0x130000 [0073.765] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0073.766] GetProcessHeap () returned 0x130000 [0073.766] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.766] GetProcessHeap () returned 0x130000 [0073.766] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0073.767] GetProcessHeap () returned 0x130000 [0073.767] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0073.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0073.769] GetProcessHeap () returned 0x130000 [0073.769] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e44ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0073.769] GetProcessHeap () returned 0x130000 [0073.770] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.770] GetProcessHeap () returned 0x130000 [0073.770] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e45833, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0073.770] GetProcessHeap () returned 0x130000 [0073.770] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.770] GetProcessHeap () returned 0x130000 [0073.770] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb523798b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0073.771] GetProcessHeap () returned 0x130000 [0073.771] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0073.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.771] GetProcessHeap () returned 0x130000 [0073.771] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0073.772] GetProcessHeap () returned 0x130000 [0073.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.772] GetProcessHeap () returned 0x130000 [0073.772] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0073.772] GetProcessHeap () returned 0x130000 [0073.773] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0073.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0073.775] GetProcessHeap () returned 0x130000 [0073.775] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2be01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0073.776] GetProcessHeap () returned 0x130000 [0073.776] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.776] GetProcessHeap () returned 0x130000 [0073.776] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2cc20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0073.779] GetProcessHeap () returned 0x130000 [0073.779] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.779] GetProcessHeap () returned 0x130000 [0073.779] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0073.779] GetProcessHeap () returned 0x130000 [0073.779] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0073.779] GetProcessHeap () returned 0x130000 [0073.779] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0073.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0073.781] GetProcessHeap () returned 0x130000 [0073.781] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0073.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0074.120] GetProcessHeap () returned 0x130000 [0074.120] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0074.120] GetProcessHeap () returned 0x130000 [0074.120] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.121] GetProcessHeap () returned 0x130000 [0074.121] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0074.121] GetProcessHeap () returned 0x130000 [0074.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0074.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0074.267] GetProcessHeap () returned 0x130000 [0074.267] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa04335f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0074.267] GetProcessHeap () returned 0x130000 [0074.267] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.267] GetProcessHeap () returned 0x130000 [0074.267] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0074.268] GetProcessHeap () returned 0x130000 [0074.268] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.268] GetProcessHeap () returned 0x130000 [0074.268] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0074.268] GetProcessHeap () returned 0x130000 [0074.268] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0074.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0074.316] GetProcessHeap () returned 0x130000 [0074.316] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa096b21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0074.317] GetProcessHeap () returned 0x130000 [0074.317] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.317] GetProcessHeap () returned 0x130000 [0074.317] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eed6166, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa097114, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0074.317] GetProcessHeap () returned 0x130000 [0074.317] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.317] GetProcessHeap () returned 0x130000 [0074.317] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0074.318] GetProcessHeap () returned 0x130000 [0074.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0074.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0074.330] GetProcessHeap () returned 0x130000 [0074.330] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa098c51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0074.330] GetProcessHeap () returned 0x130000 [0074.330] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.330] GetProcessHeap () returned 0x130000 [0074.330] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0991e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0074.331] GetProcessHeap () returned 0x130000 [0074.331] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0074.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0074.335] GetProcessHeap () returned 0x130000 [0074.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0074.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0df02e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0074.350] GetProcessHeap () returned 0x130000 [0074.350] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0074.351] GetProcessHeap () returned 0x130000 [0074.351] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0074.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0074.641] GetProcessHeap () returned 0x130000 [0074.641] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0074.641] GetProcessHeap () returned 0x130000 [0074.641] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0074.642] GetProcessHeap () returned 0x130000 [0074.642] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.642] GetProcessHeap () returned 0x130000 [0074.642] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa1412e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0074.643] SetEvent (hEvent=0x2cc) returned 1 [0074.643] ResetEvent (hEvent=0x2d0) returned 1 [0074.643] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0074.643] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0074.643] GetProcessHeap () returned 0x130000 [0074.643] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0074.643] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsonResources", cAlternateFileName="JSONRE~1")) returned 1 [0074.643] GetProcessHeap () returned 0x130000 [0074.643] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0074.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0075.163] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.163] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="AboutLinks.json", cAlternateFileName="")) returned 1 [0075.163] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4b1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrencyInfo.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x32a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultCurrencyLoc.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultFromToCurrency.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExchangeDetails.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x36cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExchangesInfo.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d73, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketsInfo.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NumberFormattingInfo.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolsDefaultData.json", cAlternateFileName="")) returned 1 [0075.297] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 1 [0075.298] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 0 [0075.298] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0075.299] GetProcessHeap () returned 0x130000 [0075.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0075.299] GetProcessHeap () returned 0x130000 [0075.299] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0075.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0075.304] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.304] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776cf25e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0075.304] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0075.304] GetProcessHeap () returned 0x130000 [0075.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0075.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0075.305] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.306] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776f534b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1 [0075.306] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776f534b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 0 [0075.306] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0075.306] GetProcessHeap () returned 0x130000 [0075.306] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0075.306] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0075.306] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0075.306] GetProcessHeap () returned 0x130000 [0075.306] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776cf25e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776cf25e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776cf25e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x776f534b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7771b5a1, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7774199d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7774199d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7774199d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7774199d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7774199d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbda000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Money.dll", cAlternateFileName="")) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Money.exe", cAlternateFileName="")) returned 1 [0075.307] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1 [0075.307] GetProcessHeap () returned 0x130000 [0075.307] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0075.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0075.308] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.308] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1 [0075.308] GetProcessHeap () returned 0x130000 [0075.308] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0075.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0075.309] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.309] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1 [0075.309] GetProcessHeap () returned 0x130000 [0075.309] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0075.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0075.355] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.355] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28d627, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance", cAlternateFileName="")) returned 1 [0075.355] GetProcessHeap () returned 0x130000 [0075.355] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28d627, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0075.355] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28d627, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.355] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 1 [0075.355] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 0 [0075.355] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0075.356] GetProcessHeap () returned 0x130000 [0075.356] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.356] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0075.356] GetProcessHeap () returned 0x130000 [0075.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0075.356] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.356] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 1 [0075.356] FindNextFileW (in: hFindFile=0x18f698, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 0 [0075.356] FindClose (in: hFindFile=0x18f698 | out: hFindFile=0x18f698) returned 1 [0075.356] GetProcessHeap () returned 0x130000 [0075.356] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.356] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0075.356] GetProcessHeap () returned 0x130000 [0075.356] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0075.357] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.357] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 1 [0075.357] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 0 [0075.357] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0075.357] GetProcessHeap () returned 0x130000 [0075.357] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.357] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0075.357] GetProcessHeap () returned 0x130000 [0075.357] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0075.358] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.358] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 1 [0075.358] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77b93d5c, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 0 [0075.358] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0075.358] GetProcessHeap () returned 0x130000 [0075.358] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.358] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0075.358] GetProcessHeap () returned 0x130000 [0075.358] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0075.358] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 0 [0075.359] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0075.359] GetProcessHeap () returned 0x130000 [0075.359] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0075.359] GetProcessHeap () returned 0x130000 [0075.359] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0075.359] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 0 [0075.359] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0075.359] GetProcessHeap () returned 0x130000 [0075.359] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.359] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0075.359] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0075.360] GetProcessHeap () returned 0x130000 [0075.360] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0075.360] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0075.360] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0075.360] GetProcessHeap () returned 0x130000 [0075.360] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0075.361] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0075.361] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0075.361] GetProcessHeap () returned 0x130000 [0075.361] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0075.362] GetProcessHeap () returned 0x130000 [0075.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0075.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0075.362] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0075.362] GetProcessHeap () returned 0x130000 [0075.362] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0075.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0075.364] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.364] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1 [0075.364] GetProcessHeap () returned 0x130000 [0075.364] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0075.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0075.364] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.364] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0075.364] GetProcessHeap () returned 0x130000 [0075.364] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0075.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0075.364] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.364] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1 [0075.364] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1 [0075.365] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 0 [0075.365] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0075.365] GetProcessHeap () returned 0x130000 [0075.365] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0075.365] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0075.365] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0075.365] GetProcessHeap () returned 0x130000 [0075.365] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0075.365] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0075.365] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0075.365] GetProcessHeap () returned 0x130000 [0075.365] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0075.366] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0075.366] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0075.366] GetProcessHeap () returned 0x130000 [0075.366] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.367] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0075.367] GetProcessHeap () returned 0x130000 [0075.367] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0075.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0075.369] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.369] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.369] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0075.369] GetProcessHeap () returned 0x130000 [0075.369] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.369] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0075.369] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0075.369] GetProcessHeap () returned 0x130000 [0075.369] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0075.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0075.669] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.669] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0075.669] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0075.669] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0075.669] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0075.670] GetProcessHeap () returned 0x130000 [0075.670] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77c2c6ee, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdee88, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c2c6ee, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77c2c6ee, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77c78b89, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c78b89, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77c78b89, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77c78b89, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0075.670] GetProcessHeap () returned 0x130000 [0075.670] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0075.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0075.670] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0075.670] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0075.671] FindNextFileW (in: hFindFile=0x18fc98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0075.671] FindClose (in: hFindFile=0x18fc98 | out: hFindFile=0x18fc98) returned 1 [0075.671] GetProcessHeap () returned 0x130000 [0075.671] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0075.671] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0075.671] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0075.671] GetProcessHeap () returned 0x130000 [0075.671] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0075.671] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIADDF~1.0_N")) returned 1 [0075.672] GetProcessHeap () returned 0x130000 [0075.672] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0075.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0076.022] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70454cf5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0076.022] GetProcessHeap () returned 0x130000 [0076.022] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0076.023] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70454cf5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x643a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70454cf5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x643a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0076.023] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0076.023] GetProcessHeap () returned 0x130000 [0076.023] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047af3f, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7047af3f, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7047af3f, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2967, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0076.023] GetProcessHeap () returned 0x130000 [0076.023] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0076.023] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.024] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.024] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0076.024] GetProcessHeap () returned 0x130000 [0076.024] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.024] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0076.024] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0076.024] GetProcessHeap () returned 0x130000 [0076.024] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0076.024] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI13A6~1.0_X")) returned 1 [0076.025] GetProcessHeap () returned 0x130000 [0076.025] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0076.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.027] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.028] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x502d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1 [0076.028] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0076.028] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0076.028] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0076.028] GetProcessHeap () returned 0x130000 [0076.028] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0076.029] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.029] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0076.029] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0076.029] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0076.032] GetProcessHeap () returned 0x130000 [0076.032] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.032] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0076.032] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0076.032] GetProcessHeap () returned 0x130000 [0076.032] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0076.032] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.032] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0076.033] GetProcessHeap () returned 0x130000 [0076.033] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0076.034] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.034] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0076.035] GetProcessHeap () returned 0x130000 [0076.035] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0076.036] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0076.037] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.037] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.037] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.037] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0076.037] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0076.037] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0076.038] GetProcessHeap () returned 0x130000 [0076.038] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.038] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0076.038] GetProcessHeap () returned 0x130000 [0076.038] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x372, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704c73fb, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0076.040] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0076.040] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0076.041] GetProcessHeap () returned 0x130000 [0076.041] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.041] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0076.041] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0076.041] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0076.041] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0076.041] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0076.042] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 0 [0076.042] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0076.042] GetProcessHeap () returned 0x130000 [0076.042] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.043] FindNextFileW (in: hFindFile=0x18f798, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0076.043] FindClose (in: hFindFile=0x18f798 | out: hFindFile=0x18f798) returned 1 [0076.043] GetProcessHeap () returned 0x130000 [0076.043] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.043] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0076.043] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0076.043] GetProcessHeap () returned 0x130000 [0076.043] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0076.043] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.043] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1 [0076.044] SetEvent (hEvent=0x2cc) returned 1 [0076.044] ResetEvent (hEvent=0x2d0) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0076.044] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0076.044] GetProcessHeap () returned 0x130000 [0076.044] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9572, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0076.044] GetProcessHeap () returned 0x130000 [0076.044] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0076.044] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0076.044] GetProcessHeap () returned 0x130000 [0076.044] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0076.045] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.045] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1 [0076.045] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 0 [0076.045] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0076.045] GetProcessHeap () returned 0x130000 [0076.045] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.045] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0076.046] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0076.046] GetProcessHeap () returned 0x130000 [0076.046] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70585fca, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70585fca, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70585fca, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705ac224, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa20e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.News.dll", cAlternateFileName="")) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.News.exe", cAlternateFileName="")) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1 [0076.047] GetProcessHeap () returned 0x130000 [0076.047] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0076.049] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.049] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1 [0076.049] GetProcessHeap () returned 0x130000 [0076.049] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0076.050] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.050] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1 [0076.050] GetProcessHeap () returned 0x130000 [0076.050] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0076.052] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.052] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45dd3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance", cAlternateFileName="")) returned 1 [0076.052] GetProcessHeap () returned 0x130000 [0076.052] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45dd3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0076.053] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45dd3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.053] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 1 [0076.053] FindNextFileW (in: hFindFile=0x18f8d8, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 0 [0076.053] FindClose (in: hFindFile=0x18f8d8 | out: hFindFile=0x18f8d8) returned 1 [0076.053] GetProcessHeap () returned 0x130000 [0076.053] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.053] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0076.053] GetProcessHeap () returned 0x130000 [0076.053] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc18 [0076.054] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.054] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 1 [0076.055] FindNextFileW (in: hFindFile=0x18fc18, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 0 [0076.055] FindClose (in: hFindFile=0x18fc18 | out: hFindFile=0x18fc18) returned 1 [0076.055] GetProcessHeap () returned 0x130000 [0076.055] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.055] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0076.055] GetProcessHeap () returned 0x130000 [0076.055] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0076.056] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.056] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 1 [0076.056] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 0 [0076.056] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0076.056] GetProcessHeap () returned 0x130000 [0076.056] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.056] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0076.056] GetProcessHeap () returned 0x130000 [0076.056] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0076.057] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.057] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 1 [0076.057] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 0 [0076.057] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0076.057] GetProcessHeap () returned 0x130000 [0076.057] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.057] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0076.057] GetProcessHeap () returned 0x130000 [0076.057] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0076.057] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.057] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 1 [0076.058] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7074fc08, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 0 [0076.058] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0076.058] GetProcessHeap () returned 0x130000 [0076.058] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.058] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0076.058] GetProcessHeap () returned 0x130000 [0076.058] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.262] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.262] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 1 [0076.262] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 0 [0076.262] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0076.262] GetProcessHeap () returned 0x130000 [0076.262] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.262] FindNextFileW (in: hFindFile=0x18fb58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0076.262] FindClose (in: hFindFile=0x18fb58 | out: hFindFile=0x18fb58) returned 1 [0076.262] GetProcessHeap () returned 0x130000 [0076.262] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.263] FindNextFileW (in: hFindFile=0x18fd58, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0076.263] FindClose (in: hFindFile=0x18fd58 | out: hFindFile=0x18fd58) returned 1 [0076.263] GetProcessHeap () returned 0x130000 [0076.263] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.264] FindNextFileW (in: hFindFile=0x18f898, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0076.264] FindClose (in: hFindFile=0x18f898 | out: hFindFile=0x18f898) returned 1 [0076.264] GetProcessHeap () returned 0x130000 [0076.264] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.265] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0076.265] GetProcessHeap () returned 0x130000 [0076.265] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0076.265] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.265] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0076.265] GetProcessHeap () returned 0x130000 [0076.265] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.266] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.267] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1 [0076.267] GetProcessHeap () returned 0x130000 [0076.267] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0076.268] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.268] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0076.268] GetProcessHeap () returned 0x130000 [0076.268] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.268] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.268] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1 [0076.269] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1 [0076.269] FindNextFileW (in: hFindFile=0x18f958, lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 0 [0076.269] FindClose (in: hFindFile=0x18f958 | out: hFindFile=0x18f958) returned 1 [0076.269] GetProcessHeap () returned 0x130000 [0076.269] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.269] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0076.269] FindClose (in: hFindFile=0x18f9d8 | out: hFindFile=0x18f9d8) returned 1 [0076.269] GetProcessHeap () returned 0x130000 [0076.269] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.269] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0076.270] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0076.270] GetProcessHeap () returned 0x130000 [0076.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.270] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0076.270] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0076.270] GetProcessHeap () returned 0x130000 [0076.270] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.271] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0076.271] GetProcessHeap () returned 0x130000 [0076.271] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0076.273] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.273] FindNextFileW (in: hFindFile=0x18fa58, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.273] FindClose (in: hFindFile=0x18fa58 | out: hFindFile=0x18fa58) returned 1 [0076.273] GetProcessHeap () returned 0x130000 [0076.273] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.273] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0076.273] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0076.273] GetProcessHeap () returned 0x130000 [0076.273] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0076.273] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.273] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0076.273] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0076.273] FindNextFileW (in: hFindFile=0x18fa98, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0076.273] FindClose (in: hFindFile=0x18fa98 | out: hFindFile=0x18fa98) returned 1 [0076.273] GetProcessHeap () returned 0x130000 [0076.273] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7079c0bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6c528, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079c0bc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7079c0bc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x707c2312, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c2312, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x707c2312, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x707c2312, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0076.274] GetProcessHeap () returned 0x130000 [0076.274] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0076.274] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18f818, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0076.274] FindClose (in: hFindFile=0x18f818 | out: hFindFile=0x18f818) returned 1 [0076.274] GetProcessHeap () returned 0x130000 [0076.274] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.274] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0076.275] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0076.275] GetProcessHeap () returned 0x130000 [0076.275] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0076.275] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI90D7~1.0_N")) returned 1 [0076.275] GetProcessHeap () returned 0x130000 [0076.275] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0076.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0076.277] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.277] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c254236, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0076.277] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0076.277] GetProcessHeap () returned 0x130000 [0076.277] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.277] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.277] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c254236, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x650b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0076.277] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c254236, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x650b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0076.277] FindClose (in: hFindFile=0x18fa18 | out: hFindFile=0x18fa18) returned 1 [0076.277] GetProcessHeap () returned 0x130000 [0076.277] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.277] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c27a365, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c27a365, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c27a365, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0076.277] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0076.278] GetProcessHeap () returned 0x130000 [0076.278] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0076.278] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.278] FindNextFileW (in: hFindFile=0x18f618, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.278] FindClose (in: hFindFile=0x18f618 | out: hFindFile=0x18f618) returned 1 [0076.278] GetProcessHeap () returned 0x130000 [0076.278] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.278] FindNextFileW (in: hFindFile=0x18f758, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0076.278] FindClose (in: hFindFile=0x18f758 | out: hFindFile=0x18f758) returned 1 [0076.278] GetProcessHeap () returned 0x130000 [0076.278] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0076.279] FindNextFileW (in: hFindFile=0x18f918, lpFindFileData=0x347efe0 | out: lpFindFileData=0x347efe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI689D~1.0_X")) returned 1 [0076.279] GetProcessHeap () returned 0x130000 [0076.279] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0076.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0076.280] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.281] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x11251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1 [0076.281] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7730, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0076.281] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2a05a2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2088, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0076.281] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0076.281] GetProcessHeap () returned 0x130000 [0076.281] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0076.282] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.282] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0076.282] FindNextFileW (in: hFindFile=0x18f718, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0076.282] FindClose (in: hFindFile=0x18f718 | out: hFindFile=0x18f718) returned 1 [0076.282] GetProcessHeap () returned 0x130000 [0076.282] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.282] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0076.282] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0076.283] GetProcessHeap () returned 0x130000 [0076.283] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0076.283] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.283] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d4131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0076.283] GetProcessHeap () returned 0x130000 [0076.283] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d4131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0076.285] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d4131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.285] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa66b57d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0076.285] GetProcessHeap () returned 0x130000 [0076.285] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa66b57d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa66b57d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x990, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x669, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.287] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.288] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eca57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2eca57, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2eca57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.288] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0076.288] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0076.288] FindClose (in: hFindFile=0x18f5d8 | out: hFindFile=0x18f5d8) returned 1 [0076.288] GetProcessHeap () returned 0x130000 [0076.288] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.288] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0076.289] GetProcessHeap () returned 0x130000 [0076.289] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0076.291] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x714, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0076.291] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.291] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c312cbd, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.291] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.291] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0076.291] FindNextFileW (in: hFindFile=0x18fc58, lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0076.291] FindClose (in: hFindFile=0x18fc58 | out: hFindFile=0x18fc58) returned 1 [0076.292] GetProcessHeap () returned 0x130000 [0076.292] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x990, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x669, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0076.292] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 0 [0076.293] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0076.293] GetProcessHeap () returned 0x130000 [0076.293] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.293] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 1 [0076.293] FindNextFileW (in: hFindFile=0x18f658, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 0 [0076.293] FindClose (in: hFindFile=0x18f658 | out: hFindFile=0x18f658) returned 1 [0076.293] GetProcessHeap () returned 0x130000 [0076.293] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.293] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0076.294] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0076.294] GetProcessHeap () returned 0x130000 [0076.294] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0076.294] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.294] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x23c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1 [0076.294] SetEvent (hEvent=0x2cc) returned 1 [0076.294] ResetEvent (hEvent=0x2d0) returned 1 [0076.294] FindNextFileW (in: hFindFile=0x18fb18, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x23c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 0 [0076.294] FindClose (in: hFindFile=0x18fb18 | out: hFindFile=0x18fb18) returned 1 [0076.294] GetProcessHeap () returned 0x130000 [0076.294] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.294] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x5ab7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0076.294] FindNextFileW (in: hFindFile=0x18f9d8, lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0076.294] GetProcessHeap () returned 0x130000 [0076.294] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0076.296] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.296] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c490576, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1 [0076.296] FindNextFileW (in: hFindFile=0x18f5d8, lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0076.296] GetProcessHeap () returned 0x130000 [0076.296] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.297] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.297] FindNextFileW (in: hFindFile=0x18fa18, lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c490576, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1 [0076.299] GetProcessHeap () returned 0x130000 [0076.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.299] GetProcessHeap () returned 0x130000 [0076.299] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.300] GetProcessHeap () returned 0x130000 [0076.300] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c5add, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0076.300] GetProcessHeap () returned 0x130000 [0076.300] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0076.301] GetProcessHeap () returned 0x130000 [0076.301] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73b0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73c941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73d444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73dce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.304] GetProcessHeap () returned 0x130000 [0076.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.305] GetProcessHeap () returned 0x130000 [0076.305] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.305] GetProcessHeap () returned 0x130000 [0076.305] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73ed8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.305] GetProcessHeap () returned 0x130000 [0076.305] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.305] GetProcessHeap () returned 0x130000 [0076.305] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.306] GetProcessHeap () returned 0x130000 [0076.306] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.306] GetProcessHeap () returned 0x130000 [0076.306] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.306] GetProcessHeap () returned 0x130000 [0076.306] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.307] GetProcessHeap () returned 0x130000 [0076.307] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.307] GetProcessHeap () returned 0x130000 [0076.307] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.308] GetProcessHeap () returned 0x130000 [0076.308] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb58 [0076.309] GetProcessHeap () returned 0x130000 [0076.309] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0076.309] GetProcessHeap () returned 0x130000 [0076.309] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.310] GetProcessHeap () returned 0x130000 [0076.310] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.310] GetProcessHeap () returned 0x130000 [0076.310] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.310] GetProcessHeap () returned 0x130000 [0076.310] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.311] GetProcessHeap () returned 0x130000 [0076.311] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.311] GetProcessHeap () returned 0x130000 [0076.311] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.312] GetProcessHeap () returned 0x130000 [0076.312] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.312] GetProcessHeap () returned 0x130000 [0076.312] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0076.313] GetProcessHeap () returned 0x130000 [0076.313] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.313] GetProcessHeap () returned 0x130000 [0076.313] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0076.314] GetProcessHeap () returned 0x130000 [0076.314] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0076.314] GetProcessHeap () returned 0x130000 [0076.314] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.315] GetProcessHeap () returned 0x130000 [0076.315] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.315] GetProcessHeap () returned 0x130000 [0076.315] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0076.316] GetProcessHeap () returned 0x130000 [0076.316] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.316] GetProcessHeap () returned 0x130000 [0076.316] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0076.316] GetProcessHeap () returned 0x130000 [0076.316] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0076.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0076.318] GetProcessHeap () returned 0x130000 [0076.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0076.318] GetProcessHeap () returned 0x130000 [0076.318] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f9d8 [0076.320] GetProcessHeap () returned 0x130000 [0076.320] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa84e071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.323] GetProcessHeap () returned 0x130000 [0076.323] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.323] GetProcessHeap () returned 0x130000 [0076.323] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.326] GetProcessHeap () returned 0x130000 [0076.326] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0076.327] GetProcessHeap () returned 0x130000 [0076.327] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.331] GetProcessHeap () returned 0x130000 [0076.331] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.331] GetProcessHeap () returned 0x130000 [0076.331] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0076.332] GetProcessHeap () returned 0x130000 [0076.332] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.332] GetProcessHeap () returned 0x130000 [0076.332] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0076.332] GetProcessHeap () returned 0x130000 [0076.332] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0076.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0076.335] GetProcessHeap () returned 0x130000 [0076.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0076.335] GetProcessHeap () returned 0x130000 [0076.335] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.335] GetProcessHeap () returned 0x130000 [0076.335] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd23078 [0076.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0076.336] GetProcessHeap () returned 0x130000 [0076.336] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd23078 | out: hHeap=0x130000) returned 1 [0076.336] GetProcessHeap () returned 0x130000 [0076.336] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0076.337] GetProcessHeap () returned 0x130000 [0076.337] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0076.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0076.758] GetProcessHeap () returned 0x130000 [0076.758] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.759] GetProcessHeap () returned 0x130000 [0076.759] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0076.759] GetProcessHeap () returned 0x130000 [0076.759] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0076.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0076.760] GetProcessHeap () returned 0x130000 [0076.760] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0076.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9d2e10, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0076.761] GetProcessHeap () returned 0x130000 [0076.761] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa1d3b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0076.763] GetProcessHeap () returned 0x130000 [0076.763] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.763] GetProcessHeap () returned 0x130000 [0076.763] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa975ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0076.766] GetProcessHeap () returned 0x130000 [0076.766] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.766] GetProcessHeap () returned 0x130000 [0076.766] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaac88c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f798 [0076.768] GetProcessHeap () returned 0x130000 [0076.768] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.768] GetProcessHeap () returned 0x130000 [0076.768] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabbfeb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0076.770] GetProcessHeap () returned 0x130000 [0076.770] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.770] GetProcessHeap () returned 0x130000 [0076.770] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabc1237, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0076.771] GetProcessHeap () returned 0x130000 [0076.771] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0076.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac222e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0076.776] GetProcessHeap () returned 0x130000 [0076.776] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0076.776] GetProcessHeap () returned 0x130000 [0076.776] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0076.776] GetProcessHeap () returned 0x130000 [0076.776] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0076.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac23e3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9f144d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f618 [0076.777] GetProcessHeap () returned 0x130000 [0076.777] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0076.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaca3951, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9cb1f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0076.779] GetProcessHeap () returned 0x130000 [0076.779] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0076.779] GetProcessHeap () returned 0x130000 [0076.779] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0076.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9f144d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad0c763, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db303c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0077.111] GetProcessHeap () returned 0x130000 [0077.111] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0077.111] GetProcessHeap () returned 0x130000 [0077.111] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0077.111] GetProcessHeap () returned 0x130000 [0077.111] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.112] GetProcessHeap () returned 0x130000 [0077.112] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2db7c876, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad78aac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0077.115] GetProcessHeap () returned 0x130000 [0077.115] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.115] GetProcessHeap () returned 0x130000 [0077.115] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.116] GetProcessHeap () returned 0x130000 [0077.116] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad79c2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0077.117] GetProcessHeap () returned 0x130000 [0077.117] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.117] GetProcessHeap () returned 0x130000 [0077.117] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7a6fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0077.117] GetProcessHeap () returned 0x130000 [0077.117] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.117] GetProcessHeap () returned 0x130000 [0077.117] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ad84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd2927f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa58 [0077.118] GetProcessHeap () returned 0x130000 [0077.118] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.118] GetProcessHeap () returned 0x130000 [0077.118] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7b5bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa98 [0077.121] GetProcessHeap () returned 0x130000 [0077.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7c2d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0077.121] GetProcessHeap () returned 0x130000 [0077.121] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0077.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7cee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0077.121] GetProcessHeap () returned 0x130000 [0077.121] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0077.121] GetProcessHeap () returned 0x130000 [0077.121] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.122] GetProcessHeap () returned 0x130000 [0077.122] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.122] GetProcessHeap () returned 0x130000 [0077.122] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7d91e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fcd8 [0077.122] GetProcessHeap () returned 0x130000 [0077.122] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7e777, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0077.124] GetProcessHeap () returned 0x130000 [0077.124] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x813778 [0077.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x347e5c0 | out: lpFindFileData=0x347e5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7f48f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0077.124] GetProcessHeap () returned 0x130000 [0077.124] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x823f88 [0077.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x347e338 | out: lpFindFileData=0x347e338*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ff09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd75732, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0077.125] GetProcessHeap () returned 0x130000 [0077.125] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x823f88 | out: hHeap=0x130000) returned 1 [0077.125] GetProcessHeap () returned 0x130000 [0077.125] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x813778 | out: hHeap=0x130000) returned 1 [0077.125] GetProcessHeap () returned 0x130000 [0077.125] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.126] GetProcessHeap () returned 0x130000 [0077.126] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.127] GetProcessHeap () returned 0x130000 [0077.127] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x2d31f11, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2d31f11, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0077.127] GetProcessHeap () returned 0x130000 [0077.127] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.127] GetProcessHeap () returned 0x130000 [0077.127] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9368ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d1965e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0077.128] GetProcessHeap () returned 0x130000 [0077.128] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.128] GetProcessHeap () returned 0x130000 [0077.128] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.129] GetProcessHeap () returned 0x130000 [0077.129] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0077.131] GetProcessHeap () returned 0x130000 [0077.131] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3d897, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0077.134] GetProcessHeap () returned 0x130000 [0077.134] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.134] GetProcessHeap () returned 0x130000 [0077.134] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0077.134] GetProcessHeap () returned 0x130000 [0077.134] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.134] GetProcessHeap () returned 0x130000 [0077.134] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.135] GetProcessHeap () returned 0x130000 [0077.135] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0077.137] GetProcessHeap () returned 0x130000 [0077.137] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebe349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0077.138] GetProcessHeap () returned 0x130000 [0077.138] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.138] GetProcessHeap () returned 0x130000 [0077.138] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaaebeeeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f698 [0077.138] GetProcessHeap () returned 0x130000 [0077.138] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.138] GetProcessHeap () returned 0x130000 [0077.138] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.146] GetProcessHeap () returned 0x130000 [0077.147] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f7d8 [0077.148] GetProcessHeap () returned 0x130000 [0077.148] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf18f1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f818 [0077.149] GetProcessHeap () returned 0x130000 [0077.149] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.149] GetProcessHeap () returned 0x130000 [0077.149] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaafbd2f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68bca1ad, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0077.300] GetProcessHeap () returned 0x130000 [0077.300] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.300] GetProcessHeap () returned 0x130000 [0077.300] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x134444f, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x134444f, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f958 [0077.302] GetProcessHeap () returned 0x130000 [0077.302] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.302] GetProcessHeap () returned 0x130000 [0077.302] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.303] GetProcessHeap () returned 0x130000 [0077.304] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fa18 [0077.308] GetProcessHeap () returned 0x130000 [0077.308] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab022752, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd526822a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0077.309] GetProcessHeap () returned 0x130000 [0077.309] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.309] GetProcessHeap () returned 0x130000 [0077.309] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab022fb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0077.309] GetProcessHeap () returned 0x130000 [0077.309] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.309] GetProcessHeap () returned 0x130000 [0077.309] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.310] GetProcessHeap () returned 0x130000 [0077.310] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f718 [0077.560] GetProcessHeap () returned 0x130000 [0077.560] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08a798, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0077.561] GetProcessHeap () returned 0x130000 [0077.561] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.561] GetProcessHeap () returned 0x130000 [0077.561] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08aff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f758 [0077.563] GetProcessHeap () returned 0x130000 [0077.563] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.563] GetProcessHeap () returned 0x130000 [0077.563] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08b876, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0077.564] GetProcessHeap () returned 0x130000 [0077.564] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08c849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0077.564] GetProcessHeap () returned 0x130000 [0077.564] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.564] GetProcessHeap () returned 0x130000 [0077.564] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08d12b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f658 [0077.565] GetProcessHeap () returned 0x130000 [0077.565] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.565] GetProcessHeap () returned 0x130000 [0077.565] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.565] GetProcessHeap () returned 0x130000 [0077.565] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0077.613] GetProcessHeap () returned 0x130000 [0077.613] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.613] GetProcessHeap () returned 0x130000 [0077.613] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08e5b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0077.613] GetProcessHeap () returned 0x130000 [0077.613] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08f2fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f5d8 [0077.613] GetProcessHeap () returned 0x130000 [0077.613] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.614] GetProcessHeap () returned 0x130000 [0077.614] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08fb6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f8d8 [0077.614] GetProcessHeap () returned 0x130000 [0077.614] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.614] GetProcessHeap () returned 0x130000 [0077.614] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.615] GetProcessHeap () returned 0x130000 [0077.615] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0077.619] GetProcessHeap () returned 0x130000 [0077.619] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.619] GetProcessHeap () returned 0x130000 [0077.619] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.620] GetProcessHeap () returned 0x130000 [0077.620] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fb18 [0077.622] GetProcessHeap () returned 0x130000 [0077.622] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab13f343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0077.624] GetProcessHeap () returned 0x130000 [0077.624] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1ce307, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0077.627] GetProcessHeap () returned 0x130000 [0077.627] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.627] GetProcessHeap () returned 0x130000 [0077.627] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x803770 [0077.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x347e848 | out: lpFindFileData=0x347e848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18f898 [0077.629] GetProcessHeap () returned 0x130000 [0077.629] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x803770 | out: hHeap=0x130000) returned 1 [0077.629] GetProcessHeap () returned 0x130000 [0077.629] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.630] GetProcessHeap () returned 0x130000 [0077.630] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fd58 [0077.631] GetProcessHeap () returned 0x130000 [0077.631] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.631] GetProcessHeap () returned 0x130000 [0077.631] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0xd12068 | out: hHeap=0x130000) returned 1 [0077.632] GetProcessHeap () returned 0x130000 [0077.632] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0xd12068 [0077.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x347ed58 | out: lpFindFileData=0x347ed58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc58 [0077.634] GetProcessHeap () returned 0x130000 [0077.634] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x347ead0 | out: lpFindFileData=0x347ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab228e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x18fc98 [0077.635] GetProcessHeap () returned 0x130000 [0077.635] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x7f3768 | out: hHeap=0x130000) returned 1 [0077.635] GetProcessHeap () returned 0x130000 [0077.635] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7f3768 [0077.635] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x347ead0) Thread: id = 25 os_tid = 0xdb4 [0050.145] GetProcessHeap () returned 0x130000 [0050.145] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x200df0 [0050.145] GetProcessHeap () returned 0x130000 [0050.145] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x210df8 [0051.480] GetProcessHeap () returned 0x130000 [0051.480] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x15bde0 [0051.480] GetProcessHeap () returned 0x130000 [0051.480] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x110102) returned 0xbda020 [0051.483] GetProcessHeap () returned 0x130000 [0051.483] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14eba0 [0051.483] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0051.483] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0051.483] Wow64DisableWow64FsRedirection (in: OldValue=0x35bf8c4 | out: OldValue=0x35bf8c4*=0x0) returned 1 [0051.483] GetProcessHeap () returned 0x130000 [0051.483] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14eba0 | out: hHeap=0x130000) returned 1 [0051.483] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.483] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.485] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.486] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.487] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.488] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.489] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.491] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.494] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.495] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.499] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.500] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.502] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0056.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0056.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.245] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0056.245] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0056.245] ReadFile (in: hFile=0x328, lpBuffer=0xbda058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bf6cc, lpOverlapped=0x0 | out: lpBuffer=0xbda058*, lpNumberOfBytesRead=0x35bf6cc*=0x40000, lpOverlapped=0x0) returned 1 [0056.252] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xaa000, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0056.252] ReadFile (in: hFile=0x328, lpBuffer=0xc1a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bf6cc, lpOverlapped=0x0 | out: lpBuffer=0xc1a058*, lpNumberOfBytesRead=0x35bf6cc*=0x40000, lpOverlapped=0x0) returned 1 [0056.261] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1be000, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0056.261] ReadFile (in: hFile=0x328, lpBuffer=0xc5a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bf6cc, lpOverlapped=0x0 | out: lpBuffer=0xc5a058*, lpNumberOfBytesRead=0x35bf6cc*=0x40000, lpOverlapped=0x0) returned 1 [0056.277] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf830 | out: lpNewFilePointer=0x0) returned 1 [0056.277] WriteFile (in: hFile=0x328, lpBuffer=0xbda020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x35bf828, lpOverlapped=0x0 | out: lpBuffer=0xbda020*, lpNumberOfBytesWritten=0x35bf828*=0xc0112, lpOverlapped=0x0) returned 1 [0056.691] SetEndOfFile (hFile=0x328) returned 1 [0056.695] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1be000, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c8 | out: lpNewFilePointer=0x0) returned 1 [0056.696] WriteFile (in: hFile=0x328, lpBuffer=0xc9a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bf6d4, lpOverlapped=0x0 | out: lpBuffer=0xc9a14a*, lpNumberOfBytesWritten=0x35bf6d4*=0x40000, lpOverlapped=0x0) returned 1 [0056.698] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xaa000, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c8 | out: lpNewFilePointer=0x0) returned 1 [0056.698] WriteFile (in: hFile=0x328, lpBuffer=0xc9a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bf6d4, lpOverlapped=0x0 | out: lpBuffer=0xc9a14a*, lpNumberOfBytesWritten=0x35bf6d4*=0x40000, lpOverlapped=0x0) returned 1 [0056.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c8 | out: lpNewFilePointer=0x0) returned 1 [0056.700] WriteFile (in: hFile=0x328, lpBuffer=0xc9a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bf6d4, lpOverlapped=0x0 | out: lpBuffer=0xc9a14a*, lpNumberOfBytesWritten=0x35bf6d4*=0x40000, lpOverlapped=0x0) returned 1 [0056.701] CloseHandle (hObject=0x328) returned 1 [0057.483] ResetEvent (hEvent=0x2cc) returned 1 [0057.483] SetEvent (hEvent=0x2d0) returned 1 [0057.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.484] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x35bf870 | out: lpFileSize=0x35bf870*=11493376) returned 1 [0057.484] CloseHandle (hObject=0x328) returned 1 [0057.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde")) returned 0x220 [0057.484] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0057.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.485] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0057.485] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0057.485] ReadFile (in: hFile=0x328, lpBuffer=0xbda058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bf6cc, lpOverlapped=0x0 | out: lpBuffer=0xbda058*, lpNumberOfBytesRead=0x35bf6cc*=0x40000, lpOverlapped=0x0) returned 1 [0058.039] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x3a7555, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0058.039] ReadFile (in: hFile=0x328, lpBuffer=0xc1a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bf6cc, lpOverlapped=0x0 | out: lpBuffer=0xc1a058*, lpNumberOfBytesRead=0x35bf6cc*=0x40000, lpOverlapped=0x0) returned 1 [0058.050] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xab6000, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c0 | out: lpNewFilePointer=0x0) returned 1 [0058.050] ReadFile (in: hFile=0x328, lpBuffer=0xc5a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35bf6cc, lpOverlapped=0x0 | out: lpBuffer=0xc5a058*, lpNumberOfBytesRead=0x35bf6cc*=0x40000, lpOverlapped=0x0) returned 1 [0058.063] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf830 | out: lpNewFilePointer=0x0) returned 1 [0058.063] WriteFile (in: hFile=0x328, lpBuffer=0xbda020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x35bf828, lpOverlapped=0x0 | out: lpBuffer=0xbda020*, lpNumberOfBytesWritten=0x35bf828*=0xc0112, lpOverlapped=0x0) returned 1 [0058.081] SetEndOfFile (hFile=0x328) returned 1 [0058.082] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xab6000, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.082] WriteFile (in: hFile=0x328, lpBuffer=0xc9a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bf6d4, lpOverlapped=0x0 | out: lpBuffer=0xc9a14a*, lpNumberOfBytesWritten=0x35bf6d4*=0x40000, lpOverlapped=0x0) returned 1 [0058.084] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x3a7555, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.084] WriteFile (in: hFile=0x328, lpBuffer=0xc9a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bf6d4, lpOverlapped=0x0 | out: lpBuffer=0xc9a14a*, lpNumberOfBytesWritten=0x35bf6d4*=0x40000, lpOverlapped=0x0) returned 1 [0058.430] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35bf6c8 | out: lpNewFilePointer=0x0) returned 1 [0058.430] WriteFile (in: hFile=0x328, lpBuffer=0xc9a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35bf6d4, lpOverlapped=0x0 | out: lpBuffer=0xc9a14a*, lpNumberOfBytesWritten=0x35bf6d4*=0x40000, lpOverlapped=0x0) returned 1 [0058.431] CloseHandle (hObject=0x328) returned 1 [0061.050] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0074.646] ResetEvent (hEvent=0x2cc) returned 1 [0074.646] SetEvent (hEvent=0x2d0) returned 1 [0074.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0075.162] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x35bf870 | out: lpFileSize=0x35bf870*=88064) returned 1 [0075.162] CloseHandle (hObject=0x300) returned 1 [0075.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0075.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0075.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0075.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.163] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0076.048] ResetEvent (hEvent=0x2cc) returned 1 [0076.048] SetEvent (hEvent=0x2d0) returned 1 [0076.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.051] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x35bf870 | out: lpFileSize=0x35bf870*=110592) returned 1 [0076.051] CloseHandle (hObject=0x33c) returned 1 [0076.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0076.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0076.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.052] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0076.295] ResetEvent (hEvent=0x2cc) returned 1 [0076.295] SetEvent (hEvent=0x2d0) returned 1 [0076.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0076.295] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x35bf870 | out: lpFileSize=0x35bf870*=146432) returned 1 [0076.296] CloseHandle (hObject=0x32c) returned 1 [0076.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0076.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0076.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.296] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0077.118] ResetEvent (hEvent=0x2cc) returned 1 [0077.118] SetEvent (hEvent=0x2d0) returned 1 [0077.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0077.123] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x35bf870 | out: lpFileSize=0x35bf870*=147456) returned 1 [0077.123] CloseHandle (hObject=0x324) returned 1 [0077.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0077.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0077.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0077.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.124] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) Thread: id = 26 os_tid = 0x1fc [0051.378] GetProcessHeap () returned 0x130000 [0051.378] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x770048 [0051.379] GetProcessHeap () returned 0x130000 [0051.379] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x780050 [0051.379] GetProcessHeap () returned 0x130000 [0051.379] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x15bf30 [0051.379] GetProcessHeap () returned 0x130000 [0051.379] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x110102) returned 0x878020 [0051.382] GetProcessHeap () returned 0x130000 [0051.382] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14edb0 [0051.382] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0051.382] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0051.382] Wow64DisableWow64FsRedirection (in: OldValue=0x36ff904 | out: OldValue=0x36ff904*=0x0) returned 1 [0051.382] GetProcessHeap () returned 0x130000 [0051.382] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14edb0 | out: hHeap=0x130000) returned 1 [0051.382] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.382] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.382] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.382] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.383] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.385] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.387] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.388] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.390] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.392] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.394] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.395] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.396] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.397] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.398] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.400] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.400] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.400] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.400] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.400] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.400] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0051.401] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0056.125] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36ff878 | out: lpNewFilePointer=0x0) returned 1 [0056.126] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36ff878 | out: lpNewFilePointer=0x0) returned 1 [0056.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0056.132] ReadFile (in: hFile=0x328, lpBuffer=0x878020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36ff884, lpOverlapped=0x0 | out: lpBuffer=0x878020*, lpNumberOfBytesRead=0x36ff884*=0x7c000, lpOverlapped=0x0) returned 1 [0056.181] WriteFile (in: hFile=0x338, lpBuffer=0x878020*, nNumberOfBytesToWrite=0x7c010, lpNumberOfBytesWritten=0x36ff868, lpOverlapped=0x0 | out: lpBuffer=0x878020*, lpNumberOfBytesWritten=0x36ff868*=0x7c010, lpOverlapped=0x0) returned 1 [0056.190] WriteFile (in: hFile=0x338, lpBuffer=0x878020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36ff868, lpOverlapped=0x0 | out: lpBuffer=0x878020*, lpNumberOfBytesWritten=0x36ff868*=0xf2, lpOverlapped=0x0) returned 1 [0056.190] CloseHandle (hObject=0x328) returned 1 [0056.190] CloseHandle (hObject=0x338) returned 1 [0056.457] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb")) returned 1 [0056.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0056.464] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x36ff8b0 | out: lpFileSize=0x36ff8b0*=9277440) returned 1 [0056.464] CloseHandle (hObject=0x338) returned 1 [0056.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 0x220 [0056.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0056.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0056.464] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36ff700 | out: lpNewFilePointer=0x0) returned 1 [0056.465] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36ff700 | out: lpNewFilePointer=0x0) returned 1 [0056.465] ReadFile (in: hFile=0x338, lpBuffer=0x878058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36ff70c, lpOverlapped=0x0 | out: lpBuffer=0x878058*, lpNumberOfBytesRead=0x36ff70c*=0x40000, lpOverlapped=0x0) returned 1 [0056.468] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x2f3000, lpNewFilePointer=0x0, dwMoveMethod=0x36ff700 | out: lpNewFilePointer=0x0) returned 1 [0056.468] ReadFile (in: hFile=0x338, lpBuffer=0x8b8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36ff70c, lpOverlapped=0x0 | out: lpBuffer=0x8b8058*, lpNumberOfBytesRead=0x36ff70c*=0x40000, lpOverlapped=0x0) returned 1 [0056.478] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x899000, lpNewFilePointer=0x0, dwMoveMethod=0x36ff700 | out: lpNewFilePointer=0x0) returned 1 [0056.478] ReadFile (in: hFile=0x338, lpBuffer=0x8f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36ff70c, lpOverlapped=0x0 | out: lpBuffer=0x8f8058*, lpNumberOfBytesRead=0x36ff70c*=0x40000, lpOverlapped=0x0) returned 1 [0056.489] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36ff870 | out: lpNewFilePointer=0x0) returned 1 [0056.489] WriteFile (in: hFile=0x338, lpBuffer=0x878020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x36ff868, lpOverlapped=0x0 | out: lpBuffer=0x878020*, lpNumberOfBytesWritten=0x36ff868*=0xc0112, lpOverlapped=0x0) returned 1 [0056.958] SetEndOfFile (hFile=0x338) returned 1 [0056.958] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x899000, lpNewFilePointer=0x0, dwMoveMethod=0x36ff708 | out: lpNewFilePointer=0x0) returned 1 [0056.958] WriteFile (in: hFile=0x338, lpBuffer=0x93814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36ff714, lpOverlapped=0x0 | out: lpBuffer=0x93814a*, lpNumberOfBytesWritten=0x36ff714*=0x40000, lpOverlapped=0x0) returned 1 [0056.961] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x2f3000, lpNewFilePointer=0x0, dwMoveMethod=0x36ff708 | out: lpNewFilePointer=0x0) returned 1 [0056.961] WriteFile (in: hFile=0x338, lpBuffer=0x93814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36ff714, lpOverlapped=0x0 | out: lpBuffer=0x93814a*, lpNumberOfBytesWritten=0x36ff714*=0x40000, lpOverlapped=0x0) returned 1 [0056.963] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36ff708 | out: lpNewFilePointer=0x0) returned 1 [0056.963] WriteFile (in: hFile=0x338, lpBuffer=0x93814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36ff714, lpOverlapped=0x0 | out: lpBuffer=0x93814a*, lpNumberOfBytesWritten=0x36ff714*=0x40000, lpOverlapped=0x0) returned 1 [0056.965] CloseHandle (hObject=0x338) returned 1 [0058.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0074.647] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0076.048] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0076.295] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0077.119] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) Thread: id = 27 os_tid = 0x2d4 [0051.414] GetProcessHeap () returned 0x130000 [0051.414] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x792060 [0051.415] GetProcessHeap () returned 0x130000 [0051.415] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7a2068 [0051.415] GetProcessHeap () returned 0x130000 [0051.415] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x15bcf0 [0051.415] GetProcessHeap () returned 0x130000 [0051.415] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x110102) returned 0x994020 [0051.418] GetProcessHeap () returned 0x130000 [0051.418] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14ed58 [0051.418] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0051.418] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0051.418] Wow64DisableWow64FsRedirection (in: OldValue=0x383fcac | out: OldValue=0x383fcac*=0x0) returned 1 [0051.418] GetProcessHeap () returned 0x130000 [0051.418] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ed58 | out: hHeap=0x130000) returned 1 [0051.418] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.602] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=42674) returned 1 [0051.602] CloseHandle (hObject=0x2e0) returned 1 [0051.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0051.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0051.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.603] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.603] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.603] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.603] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0051.604] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xa6b2, lpOverlapped=0x0) returned 1 [0051.619] WriteFile (in: hFile=0x2fc, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xa6c0, lpOverlapped=0x0) returned 1 [0051.621] WriteFile (in: hFile=0x2fc, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x122, lpOverlapped=0x0) returned 1 [0051.622] CloseHandle (hObject=0x2e0) returned 1 [0051.622] CloseHandle (hObject=0x2fc) returned 1 [0051.624] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0051.626] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.626] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=40) returned 1 [0051.626] CloseHandle (hObject=0x2fc) returned 1 [0051.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0051.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0051.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.626] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.626] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.626] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.627] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e0 [0051.627] ReadFile (in: hFile=0x2fc, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x28, lpOverlapped=0x0) returned 1 [0051.628] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x30, lpOverlapped=0x0) returned 1 [0051.628] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x112, lpOverlapped=0x0) returned 1 [0051.629] CloseHandle (hObject=0x2fc) returned 1 [0051.629] CloseHandle (hObject=0x2e0) returned 1 [0051.629] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0051.630] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.926] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=144072) returned 1 [0051.926] CloseHandle (hObject=0x2e0) returned 1 [0051.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0051.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0051.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.928] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.929] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.929] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.929] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0051.935] ReadFile (in: hFile=0x308, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x232c8, lpOverlapped=0x0) returned 1 [0051.943] WriteFile (in: hFile=0x310, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x232d0, lpOverlapped=0x0) returned 1 [0051.947] WriteFile (in: hFile=0x310, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0051.947] CloseHandle (hObject=0x308) returned 1 [0051.947] CloseHandle (hObject=0x310) returned 1 [0051.953] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0051.955] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.955] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=129) returned 1 [0051.955] CloseHandle (hObject=0x310) returned 1 [0051.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0051.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0051.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.956] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.956] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.956] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0051.956] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x308 [0051.961] ReadFile (in: hFile=0x310, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x81, lpOverlapped=0x0) returned 1 [0051.961] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x90, lpOverlapped=0x0) returned 1 [0051.995] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0051.995] CloseHandle (hObject=0x310) returned 1 [0051.995] CloseHandle (hObject=0x308) returned 1 [0051.997] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0051.998] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.009] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=0) returned 1 [0052.009] CloseHandle (hObject=0x300) returned 1 [0052.009] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.175] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=74214) returned 1 [0052.175] CloseHandle (hObject=0x300) returned 1 [0052.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0052.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0052.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.175] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.175] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.175] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.175] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0052.176] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x121e6, lpOverlapped=0x0) returned 1 [0052.192] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x121f0, lpOverlapped=0x0) returned 1 [0052.194] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0052.194] CloseHandle (hObject=0x300) returned 1 [0052.194] CloseHandle (hObject=0x308) returned 1 [0052.196] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0052.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.199] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=6309) returned 1 [0052.199] CloseHandle (hObject=0x308) returned 1 [0052.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0052.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0052.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.199] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.199] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0052.203] ReadFile (in: hFile=0x308, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x18a5, lpOverlapped=0x0) returned 1 [0052.211] WriteFile (in: hFile=0x304, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x18b0, lpOverlapped=0x0) returned 1 [0052.212] WriteFile (in: hFile=0x304, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0052.212] CloseHandle (hObject=0x308) returned 1 [0052.212] CloseHandle (hObject=0x304) returned 1 [0052.212] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0052.214] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.229] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=14168) returned 1 [0052.229] CloseHandle (hObject=0x300) returned 1 [0052.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0052.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0052.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.230] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.230] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.230] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.230] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0052.230] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x3758, lpOverlapped=0x0) returned 1 [0052.237] WriteFile (in: hFile=0x30c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x3760, lpOverlapped=0x0) returned 1 [0052.238] WriteFile (in: hFile=0x30c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0052.239] CloseHandle (hObject=0x300) returned 1 [0052.239] CloseHandle (hObject=0x30c) returned 1 [0052.240] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0052.241] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.255] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=80970) returned 1 [0052.255] CloseHandle (hObject=0x300) returned 1 [0052.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0052.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0052.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.255] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.255] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.255] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.255] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0052.255] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x13c4a, lpOverlapped=0x0) returned 1 [0052.263] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x13c50, lpOverlapped=0x0) returned 1 [0052.266] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0052.266] CloseHandle (hObject=0x300) returned 1 [0052.266] CloseHandle (hObject=0x308) returned 1 [0052.268] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0052.269] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.269] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3314) returned 1 [0052.269] CloseHandle (hObject=0x308) returned 1 [0052.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0052.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0052.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.270] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.270] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.270] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.270] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0052.288] ReadFile (in: hFile=0x308, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xcf2, lpOverlapped=0x0) returned 1 [0052.530] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xd00, lpOverlapped=0x0) returned 1 [0052.535] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0052.535] CloseHandle (hObject=0x308) returned 1 [0052.535] CloseHandle (hObject=0x2e0) returned 1 [0052.536] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0052.537] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.537] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=18776) returned 1 [0052.537] CloseHandle (hObject=0x2e0) returned 1 [0052.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0052.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0052.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.537] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.537] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.538] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.538] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0052.538] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4958, lpOverlapped=0x0) returned 1 [0052.540] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4960, lpOverlapped=0x0) returned 1 [0052.541] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0052.541] CloseHandle (hObject=0x2e0) returned 1 [0052.541] CloseHandle (hObject=0x308) returned 1 [0052.542] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0052.543] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.544] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=8876) returned 1 [0052.544] CloseHandle (hObject=0x308) returned 1 [0052.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0052.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0052.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.544] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.544] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.544] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.544] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0052.546] ReadFile (in: hFile=0x308, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x22ac, lpOverlapped=0x0) returned 1 [0052.548] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x22b0, lpOverlapped=0x0) returned 1 [0052.549] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0052.549] CloseHandle (hObject=0x308) returned 1 [0052.549] CloseHandle (hObject=0x2e0) returned 1 [0052.550] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0052.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.551] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=86284) returned 1 [0052.551] CloseHandle (hObject=0x2e0) returned 1 [0052.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0052.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0052.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.551] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.551] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0052.552] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x1510c, lpOverlapped=0x0) returned 1 [0052.554] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x15110, lpOverlapped=0x0) returned 1 [0052.557] WriteFile (in: hFile=0x308, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0052.557] CloseHandle (hObject=0x2e0) returned 1 [0052.557] CloseHandle (hObject=0x308) returned 1 [0052.559] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0052.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.561] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=19288) returned 1 [0052.561] CloseHandle (hObject=0x308) returned 1 [0052.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0052.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0052.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.561] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.561] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.561] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.561] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0052.562] ReadFile (in: hFile=0x308, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4b58, lpOverlapped=0x0) returned 1 [0052.563] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4b60, lpOverlapped=0x0) returned 1 [0052.565] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0052.565] CloseHandle (hObject=0x308) returned 1 [0052.565] CloseHandle (hObject=0x2e0) returned 1 [0052.566] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0052.567] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.567] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3188) returned 1 [0052.567] CloseHandle (hObject=0x2e0) returned 1 [0052.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0052.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0052.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.568] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.568] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.568] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0052.568] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0053.080] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xc74, lpOverlapped=0x0) returned 1 [0053.081] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xc80, lpOverlapped=0x0) returned 1 [0053.082] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0053.082] CloseHandle (hObject=0x2e0) returned 1 [0053.083] CloseHandle (hObject=0x31c) returned 1 [0053.083] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0053.084] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.085] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=17240) returned 1 [0053.085] CloseHandle (hObject=0x31c) returned 1 [0053.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0053.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0053.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.085] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.085] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.085] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.085] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.085] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4358, lpOverlapped=0x0) returned 1 [0053.087] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4360, lpOverlapped=0x0) returned 1 [0053.088] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.088] CloseHandle (hObject=0x31c) returned 1 [0053.088] CloseHandle (hObject=0x2e0) returned 1 [0053.089] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0053.090] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.091] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3702) returned 1 [0053.091] CloseHandle (hObject=0x2e0) returned 1 [0053.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0053.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0053.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.091] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.091] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.091] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.091] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0053.093] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xe76, lpOverlapped=0x0) returned 1 [0053.095] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xe80, lpOverlapped=0x0) returned 1 [0053.096] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0053.096] CloseHandle (hObject=0x2e0) returned 1 [0053.096] CloseHandle (hObject=0x328) returned 1 [0053.097] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0053.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.098] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77022) returned 1 [0053.098] CloseHandle (hObject=0x328) returned 1 [0053.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0053.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0053.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.098] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.099] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.099] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.099] ReadFile (in: hFile=0x328, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x12cde, lpOverlapped=0x0) returned 1 [0053.101] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x12ce0, lpOverlapped=0x0) returned 1 [0053.103] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.103] CloseHandle (hObject=0x328) returned 1 [0053.103] CloseHandle (hObject=0x2e0) returned 1 [0053.105] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0053.107] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.107] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=18264) returned 1 [0053.107] CloseHandle (hObject=0x2e0) returned 1 [0053.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0053.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0053.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.107] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.107] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.108] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.108] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0053.108] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4758, lpOverlapped=0x0) returned 1 [0053.110] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4760, lpOverlapped=0x0) returned 1 [0053.111] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.111] CloseHandle (hObject=0x2e0) returned 1 [0053.111] CloseHandle (hObject=0x328) returned 1 [0053.112] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0053.113] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.113] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3526) returned 1 [0053.113] CloseHandle (hObject=0x328) returned 1 [0053.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0053.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0053.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.114] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.114] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.115] ReadFile (in: hFile=0x328, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xdc6, lpOverlapped=0x0) returned 1 [0053.407] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xdd0, lpOverlapped=0x0) returned 1 [0053.409] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0053.409] CloseHandle (hObject=0x328) returned 1 [0053.409] CloseHandle (hObject=0x2e0) returned 1 [0053.410] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0053.411] SetEvent (hEvent=0x2e4) returned 1 [0053.412] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.412] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=72076) returned 1 [0053.412] CloseHandle (hObject=0x2e0) returned 1 [0053.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0053.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0053.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.413] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.413] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.413] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.413] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0053.413] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x1198c, lpOverlapped=0x0) returned 1 [0053.416] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11990, lpOverlapped=0x0) returned 1 [0053.418] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.418] CloseHandle (hObject=0x2e0) returned 1 [0053.418] CloseHandle (hObject=0x328) returned 1 [0053.420] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0053.425] SetEvent (hEvent=0x2e4) returned 1 [0053.425] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.426] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=16728) returned 1 [0053.426] CloseHandle (hObject=0x328) returned 1 [0053.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0053.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0053.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.426] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.426] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.426] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.426] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.426] ReadFile (in: hFile=0x328, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4158, lpOverlapped=0x0) returned 1 [0053.428] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4160, lpOverlapped=0x0) returned 1 [0053.430] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.430] CloseHandle (hObject=0x328) returned 1 [0053.430] CloseHandle (hObject=0x2e0) returned 1 [0053.431] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0053.432] SetEvent (hEvent=0x2e4) returned 1 [0053.432] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.432] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=4254) returned 1 [0053.432] CloseHandle (hObject=0x2e0) returned 1 [0053.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0053.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0053.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.432] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.432] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.433] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.435] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x109e, lpOverlapped=0x0) returned 1 [0053.437] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x10a0, lpOverlapped=0x0) returned 1 [0053.439] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0053.439] CloseHandle (hObject=0x2e0) returned 1 [0053.439] CloseHandle (hObject=0x320) returned 1 [0053.440] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0053.440] SetEvent (hEvent=0x2e4) returned 1 [0053.441] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.441] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=86442) returned 1 [0053.441] CloseHandle (hObject=0x320) returned 1 [0053.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0053.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0053.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.441] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.441] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.441] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.441] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.441] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x151aa, lpOverlapped=0x0) returned 1 [0053.444] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x151b0, lpOverlapped=0x0) returned 1 [0053.446] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.446] CloseHandle (hObject=0x320) returned 1 [0053.446] CloseHandle (hObject=0x2e0) returned 1 [0053.449] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0053.450] SetEvent (hEvent=0x2e4) returned 1 [0053.450] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0053.629] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=18776) returned 1 [0053.629] CloseHandle (hObject=0x314) returned 1 [0053.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0053.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0053.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.630] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0053.630] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.630] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.630] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0053.630] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4958, lpOverlapped=0x0) returned 1 [0053.633] WriteFile (in: hFile=0x318, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4960, lpOverlapped=0x0) returned 1 [0053.634] WriteFile (in: hFile=0x318, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.634] CloseHandle (hObject=0x314) returned 1 [0053.634] CloseHandle (hObject=0x318) returned 1 [0053.635] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0053.636] SetEvent (hEvent=0x2e4) returned 1 [0053.636] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.637] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=15704) returned 1 [0053.637] CloseHandle (hObject=0x318) returned 1 [0053.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0053.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0053.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.637] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0053.637] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.637] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0053.637] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0053.637] ReadFile (in: hFile=0x318, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x3d58, lpOverlapped=0x0) returned 1 [0053.649] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x3d60, lpOverlapped=0x0) returned 1 [0053.650] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0053.650] CloseHandle (hObject=0x318) returned 1 [0053.650] CloseHandle (hObject=0x314) returned 1 [0053.651] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0053.652] SetEvent (hEvent=0x2e4) returned 1 [0053.652] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0053.652] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=12687) returned 1 [0053.652] CloseHandle (hObject=0x314) returned 1 [0053.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0053.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0053.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.209] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.209] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.209] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.209] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.210] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x318f, lpOverlapped=0x0) returned 1 [0054.213] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x3190, lpOverlapped=0x0) returned 1 [0054.214] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0054.214] CloseHandle (hObject=0x31c) returned 1 [0054.215] CloseHandle (hObject=0x320) returned 1 [0054.216] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0054.217] SetEvent (hEvent=0x2e4) returned 1 [0054.218] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.220] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=79634) returned 1 [0054.220] CloseHandle (hObject=0x31c) returned 1 [0054.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0054.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0054.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.221] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.221] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0054.221] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x13712, lpOverlapped=0x0) returned 1 [0054.238] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x13720, lpOverlapped=0x0) returned 1 [0054.240] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.240] CloseHandle (hObject=0x31c) returned 1 [0054.240] CloseHandle (hObject=0x314) returned 1 [0054.242] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0054.244] SetEvent (hEvent=0x2e4) returned 1 [0054.244] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.244] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3046) returned 1 [0054.244] CloseHandle (hObject=0x314) returned 1 [0054.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0054.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0054.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.244] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.244] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.244] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.244] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0054.255] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xbe6, lpOverlapped=0x0) returned 1 [0054.263] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xbf0, lpOverlapped=0x0) returned 1 [0054.265] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0054.265] CloseHandle (hObject=0x314) returned 1 [0054.265] CloseHandle (hObject=0x2e0) returned 1 [0054.266] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0054.267] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.267] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=17752) returned 1 [0054.267] CloseHandle (hObject=0x2e0) returned 1 [0054.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0054.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0054.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.267] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.267] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.267] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.267] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0054.268] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4558, lpOverlapped=0x0) returned 1 [0054.495] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4560, lpOverlapped=0x0) returned 1 [0054.496] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.496] CloseHandle (hObject=0x2e0) returned 1 [0054.496] CloseHandle (hObject=0x314) returned 1 [0054.498] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0054.499] SetEvent (hEvent=0x2e4) returned 1 [0054.499] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.500] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3683) returned 1 [0054.500] CloseHandle (hObject=0x314) returned 1 [0054.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0054.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0054.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.500] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.500] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.500] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.500] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0054.502] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xe63, lpOverlapped=0x0) returned 1 [0054.503] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xe70, lpOverlapped=0x0) returned 1 [0054.504] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0054.505] CloseHandle (hObject=0x314) returned 1 [0054.505] CloseHandle (hObject=0x2e0) returned 1 [0054.505] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0054.506] SetEvent (hEvent=0x2e4) returned 1 [0054.506] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.507] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=80738) returned 1 [0054.507] CloseHandle (hObject=0x2e0) returned 1 [0054.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0054.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0054.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.507] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.507] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.507] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.507] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0054.507] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x13b62, lpOverlapped=0x0) returned 1 [0054.510] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x13b70, lpOverlapped=0x0) returned 1 [0054.512] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.512] CloseHandle (hObject=0x2e0) returned 1 [0054.512] CloseHandle (hObject=0x314) returned 1 [0054.514] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0054.516] SetEvent (hEvent=0x2e4) returned 1 [0054.516] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.516] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=18264) returned 1 [0054.516] CloseHandle (hObject=0x314) returned 1 [0054.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0054.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0054.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.516] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.516] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.516] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.517] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0054.517] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4758, lpOverlapped=0x0) returned 1 [0054.518] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4760, lpOverlapped=0x0) returned 1 [0054.520] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.520] CloseHandle (hObject=0x314) returned 1 [0054.520] CloseHandle (hObject=0x2e0) returned 1 [0054.521] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0054.522] SetEvent (hEvent=0x2e4) returned 1 [0054.522] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.523] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=54456) returned 1 [0054.523] CloseHandle (hObject=0x2e0) returned 1 [0054.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0054.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0054.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.523] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.523] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.523] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.523] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0054.526] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xd4b8, lpOverlapped=0x0) returned 1 [0054.528] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xd4c0, lpOverlapped=0x0) returned 1 [0054.530] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0054.530] CloseHandle (hObject=0x2e0) returned 1 [0054.530] CloseHandle (hObject=0x314) returned 1 [0054.532] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0054.533] SetEvent (hEvent=0x2e4) returned 1 [0054.533] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.533] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=81482) returned 1 [0054.533] CloseHandle (hObject=0x314) returned 1 [0054.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0054.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0054.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.534] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.534] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.534] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.534] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0054.534] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x13e4a, lpOverlapped=0x0) returned 1 [0054.751] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x13e50, lpOverlapped=0x0) returned 1 [0054.753] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.753] CloseHandle (hObject=0x314) returned 1 [0054.753] CloseHandle (hObject=0x2e0) returned 1 [0054.755] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0054.757] SetEvent (hEvent=0x2e4) returned 1 [0054.757] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.758] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76818) returned 1 [0054.758] CloseHandle (hObject=0x2e0) returned 1 [0054.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0054.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0054.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.758] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.758] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.758] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.758] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x314 [0054.758] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x12c12, lpOverlapped=0x0) returned 1 [0054.763] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x12c20, lpOverlapped=0x0) returned 1 [0054.766] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.766] CloseHandle (hObject=0x2e0) returned 1 [0054.766] CloseHandle (hObject=0x314) returned 1 [0054.768] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0054.769] SetEvent (hEvent=0x2e4) returned 1 [0054.769] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.769] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=17752) returned 1 [0054.769] CloseHandle (hObject=0x314) returned 1 [0054.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0054.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0054.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.770] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.770] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.770] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.770] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0054.773] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x4558, lpOverlapped=0x0) returned 1 [0054.777] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x4560, lpOverlapped=0x0) returned 1 [0054.778] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0054.778] CloseHandle (hObject=0x314) returned 1 [0054.778] CloseHandle (hObject=0x2e0) returned 1 [0054.779] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0054.780] SetEvent (hEvent=0x2e4) returned 1 [0054.780] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.780] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=5827) returned 1 [0054.780] CloseHandle (hObject=0x2e0) returned 1 [0054.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0054.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0054.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.781] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.781] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.781] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.781] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.798] ReadFile (in: hFile=0x2e0, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x16c3, lpOverlapped=0x0) returned 1 [0054.799] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x16d0, lpOverlapped=0x0) returned 1 [0054.800] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0054.800] CloseHandle (hObject=0x2e0) returned 1 [0054.801] CloseHandle (hObject=0x320) returned 1 [0054.801] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0054.802] SetEvent (hEvent=0x2e4) returned 1 [0054.802] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.803] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=14168) returned 1 [0054.803] CloseHandle (hObject=0x320) returned 1 [0054.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0054.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0054.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.803] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.803] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.803] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0054.803] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0054.803] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x3758, lpOverlapped=0x0) returned 1 [0055.144] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x3760, lpOverlapped=0x0) returned 1 [0055.146] WriteFile (in: hFile=0x2e0, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0055.146] CloseHandle (hObject=0x320) returned 1 [0055.146] CloseHandle (hObject=0x2e0) returned 1 [0055.148] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0055.149] SetEvent (hEvent=0x2e4) returned 1 [0055.150] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.379] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=60816) returned 1 [0055.379] CloseHandle (hObject=0x320) returned 1 [0055.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0055.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0055.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.398] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.725] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.725] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.725] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0055.725] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xed90, lpOverlapped=0x0) returned 1 [0055.728] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xeda0, lpOverlapped=0x0) returned 1 [0055.729] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0055.730] CloseHandle (hObject=0x31c) returned 1 [0055.730] CloseHandle (hObject=0x320) returned 1 [0055.732] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0055.733] SetEvent (hEvent=0x2e4) returned 1 [0055.733] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.734] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=39042) returned 1 [0055.734] CloseHandle (hObject=0x320) returned 1 [0055.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0055.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0055.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.735] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.735] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.735] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.735] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0055.737] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x9882, lpOverlapped=0x0) returned 1 [0055.739] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x9890, lpOverlapped=0x0) returned 1 [0055.741] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0055.741] CloseHandle (hObject=0x320) returned 1 [0055.741] CloseHandle (hObject=0x31c) returned 1 [0055.743] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0055.744] SetEvent (hEvent=0x2e4) returned 1 [0055.744] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.744] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=16118) returned 1 [0055.744] CloseHandle (hObject=0x31c) returned 1 [0055.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0055.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0055.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.744] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.745] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.745] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.745] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0055.745] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x3ef6, lpOverlapped=0x0) returned 1 [0055.747] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x3f00, lpOverlapped=0x0) returned 1 [0055.749] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0055.749] CloseHandle (hObject=0x31c) returned 1 [0055.749] CloseHandle (hObject=0x320) returned 1 [0055.750] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0055.751] SetEvent (hEvent=0x2e4) returned 1 [0055.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.752] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=88533) returned 1 [0055.752] CloseHandle (hObject=0x320) returned 1 [0055.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0055.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0055.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.752] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.752] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.752] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0055.752] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0055.752] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x159d5, lpOverlapped=0x0) returned 1 [0055.995] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x159e0, lpOverlapped=0x0) returned 1 [0056.000] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.000] CloseHandle (hObject=0x320) returned 1 [0056.000] CloseHandle (hObject=0x31c) returned 1 [0056.003] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0056.004] SetEvent (hEvent=0x2e4) returned 1 [0056.005] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.006] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=894) returned 1 [0056.006] CloseHandle (hObject=0x31c) returned 1 [0056.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0056.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0056.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.006] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.007] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.007] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.007] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0056.007] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x37e, lpOverlapped=0x0) returned 1 [0056.009] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x380, lpOverlapped=0x0) returned 1 [0056.011] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.011] CloseHandle (hObject=0x31c) returned 1 [0056.011] CloseHandle (hObject=0x320) returned 1 [0056.012] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0056.013] SetEvent (hEvent=0x2e4) returned 1 [0056.013] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.013] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=894) returned 1 [0056.013] CloseHandle (hObject=0x320) returned 1 [0056.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0056.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0056.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.013] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.013] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.014] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.014] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0056.014] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x37e, lpOverlapped=0x0) returned 1 [0056.017] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x380, lpOverlapped=0x0) returned 1 [0056.018] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.018] CloseHandle (hObject=0x320) returned 1 [0056.018] CloseHandle (hObject=0x31c) returned 1 [0056.019] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0056.019] SetEvent (hEvent=0x2e4) returned 1 [0056.020] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.020] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=894) returned 1 [0056.020] CloseHandle (hObject=0x31c) returned 1 [0056.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0056.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0056.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.020] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.020] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.020] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.020] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0056.021] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x37e, lpOverlapped=0x0) returned 1 [0056.022] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x380, lpOverlapped=0x0) returned 1 [0056.023] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.023] CloseHandle (hObject=0x31c) returned 1 [0056.023] CloseHandle (hObject=0x320) returned 1 [0056.024] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0056.025] SetEvent (hEvent=0x2e4) returned 1 [0056.025] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.026] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=894) returned 1 [0056.026] CloseHandle (hObject=0x320) returned 1 [0056.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0056.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0056.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.026] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.026] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.027] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.027] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0056.027] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x37e, lpOverlapped=0x0) returned 1 [0056.028] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x380, lpOverlapped=0x0) returned 1 [0056.029] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.029] CloseHandle (hObject=0x320) returned 1 [0056.029] CloseHandle (hObject=0x31c) returned 1 [0056.030] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0056.031] SetEvent (hEvent=0x2e4) returned 1 [0056.031] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.031] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=894) returned 1 [0056.031] CloseHandle (hObject=0x31c) returned 1 [0056.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0056.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0056.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.032] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.032] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.032] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.032] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0056.032] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x37e, lpOverlapped=0x0) returned 1 [0056.320] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x380, lpOverlapped=0x0) returned 1 [0056.321] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.321] CloseHandle (hObject=0x31c) returned 1 [0056.321] CloseHandle (hObject=0x320) returned 1 [0056.322] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0056.323] SetEvent (hEvent=0x2e4) returned 1 [0056.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.324] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=1150) returned 1 [0056.324] CloseHandle (hObject=0x320) returned 1 [0056.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0056.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0056.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.324] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.324] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0056.325] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x47e, lpOverlapped=0x0) returned 1 [0056.327] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x480, lpOverlapped=0x0) returned 1 [0056.327] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.327] CloseHandle (hObject=0x320) returned 1 [0056.328] CloseHandle (hObject=0x31c) returned 1 [0056.328] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0056.329] SetEvent (hEvent=0x2e4) returned 1 [0056.329] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.329] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=1150) returned 1 [0056.329] CloseHandle (hObject=0x31c) returned 1 [0056.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0056.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0056.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.330] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.330] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.330] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.330] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0056.330] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x47e, lpOverlapped=0x0) returned 1 [0056.333] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x480, lpOverlapped=0x0) returned 1 [0056.334] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0056.334] CloseHandle (hObject=0x31c) returned 1 [0056.334] CloseHandle (hObject=0x320) returned 1 [0056.335] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0056.336] SetEvent (hEvent=0x2e4) returned 1 [0056.336] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.336] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=10134) returned 1 [0056.336] CloseHandle (hObject=0x320) returned 1 [0056.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0056.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0056.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.337] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.337] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.337] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.337] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0056.337] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x2796, lpOverlapped=0x0) returned 1 [0056.340] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x27a0, lpOverlapped=0x0) returned 1 [0056.341] WriteFile (in: hFile=0x31c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.341] CloseHandle (hObject=0x320) returned 1 [0056.341] CloseHandle (hObject=0x31c) returned 1 [0056.342] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0056.343] SetEvent (hEvent=0x2e4) returned 1 [0056.343] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.354] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3628) returned 1 [0056.354] CloseHandle (hObject=0x31c) returned 1 [0056.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0056.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0056.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.354] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.355] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.355] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0056.355] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0056.355] ReadFile (in: hFile=0x31c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xe2c, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xe30, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0056.358] CloseHandle (hObject=0x31c) returned 1 [0056.358] CloseHandle (hObject=0x320) returned 1 [0056.359] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0056.360] SetEvent (hEvent=0x2e4) returned 1 [0056.360] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.361] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=181483595) returned 1 [0056.361] CloseHandle (hObject=0x320) returned 1 [0056.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0056.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0056.362] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0056.362] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0056.362] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0056.362] ReadFile (in: hFile=0x320, lpBuffer=0x994058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x994058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0056.368] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0056.368] ReadFile (in: hFile=0x320, lpBuffer=0x9d4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x9d4058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0056.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0056.827] ReadFile (in: hFile=0x320, lpBuffer=0xa14058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0xa14058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0056.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc18 | out: lpNewFilePointer=0x0) returned 1 [0056.841] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xc0112, lpOverlapped=0x0) returned 1 [0056.855] SetEndOfFile (hFile=0x320) returned 1 [0056.855] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0056.855] WriteFile (in: hFile=0x320, lpBuffer=0xa5414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5414a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0056.857] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0056.857] WriteFile (in: hFile=0x320, lpBuffer=0xa5414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5414a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0056.858] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0056.858] WriteFile (in: hFile=0x320, lpBuffer=0xa5414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5414a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0056.858] CloseHandle (hObject=0x320) returned 1 [0058.685] SetEvent (hEvent=0x2e4) returned 1 [0058.686] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.699] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=872448) returned 1 [0058.699] CloseHandle (hObject=0x320) returned 1 [0058.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0058.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0058.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0058.700] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0058.700] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0058.700] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0058.700] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0058.700] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xd5000, lpOverlapped=0x0) returned 1 [0058.732] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xd5010, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0058.953] CloseHandle (hObject=0x320) returned 1 [0058.953] CloseHandle (hObject=0x300) returned 1 [0058.986] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0059.096] SetEvent (hEvent=0x2e4) returned 1 [0059.097] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.098] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=495616) returned 1 [0059.098] CloseHandle (hObject=0x33c) returned 1 [0059.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0059.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0059.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0059.099] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.099] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.099] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.100] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0059.100] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x79000, lpOverlapped=0x0) returned 1 [0059.110] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x79010, lpOverlapped=0x0) returned 1 [0059.119] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0059.119] CloseHandle (hObject=0x33c) returned 1 [0059.119] CloseHandle (hObject=0x330) returned 1 [0059.129] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0059.338] SetEvent (hEvent=0x2e4) returned 1 [0059.339] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.340] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=272046) returned 1 [0059.340] CloseHandle (hObject=0x330) returned 1 [0059.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0059.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0059.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0059.340] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.340] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.340] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.340] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0059.341] ReadFile (in: hFile=0x330, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x426ae, lpOverlapped=0x0) returned 1 [0059.350] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x426b0, lpOverlapped=0x0) returned 1 [0059.355] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0059.355] CloseHandle (hObject=0x330) returned 1 [0059.355] CloseHandle (hObject=0x33c) returned 1 [0059.360] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0059.363] SetEvent (hEvent=0x2e4) returned 1 [0059.363] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.364] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=184832) returned 1 [0059.364] CloseHandle (hObject=0x33c) returned 1 [0059.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0059.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0059.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0059.364] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.364] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.364] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.364] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0059.364] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x2d200, lpOverlapped=0x0) returned 1 [0059.369] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x2d210, lpOverlapped=0x0) returned 1 [0059.372] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0059.372] CloseHandle (hObject=0x33c) returned 1 [0059.372] CloseHandle (hObject=0x330) returned 1 [0059.376] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0059.378] SetEvent (hEvent=0x2e4) returned 1 [0059.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.379] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=94720) returned 1 [0059.379] CloseHandle (hObject=0x330) returned 1 [0059.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0059.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0059.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0059.379] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.379] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.379] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.379] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0059.379] ReadFile (in: hFile=0x330, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x17200, lpOverlapped=0x0) returned 1 [0059.684] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x17210, lpOverlapped=0x0) returned 1 [0059.686] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0059.686] CloseHandle (hObject=0x330) returned 1 [0059.686] CloseHandle (hObject=0x33c) returned 1 [0059.689] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0059.690] SetEvent (hEvent=0x2e4) returned 1 [0059.691] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.691] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=78152) returned 1 [0059.691] CloseHandle (hObject=0x33c) returned 1 [0059.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0059.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0059.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0059.692] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0059.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.692] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0059.692] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x13148, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x13150, lpOverlapped=0x0) returned 1 [0059.697] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0059.697] CloseHandle (hObject=0x33c) returned 1 [0059.697] CloseHandle (hObject=0x330) returned 1 [0059.699] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0059.700] SetEvent (hEvent=0x2e4) returned 1 [0059.700] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.701] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=807256) returned 1 [0059.701] CloseHandle (hObject=0x330) returned 1 [0059.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0059.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0059.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0059.701] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.701] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.701] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0059.701] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0059.703] ReadFile (in: hFile=0x330, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xc5158, lpOverlapped=0x0) returned 1 [0059.717] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xc5160, lpOverlapped=0x0) returned 1 [0060.331] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0060.331] CloseHandle (hObject=0x330) returned 1 [0060.331] CloseHandle (hObject=0x33c) returned 1 [0060.649] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0060.656] SetEvent (hEvent=0x2e4) returned 1 [0060.656] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.657] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=295248) returned 1 [0060.657] CloseHandle (hObject=0x33c) returned 1 [0060.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0060.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0060.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0060.657] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.657] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.657] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.657] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0060.658] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x48150, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x48160, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x330, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0060.676] CloseHandle (hObject=0x33c) returned 1 [0060.676] CloseHandle (hObject=0x330) returned 1 [0060.729] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0060.733] SetEvent (hEvent=0x2e4) returned 1 [0060.733] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.924] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=30120) returned 1 [0060.924] CloseHandle (hObject=0x300) returned 1 [0060.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0060.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0060.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0060.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.924] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.924] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0060.924] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x75a8, lpOverlapped=0x0) returned 1 [0060.927] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x75b0, lpOverlapped=0x0) returned 1 [0060.929] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0060.929] CloseHandle (hObject=0x300) returned 1 [0060.929] CloseHandle (hObject=0x33c) returned 1 [0060.930] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0060.932] SetEvent (hEvent=0x2e4) returned 1 [0060.932] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.932] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=96088) returned 1 [0060.932] CloseHandle (hObject=0x33c) returned 1 [0060.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0060.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0060.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0060.932] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0060.932] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.932] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.932] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0060.933] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x17758, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x17760, lpOverlapped=0x0) returned 1 [0060.987] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0060.987] CloseHandle (hObject=0x33c) returned 1 [0060.988] CloseHandle (hObject=0x300) returned 1 [0060.991] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0060.994] SetEvent (hEvent=0x2e4) returned 1 [0060.994] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.995] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=41080) returned 1 [0060.995] CloseHandle (hObject=0x300) returned 1 [0060.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0060.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0060.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0060.995] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.995] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.996] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0060.996] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0060.996] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0xa078, lpOverlapped=0x0) returned 1 [0061.003] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xa080, lpOverlapped=0x0) returned 1 [0061.004] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0061.005] CloseHandle (hObject=0x300) returned 1 [0061.005] CloseHandle (hObject=0x33c) returned 1 [0061.006] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0061.008] SetEvent (hEvent=0x2e4) returned 1 [0061.008] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.008] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=144416) returned 1 [0061.008] CloseHandle (hObject=0x33c) returned 1 [0061.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0061.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0061.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0061.008] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.008] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.008] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.009] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0061.009] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x23420, lpOverlapped=0x0) returned 1 [0061.131] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x23430, lpOverlapped=0x0) returned 1 [0061.134] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0061.134] CloseHandle (hObject=0x33c) returned 1 [0061.134] CloseHandle (hObject=0x300) returned 1 [0061.138] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0061.140] SetEvent (hEvent=0x2e4) returned 1 [0061.140] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.141] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=14084) returned 1 [0061.141] CloseHandle (hObject=0x300) returned 1 [0061.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0061.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0061.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0061.151] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.151] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.151] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.151] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0061.151] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x3704, lpOverlapped=0x0) returned 1 [0061.154] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x3710, lpOverlapped=0x0) returned 1 [0061.155] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0061.155] CloseHandle (hObject=0x300) returned 1 [0061.155] CloseHandle (hObject=0x33c) returned 1 [0061.157] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0061.158] SetEvent (hEvent=0x2e4) returned 1 [0061.158] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.158] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=38898) returned 1 [0061.158] CloseHandle (hObject=0x33c) returned 1 [0061.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0061.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0061.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0061.159] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.159] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.159] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.159] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0061.159] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x97f2, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x9800, lpOverlapped=0x0) returned 1 [0061.163] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0061.163] CloseHandle (hObject=0x33c) returned 1 [0061.163] CloseHandle (hObject=0x300) returned 1 [0061.165] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0061.166] SetEvent (hEvent=0x2e4) returned 1 [0061.166] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.166] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=104072) returned 1 [0061.166] CloseHandle (hObject=0x300) returned 1 [0061.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0061.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0061.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0061.167] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.167] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.167] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0061.167] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0061.167] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x19688, lpOverlapped=0x0) returned 1 [0061.173] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x19690, lpOverlapped=0x0) returned 1 [0061.175] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0061.175] CloseHandle (hObject=0x300) returned 1 [0061.175] CloseHandle (hObject=0x33c) returned 1 [0061.178] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0061.180] SetEvent (hEvent=0x2e4) returned 1 [0061.180] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.259] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=5198099) returned 1 [0061.259] CloseHandle (hObject=0x33c) returned 1 [0061.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0061.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0061.273] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0061.276] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0061.280] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0061.283] ReadFile (in: hFile=0x33c, lpBuffer=0x994058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x994058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0061.297] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0061.297] ReadFile (in: hFile=0x33c, lpBuffer=0x9d4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x9d4058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0061.306] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0061.307] ReadFile (in: hFile=0x33c, lpBuffer=0xa14058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0xa14058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0061.323] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc18 | out: lpNewFilePointer=0x0) returned 1 [0061.323] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xc0132, lpOverlapped=0x0) returned 1 [0061.477] SetEndOfFile (hFile=0x33c) returned 1 [0061.477] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0061.478] WriteFile (in: hFile=0x33c, lpBuffer=0xa5416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5416a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0061.480] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0061.481] WriteFile (in: hFile=0x33c, lpBuffer=0xa5416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5416a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0061.483] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0061.483] WriteFile (in: hFile=0x33c, lpBuffer=0xa5416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5416a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0061.486] CloseHandle (hObject=0x33c) returned 1 [0063.075] SetEvent (hEvent=0x2e4) returned 1 [0063.076] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.076] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=5091790) returned 1 [0063.076] CloseHandle (hObject=0x33c) returned 1 [0063.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0063.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0063.077] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.077] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0063.077] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0063.077] ReadFile (in: hFile=0x33c, lpBuffer=0x994058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x994058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0063.086] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0063.086] ReadFile (in: hFile=0x33c, lpBuffer=0x9d4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x9d4058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0063.124] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0063.124] ReadFile (in: hFile=0x33c, lpBuffer=0xa14058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0xa14058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0063.145] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc18 | out: lpNewFilePointer=0x0) returned 1 [0063.145] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xc0132, lpOverlapped=0x0) returned 1 [0063.224] SetEndOfFile (hFile=0x33c) returned 1 [0063.264] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0063.264] WriteFile (in: hFile=0x33c, lpBuffer=0xa5416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5416a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0063.267] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0063.267] WriteFile (in: hFile=0x33c, lpBuffer=0xa5416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5416a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0063.270] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0063.270] WriteFile (in: hFile=0x33c, lpBuffer=0xa5416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5416a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0063.272] CloseHandle (hObject=0x33c) returned 1 [0065.123] SetEvent (hEvent=0x2e4) returned 1 [0065.125] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.125] SetEvent (hEvent=0x2e4) returned 1 [0065.125] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.126] SetEvent (hEvent=0x2e4) returned 1 [0065.126] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.126] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=0) returned 1 [0065.126] CloseHandle (hObject=0x328) returned 1 [0065.126] SetEvent (hEvent=0x2e4) returned 1 [0065.127] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.127] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=0) returned 1 [0065.127] CloseHandle (hObject=0x328) returned 1 [0065.127] SetEvent (hEvent=0x2e4) returned 1 [0065.128] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.128] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77664) returned 1 [0065.128] CloseHandle (hObject=0x328) returned 1 [0065.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0065.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0065.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.128] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.128] SetEvent (hEvent=0x2e4) returned 1 [0065.129] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0065.247] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=95648) returned 1 [0065.247] CloseHandle (hObject=0x318) returned 1 [0065.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0065.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0065.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.247] SetEvent (hEvent=0x2e4) returned 1 [0065.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0065.249] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=65536) returned 1 [0065.249] CloseHandle (hObject=0x318) returned 1 [0065.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0065.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0065.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0065.249] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0065.249] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0065.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x328 [0065.250] ReadFile (in: hFile=0x318, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x10000, lpOverlapped=0x0) returned 1 [0065.255] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x10010, lpOverlapped=0x0) returned 1 [0065.257] WriteFile (in: hFile=0x328, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0065.257] CloseHandle (hObject=0x318) returned 1 [0065.257] CloseHandle (hObject=0x328) returned 1 [0065.260] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0065.261] SetEvent (hEvent=0x2e4) returned 1 [0065.261] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.261] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=99744) returned 1 [0065.261] CloseHandle (hObject=0x328) returned 1 [0065.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0065.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0065.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.262] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76632) returned 1 [0065.262] CloseHandle (hObject=0x328) returned 1 [0065.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0065.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0065.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.263] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0065.263] CloseHandle (hObject=0x328) returned 1 [0065.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0065.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0065.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.264] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=75616) returned 1 [0065.264] CloseHandle (hObject=0x328) returned 1 [0065.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0065.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0065.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.264] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0065.264] CloseHandle (hObject=0x328) returned 1 [0065.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0065.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0065.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.265] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.265] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=79200) returned 1 [0065.265] CloseHandle (hObject=0x328) returned 1 [0065.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0065.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0065.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.265] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.265] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.265] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45984) returned 1 [0065.265] CloseHandle (hObject=0x328) returned 1 [0065.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0065.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0065.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.266] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.266] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.266] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=80224) returned 1 [0065.266] CloseHandle (hObject=0x328) returned 1 [0065.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0065.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0065.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.266] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.267] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.267] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=46496) returned 1 [0065.267] CloseHandle (hObject=0x328) returned 1 [0065.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0065.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0065.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.267] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.267] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.267] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=74072) returned 1 [0065.268] CloseHandle (hObject=0x328) returned 1 [0065.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0065.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0065.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.268] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.268] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.268] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=74144) returned 1 [0065.268] CloseHandle (hObject=0x328) returned 1 [0065.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0065.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0065.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.268] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.269] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.269] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=44960) returned 1 [0065.269] CloseHandle (hObject=0x328) returned 1 [0065.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0065.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0065.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.269] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.269] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.270] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77664) returned 1 [0065.271] CloseHandle (hObject=0x328) returned 1 [0065.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0065.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0065.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.271] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45984) returned 1 [0065.271] CloseHandle (hObject=0x328) returned 1 [0065.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0065.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0065.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.272] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77664) returned 1 [0065.272] CloseHandle (hObject=0x328) returned 1 [0065.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0065.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0065.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.274] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=75104) returned 1 [0065.274] CloseHandle (hObject=0x328) returned 1 [0065.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0065.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0065.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.274] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76640) returned 1 [0065.274] CloseHandle (hObject=0x328) returned 1 [0065.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0065.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0065.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.275] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0065.275] CloseHandle (hObject=0x328) returned 1 [0065.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0065.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0065.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0065.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.276] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.279] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3695719) returned 1 [0065.279] CloseHandle (hObject=0x328) returned 1 [0065.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0065.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0065.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0065.279] SetEvent (hEvent=0x2e4) returned 1 [0065.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0066.476] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=3878410) returned 1 [0066.477] CloseHandle (hObject=0x328) returned 1 [0066.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0066.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0066.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0066.477] SetEvent (hEvent=0x2e4) returned 1 [0066.478] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0066.489] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=1985867) returned 1 [0066.489] CloseHandle (hObject=0x314) returned 1 [0066.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0066.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0066.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0066.490] SetEvent (hEvent=0x2e4) returned 1 [0066.491] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0066.514] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=2373000) returned 1 [0066.514] CloseHandle (hObject=0x314) returned 1 [0066.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0066.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0066.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0066.518] SetEvent (hEvent=0x2e4) returned 1 [0066.518] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0066.546] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=174959) returned 1 [0066.546] CloseHandle (hObject=0x328) returned 1 [0066.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0066.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0066.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0066.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.547] SetEvent (hEvent=0x2e4) returned 1 [0066.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0066.696] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=177414) returned 1 [0066.696] CloseHandle (hObject=0x304) returned 1 [0066.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0066.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0066.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0066.696] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.696] SetEvent (hEvent=0x2e4) returned 1 [0066.788] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0066.958] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=143754) returned 1 [0066.958] CloseHandle (hObject=0x308) returned 1 [0066.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0066.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0066.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0066.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.959] SetEvent (hEvent=0x2e4) returned 1 [0066.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.014] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=145419) returned 1 [0067.014] CloseHandle (hObject=0x308) returned 1 [0067.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0067.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0067.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.014] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.014] SetEvent (hEvent=0x2e4) returned 1 [0067.015] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.015] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=162331) returned 1 [0067.015] CloseHandle (hObject=0x308) returned 1 [0067.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0067.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0067.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.015] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.015] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.290] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=164347) returned 1 [0067.290] CloseHandle (hObject=0x328) returned 1 [0067.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0067.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0067.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.291] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.291] SetEvent (hEvent=0x2e4) returned 1 [0067.291] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.291] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=154427) returned 1 [0067.291] CloseHandle (hObject=0x328) returned 1 [0067.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0067.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0067.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.291] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.291] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.292] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=156245) returned 1 [0067.292] CloseHandle (hObject=0x328) returned 1 [0067.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0067.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0067.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.292] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.292] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.428] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=44859) returned 1 [0067.428] CloseHandle (hObject=0x328) returned 1 [0067.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0067.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0067.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.428] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.428] SetEvent (hEvent=0x2e4) returned 1 [0067.429] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.429] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=85862) returned 1 [0067.429] CloseHandle (hObject=0x328) returned 1 [0067.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0067.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0067.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.429] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.429] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.429] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=86178) returned 1 [0067.429] CloseHandle (hObject=0x328) returned 1 [0067.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0067.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0067.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.432] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.432] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.432] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=49091) returned 1 [0067.432] CloseHandle (hObject=0x328) returned 1 [0067.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0067.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0067.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.433] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.433] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.433] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=79200) returned 1 [0067.433] CloseHandle (hObject=0x328) returned 1 [0067.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0067.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0067.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.433] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.433] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.434] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=79192) returned 1 [0067.434] CloseHandle (hObject=0x328) returned 1 [0067.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0067.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0067.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.434] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.434] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.434] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45984) returned 1 [0067.434] CloseHandle (hObject=0x328) returned 1 [0067.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0067.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0067.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.435] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.435] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.435] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76640) returned 1 [0067.435] CloseHandle (hObject=0x328) returned 1 [0067.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0067.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0067.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.435] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.435] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.436] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=78688) returned 1 [0067.436] CloseHandle (hObject=0x328) returned 1 [0067.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0067.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0067.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.436] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.436] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.436] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45976) returned 1 [0067.436] CloseHandle (hObject=0x328) returned 1 [0067.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0067.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0067.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.436] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.437] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.437] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77144) returned 1 [0067.437] CloseHandle (hObject=0x328) returned 1 [0067.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0067.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0067.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.437] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.437] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.437] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0067.437] CloseHandle (hObject=0x328) returned 1 [0067.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0067.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0067.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.438] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.438] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.438] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=67424) returned 1 [0067.438] CloseHandle (hObject=0x328) returned 1 [0067.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0067.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0067.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.438] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.439] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.439] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=42904) returned 1 [0067.439] CloseHandle (hObject=0x328) returned 1 [0067.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0067.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0067.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.439] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.439] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.439] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=66912) returned 1 [0067.439] CloseHandle (hObject=0x328) returned 1 [0067.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0067.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0067.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.440] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.440] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.440] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=42912) returned 1 [0067.440] CloseHandle (hObject=0x328) returned 1 [0067.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0067.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0067.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.440] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.440] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.441] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=75616) returned 1 [0067.441] CloseHandle (hObject=0x328) returned 1 [0067.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0067.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0067.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.441] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.441] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.441] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=75608) returned 1 [0067.441] CloseHandle (hObject=0x328) returned 1 [0067.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0067.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0067.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.441] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.442] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.442] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=811936) returned 1 [0067.442] CloseHandle (hObject=0x328) returned 1 [0067.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0067.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0067.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\memtest.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.442] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.442] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.442] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=75616) returned 1 [0067.443] CloseHandle (hObject=0x328) returned 1 [0067.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0067.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0067.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.443] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.443] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.443] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0067.443] CloseHandle (hObject=0x328) returned 1 [0067.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0067.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0067.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.443] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.444] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.444] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=78176) returned 1 [0067.444] CloseHandle (hObject=0x328) returned 1 [0067.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0067.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0067.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.444] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.444] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.444] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0067.444] CloseHandle (hObject=0x328) returned 1 [0067.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0067.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0067.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.445] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.445] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.451] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77656) returned 1 [0067.451] CloseHandle (hObject=0x328) returned 1 [0067.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0067.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0067.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.452] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.452] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.452] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45984) returned 1 [0067.452] CloseHandle (hObject=0x328) returned 1 [0067.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0067.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0067.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.452] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.453] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76640) returned 1 [0067.453] CloseHandle (hObject=0x328) returned 1 [0067.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0067.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0067.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.453] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.453] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0067.453] CloseHandle (hObject=0x328) returned 1 [0067.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0067.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0067.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.454] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.454] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.454] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76640) returned 1 [0067.454] CloseHandle (hObject=0x328) returned 1 [0067.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0067.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0067.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.454] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.455] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45984) returned 1 [0067.455] CloseHandle (hObject=0x328) returned 1 [0067.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0067.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0067.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.455] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=74080) returned 1 [0067.455] CloseHandle (hObject=0x328) returned 1 [0067.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0067.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0067.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.456] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=54168) returned 1 [0067.456] CloseHandle (hObject=0x328) returned 1 [0067.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0067.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0067.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.457] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=92576) returned 1 [0067.457] CloseHandle (hObject=0x328) returned 1 [0067.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0067.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0067.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.457] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.457] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.457] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=12192) returned 1 [0067.457] CloseHandle (hObject=0x328) returned 1 [0067.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0067.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0067.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.458] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.458] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.458] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76128) returned 1 [0067.458] CloseHandle (hObject=0x328) returned 1 [0067.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0067.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0067.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.458] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.459] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.459] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77152) returned 1 [0067.459] CloseHandle (hObject=0x328) returned 1 [0067.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0067.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0067.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.459] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.459] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.459] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=44960) returned 1 [0067.459] CloseHandle (hObject=0x328) returned 1 [0067.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0067.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0067.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.460] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.460] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.460] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77144) returned 1 [0067.460] CloseHandle (hObject=0x328) returned 1 [0067.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0067.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0067.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.460] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.461] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.467] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76640) returned 1 [0067.467] CloseHandle (hObject=0x328) returned 1 [0067.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0067.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0067.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.467] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.467] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.468] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77152) returned 1 [0067.468] CloseHandle (hObject=0x328) returned 1 [0067.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0067.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0067.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.468] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.468] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.468] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=44888) returned 1 [0067.468] CloseHandle (hObject=0x328) returned 1 [0067.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0067.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0067.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.469] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.469] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.469] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77152) returned 1 [0067.469] CloseHandle (hObject=0x328) returned 1 [0067.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0067.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0067.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.469] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.470] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.470] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=76128) returned 1 [0067.470] CloseHandle (hObject=0x328) returned 1 [0067.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0067.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0067.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.470] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.470] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.470] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=44952) returned 1 [0067.470] CloseHandle (hObject=0x328) returned 1 [0067.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0067.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0067.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.471] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=75096) returned 1 [0067.471] CloseHandle (hObject=0x328) returned 1 [0067.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0067.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0067.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0067.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.472] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.472] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=45472) returned 1 [0067.472] CloseHandle (hObject=0x328) returned 1 [0068.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0068.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0068.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.228] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.229] SetEvent (hEvent=0x2e4) returned 1 [0068.230] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.230] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=77152) returned 1 [0068.230] CloseHandle (hObject=0x300) returned 1 [0068.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0068.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0068.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.230] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.230] SetEvent (hEvent=0x2e4) returned 1 [0068.231] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.232] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=4662) returned 1 [0068.232] CloseHandle (hObject=0x300) returned 1 [0068.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0068.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0068.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.232] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.232] SetEvent (hEvent=0x2e4) returned 1 [0068.232] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.232] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=63840) returned 1 [0068.232] CloseHandle (hObject=0x300) returned 1 [0068.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0068.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0068.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.233] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.233] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.233] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=42400) returned 1 [0068.233] CloseHandle (hObject=0x300) returned 1 [0068.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0068.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0068.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.233] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.234] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=63832) returned 1 [0068.234] CloseHandle (hObject=0x300) returned 1 [0068.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0068.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0068.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.234] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=42328) returned 1 [0068.234] CloseHandle (hObject=0x300) returned 1 [0068.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0068.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0068.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.235] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=63840) returned 1 [0068.235] CloseHandle (hObject=0x300) returned 1 [0068.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0068.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0068.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.236] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=42392) returned 1 [0068.236] CloseHandle (hObject=0x300) returned 1 [0068.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0068.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0068.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.236] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.236] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.238] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=395226) returned 1 [0068.238] CloseHandle (hObject=0x300) returned 1 [0068.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0068.238] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0068.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0068.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootmgr.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.238] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.238] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0068.239] SetEvent (hEvent=0x2e4) returned 1 [0068.239] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.240] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=1) returned 1 [0068.240] CloseHandle (hObject=0x300) returned 1 [0068.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26 [0068.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26 [0068.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootnxt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.240] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.241] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.241] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.241] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootnxt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x334 [0068.241] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x1, lpOverlapped=0x0) returned 1 [0068.242] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x10, lpOverlapped=0x0) returned 1 [0068.243] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xe2, lpOverlapped=0x0) returned 1 [0068.243] CloseHandle (hObject=0x300) returned 1 [0068.243] CloseHandle (hObject=0x334) returned 1 [0068.244] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0068.245] SetEvent (hEvent=0x2e4) returned 1 [0068.245] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0068.245] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=8192) returned 1 [0068.246] CloseHandle (hObject=0x334) returned 1 [0068.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0068.246] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0068.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x26 [0068.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootsect.bak.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.246] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0068.246] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.246] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.246] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootsect.bak.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x300 [0068.250] ReadFile (in: hFile=0x334, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x2000, lpOverlapped=0x0) returned 1 [0068.252] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x2010, lpOverlapped=0x0) returned 1 [0068.253] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xf2, lpOverlapped=0x0) returned 1 [0068.253] CloseHandle (hObject=0x334) returned 1 [0068.253] CloseHandle (hObject=0x300) returned 1 [0068.254] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0068.255] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-2869].[robinhood@countermail.com].eject", dwFileAttributes=0x27) returned 1 [0068.255] SetEvent (hEvent=0x2e4) returned 1 [0068.255] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.255] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.258] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0068.258] CloseHandle (hObject=0x300) returned 1 [0068.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0068.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0068.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\application.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.258] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.258] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.258] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.258] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\application.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x334 [0068.259] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0068.261] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0068.266] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0068.266] CloseHandle (hObject=0x300) returned 1 [0068.266] CloseHandle (hObject=0x334) returned 1 [0068.268] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0068.270] SetEvent (hEvent=0x2e4) returned 1 [0068.270] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0068.271] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0068.271] CloseHandle (hObject=0x334) returned 1 [0068.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0068.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0068.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.271] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0068.271] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.271] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.271] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0068.271] ReadFile (in: hFile=0x334, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0068.979] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0068.982] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x102, lpOverlapped=0x0) returned 1 [0068.982] CloseHandle (hObject=0x334) returned 1 [0068.982] CloseHandle (hObject=0x300) returned 1 [0068.984] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0068.985] SetEvent (hEvent=0x2e4) returned 1 [0068.986] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.986] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0068.986] CloseHandle (hObject=0x300) returned 1 [0068.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0068.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0068.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.986] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0068.987] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.987] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0068.987] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x334 [0068.987] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.029] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.031] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x112, lpOverlapped=0x0) returned 1 [0069.031] CloseHandle (hObject=0x300) returned 1 [0069.031] CloseHandle (hObject=0x334) returned 1 [0069.033] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0069.035] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.045] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.046] CloseHandle (hObject=0x338) returned 1 [0069.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0069.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0069.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.046] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.046] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.046] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.046] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0069.066] ReadFile (in: hFile=0x338, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.110] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.112] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x172, lpOverlapped=0x0) returned 1 [0069.112] CloseHandle (hObject=0x338) returned 1 [0069.112] CloseHandle (hObject=0x300) returned 1 [0069.115] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0069.116] SetEvent (hEvent=0x2e4) returned 1 [0069.116] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0069.116] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.116] CloseHandle (hObject=0x300) returned 1 [0069.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0069.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0069.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.117] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0069.117] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.117] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.117] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x338 [0069.117] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.179] WriteFile (in: hFile=0x338, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.181] WriteFile (in: hFile=0x338, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0069.181] CloseHandle (hObject=0x300) returned 1 [0069.182] CloseHandle (hObject=0x338) returned 1 [0069.184] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0069.186] SetEvent (hEvent=0x2e4) returned 1 [0069.186] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.187] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.187] CloseHandle (hObject=0x338) returned 1 [0069.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0069.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0069.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.187] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.187] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.187] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.187] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0069.188] ReadFile (in: hFile=0x338, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.197] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.199] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0069.199] CloseHandle (hObject=0x338) returned 1 [0069.199] CloseHandle (hObject=0x300) returned 1 [0069.545] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0069.548] SetEvent (hEvent=0x2e4) returned 1 [0069.548] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0069.549] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.549] CloseHandle (hObject=0x300) returned 1 [0069.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0069.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0069.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.549] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0069.549] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.549] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.549] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x334 [0069.550] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.576] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.578] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x152, lpOverlapped=0x0) returned 1 [0069.579] CloseHandle (hObject=0x300) returned 1 [0069.579] CloseHandle (hObject=0x334) returned 1 [0069.581] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0069.582] SetEvent (hEvent=0x2e4) returned 1 [0069.582] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.583] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.583] CloseHandle (hObject=0x334) returned 1 [0069.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0069.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0069.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.583] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.583] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.583] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.583] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x338 [0069.590] ReadFile (in: hFile=0x334, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.594] WriteFile (in: hFile=0x338, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x338, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x152, lpOverlapped=0x0) returned 1 [0069.597] CloseHandle (hObject=0x334) returned 1 [0069.597] CloseHandle (hObject=0x338) returned 1 [0069.599] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0069.601] SetEvent (hEvent=0x2e4) returned 1 [0069.601] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.601] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.601] CloseHandle (hObject=0x338) returned 1 [0069.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0069.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0069.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.602] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.602] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.602] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.602] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x334 [0069.603] ReadFile (in: hFile=0x338, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.611] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.613] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0069.613] CloseHandle (hObject=0x338) returned 1 [0069.613] CloseHandle (hObject=0x334) returned 1 [0069.615] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0069.617] SetEvent (hEvent=0x2e4) returned 1 [0069.617] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.617] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.617] CloseHandle (hObject=0x334) returned 1 [0069.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0069.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0069.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.617] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.617] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.617] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.618] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x338 [0069.618] ReadFile (in: hFile=0x334, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.826] WriteFile (in: hFile=0x338, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.828] WriteFile (in: hFile=0x338, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0069.829] CloseHandle (hObject=0x334) returned 1 [0069.829] CloseHandle (hObject=0x338) returned 1 [0069.831] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0069.833] SetEvent (hEvent=0x2e4) returned 1 [0069.833] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.834] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0069.834] CloseHandle (hObject=0x338) returned 1 [0069.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0069.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0069.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.834] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0069.834] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.834] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0069.834] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x334 [0069.835] ReadFile (in: hFile=0x338, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0069.866] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0069.868] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0069.868] CloseHandle (hObject=0x338) returned 1 [0069.868] CloseHandle (hObject=0x334) returned 1 [0069.870] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0069.872] SetEvent (hEvent=0x2e4) returned 1 [0069.872] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.872] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=2166784) returned 1 [0069.872] CloseHandle (hObject=0x334) returned 1 [0069.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0069.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0069.873] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.873] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0069.873] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0069.874] ReadFile (in: hFile=0x334, lpBuffer=0x994058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x994058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0069.879] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0069.879] ReadFile (in: hFile=0x334, lpBuffer=0x9d4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0x9d4058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0069.885] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x383faa8 | out: lpNewFilePointer=0x0) returned 1 [0069.885] ReadFile (in: hFile=0x334, lpBuffer=0xa14058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x383fab4, lpOverlapped=0x0 | out: lpBuffer=0xa14058*, lpNumberOfBytesRead=0x383fab4*=0x40000, lpOverlapped=0x0) returned 1 [0070.149] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc18 | out: lpNewFilePointer=0x0) returned 1 [0070.149] WriteFile (in: hFile=0x334, lpBuffer=0x994020*, nNumberOfBytesToWrite=0xc0162, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0xc0162, lpOverlapped=0x0) returned 1 [0070.179] SetEndOfFile (hFile=0x334) returned 1 [0070.179] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0070.180] WriteFile (in: hFile=0x334, lpBuffer=0xa5419a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5419a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0070.181] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0070.181] WriteFile (in: hFile=0x334, lpBuffer=0xa5419a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5419a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0070.183] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fab0 | out: lpNewFilePointer=0x0) returned 1 [0070.183] WriteFile (in: hFile=0x334, lpBuffer=0xa5419a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x383fabc, lpOverlapped=0x0 | out: lpBuffer=0xa5419a*, lpNumberOfBytesWritten=0x383fabc*=0x40000, lpOverlapped=0x0) returned 1 [0070.482] CloseHandle (hObject=0x334) returned 1 [0071.088] SetEvent (hEvent=0x2e4) returned 1 [0071.099] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.481] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.481] CloseHandle (hObject=0x314) returned 1 [0071.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0071.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0071.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.481] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.481] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.481] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.482] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0071.482] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0071.484] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0071.486] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0071.486] CloseHandle (hObject=0x314) returned 1 [0071.486] CloseHandle (hObject=0x320) returned 1 [0071.488] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0071.490] SetEvent (hEvent=0x2e4) returned 1 [0071.490] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.490] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.490] CloseHandle (hObject=0x320) returned 1 [0071.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0071.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0071.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.490] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.491] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.491] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.491] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0071.492] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0071.494] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0071.496] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0071.496] CloseHandle (hObject=0x320) returned 1 [0071.496] CloseHandle (hObject=0x314) returned 1 [0071.499] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0071.500] SetEvent (hEvent=0x2e4) returned 1 [0071.500] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.500] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.500] CloseHandle (hObject=0x314) returned 1 [0071.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0071.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0071.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.501] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.501] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.501] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.501] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0071.501] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0071.504] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0071.506] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0071.506] CloseHandle (hObject=0x314) returned 1 [0071.506] CloseHandle (hObject=0x320) returned 1 [0071.513] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0071.514] SetEvent (hEvent=0x2e4) returned 1 [0071.514] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.515] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.515] CloseHandle (hObject=0x320) returned 1 [0071.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0071.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0071.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.515] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.515] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.515] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.515] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0071.930] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0071.934] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0071.937] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0071.937] CloseHandle (hObject=0x320) returned 1 [0071.937] CloseHandle (hObject=0x314) returned 1 [0071.939] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0071.941] SetEvent (hEvent=0x2e4) returned 1 [0071.941] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.942] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.942] CloseHandle (hObject=0x314) returned 1 [0071.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0071.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0071.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.942] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.942] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.942] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.942] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0071.943] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0071.947] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0071.949] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0071.949] CloseHandle (hObject=0x314) returned 1 [0071.949] CloseHandle (hObject=0x320) returned 1 [0071.952] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0071.954] SetEvent (hEvent=0x2e4) returned 1 [0071.954] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.956] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.956] CloseHandle (hObject=0x320) returned 1 [0071.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0071.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0071.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.957] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.957] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.957] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.957] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0071.958] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0071.961] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0071.964] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0071.964] CloseHandle (hObject=0x320) returned 1 [0071.964] CloseHandle (hObject=0x314) returned 1 [0071.969] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0071.971] SetEvent (hEvent=0x2e4) returned 1 [0071.971] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.971] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0071.971] CloseHandle (hObject=0x314) returned 1 [0071.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0071.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0071.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.972] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0071.972] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.972] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0071.972] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0071.972] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0072.187] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0072.189] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x152, lpOverlapped=0x0) returned 1 [0072.189] CloseHandle (hObject=0x314) returned 1 [0072.189] CloseHandle (hObject=0x320) returned 1 [0072.191] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0072.193] SetEvent (hEvent=0x2e4) returned 1 [0072.193] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0072.194] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0072.194] CloseHandle (hObject=0x320) returned 1 [0072.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0072.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0072.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.194] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0072.194] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.194] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.194] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0072.194] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0072.205] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0072.207] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0072.207] CloseHandle (hObject=0x320) returned 1 [0072.207] CloseHandle (hObject=0x314) returned 1 [0072.210] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0072.211] SetEvent (hEvent=0x2e4) returned 1 [0072.211] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.212] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0072.212] CloseHandle (hObject=0x314) returned 1 [0072.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0072.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0072.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.213] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.213] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.213] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.213] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0072.214] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0072.218] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0072.223] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0072.223] CloseHandle (hObject=0x314) returned 1 [0072.223] CloseHandle (hObject=0x320) returned 1 [0072.226] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0072.228] SetEvent (hEvent=0x2e4) returned 1 [0072.228] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0072.228] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0072.229] CloseHandle (hObject=0x320) returned 1 [0072.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0072.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0072.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.229] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0072.229] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.229] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.229] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0072.230] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0072.233] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0072.397] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0072.397] CloseHandle (hObject=0x320) returned 1 [0072.397] CloseHandle (hObject=0x314) returned 1 [0072.400] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0072.401] SetEvent (hEvent=0x2e4) returned 1 [0072.402] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.402] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0072.402] CloseHandle (hObject=0x314) returned 1 [0072.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0072.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0072.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.402] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.403] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.403] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.403] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0072.403] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0072.406] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0072.409] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0072.409] CloseHandle (hObject=0x314) returned 1 [0072.409] CloseHandle (hObject=0x320) returned 1 [0072.411] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0072.412] SetEvent (hEvent=0x2e4) returned 1 [0072.412] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0072.413] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0072.413] CloseHandle (hObject=0x320) returned 1 [0072.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0072.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0072.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.413] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0072.413] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.413] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.413] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0072.413] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0072.416] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0072.418] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0072.418] CloseHandle (hObject=0x320) returned 1 [0072.418] CloseHandle (hObject=0x314) returned 1 [0072.421] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0072.422] SetEvent (hEvent=0x2e4) returned 1 [0072.422] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.422] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=1052672) returned 1 [0072.422] CloseHandle (hObject=0x314) returned 1 [0072.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0072.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0072.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.422] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.423] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.423] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0072.423] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0072.423] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x101000, lpOverlapped=0x0) returned 1 [0072.675] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x101010, lpOverlapped=0x0) returned 1 [0072.698] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0072.698] CloseHandle (hObject=0x314) returned 1 [0072.698] CloseHandle (hObject=0x320) returned 1 [0073.121] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0073.123] SetEvent (hEvent=0x2e4) returned 1 [0073.124] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.124] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.124] CloseHandle (hObject=0x320) returned 1 [0073.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0073.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0073.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.125] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.125] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.125] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.125] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x32c [0073.125] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.414] WriteFile (in: hFile=0x32c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.416] WriteFile (in: hFile=0x32c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0073.416] CloseHandle (hObject=0x320) returned 1 [0073.416] CloseHandle (hObject=0x32c) returned 1 [0073.418] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0073.420] SetEvent (hEvent=0x2e4) returned 1 [0073.420] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0073.421] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.421] CloseHandle (hObject=0x32c) returned 1 [0073.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0073.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0073.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.421] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0073.421] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.421] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.421] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0073.426] ReadFile (in: hFile=0x32c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.428] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.430] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0073.430] CloseHandle (hObject=0x32c) returned 1 [0073.430] CloseHandle (hObject=0x320) returned 1 [0073.432] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0073.434] SetEvent (hEvent=0x2e4) returned 1 [0073.434] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.434] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.434] CloseHandle (hObject=0x320) returned 1 [0073.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0073.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0073.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.434] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.435] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.435] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.435] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0073.436] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.439] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.441] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x122, lpOverlapped=0x0) returned 1 [0073.441] CloseHandle (hObject=0x320) returned 1 [0073.441] CloseHandle (hObject=0x33c) returned 1 [0073.443] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0073.445] SetEvent (hEvent=0x2e4) returned 1 [0073.445] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0073.446] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.446] CloseHandle (hObject=0x33c) returned 1 [0073.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0073.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0073.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.446] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0073.446] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.446] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.446] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0073.447] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.449] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.451] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x172, lpOverlapped=0x0) returned 1 [0073.451] CloseHandle (hObject=0x33c) returned 1 [0073.451] CloseHandle (hObject=0x320) returned 1 [0073.453] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0073.518] SetEvent (hEvent=0x2e4) returned 1 [0073.519] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.721] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.722] CloseHandle (hObject=0x314) returned 1 [0073.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0073.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0073.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.722] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.722] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.722] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.722] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0073.722] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.725] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.727] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0073.727] CloseHandle (hObject=0x314) returned 1 [0073.728] CloseHandle (hObject=0x320) returned 1 [0073.730] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0073.732] SetEvent (hEvent=0x2e4) returned 1 [0073.732] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.732] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.732] CloseHandle (hObject=0x320) returned 1 [0073.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0073.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0073.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.733] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.733] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.733] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.733] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0073.733] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x162, lpOverlapped=0x0) returned 1 [0073.738] CloseHandle (hObject=0x320) returned 1 [0073.738] CloseHandle (hObject=0x314) returned 1 [0073.740] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0073.742] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.742] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.742] CloseHandle (hObject=0x314) returned 1 [0073.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0073.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0073.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.742] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.743] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.743] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.743] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0073.744] ReadFile (in: hFile=0x314, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.746] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0073.748] CloseHandle (hObject=0x314) returned 1 [0073.748] CloseHandle (hObject=0x320) returned 1 [0073.750] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0073.752] SetEvent (hEvent=0x2e4) returned 1 [0073.752] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.752] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0073.752] CloseHandle (hObject=0x320) returned 1 [0073.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0073.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0073.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.756] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0073.756] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.756] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0073.756] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0073.756] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0073.759] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0073.761] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0073.761] CloseHandle (hObject=0x320) returned 1 [0073.761] CloseHandle (hObject=0x314) returned 1 [0073.763] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0074.115] SetEvent (hEvent=0x2e4) returned 1 [0074.115] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0074.115] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0074.115] CloseHandle (hObject=0x320) returned 1 [0074.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0074.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0074.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0074.116] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0074.116] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0074.116] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0074.116] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0074.116] ReadFile (in: hFile=0x320, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0074.156] CloseHandle (hObject=0x320) returned 1 [0074.156] CloseHandle (hObject=0x33c) returned 1 [0074.158] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0074.207] SetEvent (hEvent=0x2e4) returned 1 [0074.207] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0074.269] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0074.269] CloseHandle (hObject=0x330) returned 1 [0074.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0074.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0074.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0074.342] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0074.342] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0074.342] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0074.342] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x318 [0074.342] ReadFile (in: hFile=0x32c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0074.682] WriteFile (in: hFile=0x318, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0075.766] WriteFile (in: hFile=0x318, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0075.766] CloseHandle (hObject=0x32c) returned 1 [0075.766] CloseHandle (hObject=0x318) returned 1 [0076.226] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0076.238] SetEvent (hEvent=0x2e4) returned 1 [0076.257] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.570] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0076.570] CloseHandle (hObject=0x33c) returned 1 [0076.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0076.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0076.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.570] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.580] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.580] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.580] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0076.581] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0076.593] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0076.596] WriteFile (in: hFile=0x300, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x162, lpOverlapped=0x0) returned 1 [0076.596] CloseHandle (hObject=0x33c) returned 1 [0076.596] CloseHandle (hObject=0x300) returned 1 [0076.598] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0076.599] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.600] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0076.600] CloseHandle (hObject=0x300) returned 1 [0076.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0076.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0076.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.600] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.600] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.600] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.600] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0076.600] ReadFile (in: hFile=0x300, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0076.612] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0076.634] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x152, lpOverlapped=0x0) returned 1 [0076.687] CloseHandle (hObject=0x300) returned 1 [0076.687] CloseHandle (hObject=0x33c) returned 1 [0076.690] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0076.692] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.692] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0076.692] CloseHandle (hObject=0x33c) returned 1 [0076.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0076.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0076.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.692] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.693] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0076.699] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0076.702] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0076.705] WriteFile (in: hFile=0x320, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0076.705] CloseHandle (hObject=0x33c) returned 1 [0076.705] CloseHandle (hObject=0x320) returned 1 [0076.708] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0076.710] SetEvent (hEvent=0x2e4) returned 1 [0076.710] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.712] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0076.712] CloseHandle (hObject=0x33c) returned 1 [0076.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0076.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0076.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.712] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.712] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.712] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0076.713] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0076.713] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0077.215] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0077.217] WriteFile (in: hFile=0x314, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x152, lpOverlapped=0x0) returned 1 [0077.217] CloseHandle (hObject=0x33c) returned 1 [0077.218] CloseHandle (hObject=0x314) returned 1 [0077.325] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0077.348] SetEvent (hEvent=0x2e4) returned 1 [0077.349] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0077.349] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0077.349] CloseHandle (hObject=0x318) returned 1 [0077.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0077.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0077.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0077.349] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0077.350] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0077.350] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0077.350] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0077.350] ReadFile (in: hFile=0x318, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0077.353] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0077.356] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x152, lpOverlapped=0x0) returned 1 [0077.356] CloseHandle (hObject=0x318) returned 1 [0077.356] CloseHandle (hObject=0x33c) returned 1 [0077.358] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0077.359] SetEvent (hEvent=0x2e4) returned 1 [0077.359] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0077.359] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=69632) returned 1 [0077.359] CloseHandle (hObject=0x33c) returned 1 [0077.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0077.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0077.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0077.360] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0077.360] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0077.360] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0077.360] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x318 [0077.362] ReadFile (in: hFile=0x33c, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x11000, lpOverlapped=0x0) returned 1 [0077.364] WriteFile (in: hFile=0x318, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x11010, lpOverlapped=0x0) returned 1 [0077.366] WriteFile (in: hFile=0x318, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x132, lpOverlapped=0x0) returned 1 [0077.367] CloseHandle (hObject=0x33c) returned 1 [0077.367] CloseHandle (hObject=0x318) returned 1 [0077.369] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0077.370] SetEvent (hEvent=0x2e4) returned 1 [0077.370] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0077.370] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x383fc58 | out: lpFileSize=0x383fc58*=1052672) returned 1 [0077.370] CloseHandle (hObject=0x318) returned 1 [0077.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0077.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0077.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0077.371] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0077.371] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0077.371] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x383fc20 | out: lpNewFilePointer=0x0) returned 1 [0077.371] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0077.371] ReadFile (in: hFile=0x318, lpBuffer=0x994020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x383fc2c, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesRead=0x383fc2c*=0x101000, lpOverlapped=0x0) returned 1 [0077.699] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x101010, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x33c, lpBuffer=0x994020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x383fc10, lpOverlapped=0x0 | out: lpBuffer=0x994020*, lpNumberOfBytesWritten=0x383fc10*=0x142, lpOverlapped=0x0) returned 1 [0077.721] CloseHandle (hObject=0x318) returned 1 [0077.721] CloseHandle (hObject=0x33c) Thread: id = 28 os_tid = 0x3cc [0051.420] GetProcessHeap () returned 0x130000 [0051.420] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7b2740 [0051.421] GetProcessHeap () returned 0x130000 [0051.421] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x10000) returned 0x7c2748 [0051.421] GetProcessHeap () returned 0x130000 [0051.421] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x28) returned 0x15be10 [0051.421] GetProcessHeap () returned 0x130000 [0051.421] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x110102) returned 0xab4020 [0051.424] GetProcessHeap () returned 0x130000 [0051.424] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x50) returned 0x14ed00 [0051.424] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0051.424] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0051.424] Wow64DisableWow64FsRedirection (in: OldValue=0x397fe4c | out: OldValue=0x397fe4c*=0x0) returned 1 [0051.424] GetProcessHeap () returned 0x130000 [0051.424] HeapFree (in: hHeap=0x130000, dwFlags=0x0, lpMem=0x14ed00 | out: hHeap=0x130000) returned 1 [0051.424] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.618] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=6004) returned 1 [0051.618] CloseHandle (hObject=0x304) returned 1 [0051.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0051.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0051.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.632] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.632] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.632] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.632] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0051.633] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x1774, lpOverlapped=0x0) returned 1 [0051.648] WriteFile (in: hFile=0x2fc, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x1780, lpOverlapped=0x0) returned 1 [0051.649] WriteFile (in: hFile=0x2fc, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x122, lpOverlapped=0x0) returned 1 [0051.649] CloseHandle (hObject=0x2e0) returned 1 [0051.649] CloseHandle (hObject=0x2fc) returned 1 [0051.650] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0051.651] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.659] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=156) returned 1 [0051.659] CloseHandle (hObject=0x2e0) returned 1 [0051.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0051.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0051.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.660] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.660] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.660] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.660] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0051.660] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x9c, lpOverlapped=0x0) returned 1 [0051.661] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xa0, lpOverlapped=0x0) returned 1 [0051.662] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0051.662] CloseHandle (hObject=0x2e0) returned 1 [0051.662] CloseHandle (hObject=0x304) returned 1 [0051.663] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0051.664] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.664] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=577) returned 1 [0051.664] CloseHandle (hObject=0x304) returned 1 [0051.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0051.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0051.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.665] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.665] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.665] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.665] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e0 [0051.665] ReadFile (in: hFile=0x304, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x241, lpOverlapped=0x0) returned 1 [0051.676] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x250, lpOverlapped=0x0) returned 1 [0051.677] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x112, lpOverlapped=0x0) returned 1 [0051.677] CloseHandle (hObject=0x304) returned 1 [0051.677] CloseHandle (hObject=0x2e0) returned 1 [0051.678] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0051.679] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.899] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=74) returned 1 [0051.900] CloseHandle (hObject=0x2e0) returned 1 [0051.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0051.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0051.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.900] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.900] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.900] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.900] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0051.900] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4a, lpOverlapped=0x0) returned 1 [0051.909] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x50, lpOverlapped=0x0) returned 1 [0051.909] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0051.909] CloseHandle (hObject=0x2e0) returned 1 [0051.910] CloseHandle (hObject=0x304) returned 1 [0051.910] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0051.911] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.926] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=307) returned 1 [0051.926] CloseHandle (hObject=0x2e0) returned 1 [0051.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0051.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0051.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.926] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.927] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.927] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.927] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0051.932] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x133, lpOverlapped=0x0) returned 1 [0051.933] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x140, lpOverlapped=0x0) returned 1 [0051.934] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0051.938] CloseHandle (hObject=0x2e0) returned 1 [0051.938] CloseHandle (hObject=0x30c) returned 1 [0051.939] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0051.940] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.940] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=129) returned 1 [0051.940] CloseHandle (hObject=0x30c) returned 1 [0051.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0051.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0051.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0051.941] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.941] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.941] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0051.941] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x300 [0052.004] ReadFile (in: hFile=0x30c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x81, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x90, lpOverlapped=0x0) returned 1 [0052.006] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0052.007] CloseHandle (hObject=0x30c) returned 1 [0052.007] CloseHandle (hObject=0x300) returned 1 [0052.008] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0052.009] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.171] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=7567) returned 1 [0052.172] CloseHandle (hObject=0x304) returned 1 [0052.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0052.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0052.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.172] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.172] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0052.174] ReadFile (in: hFile=0x304, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x1d8f, lpOverlapped=0x0) returned 1 [0052.187] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x1d90, lpOverlapped=0x0) returned 1 [0052.188] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0052.188] CloseHandle (hObject=0x304) returned 1 [0052.188] CloseHandle (hObject=0x30c) returned 1 [0052.189] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0052.190] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.200] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=17240) returned 1 [0052.200] CloseHandle (hObject=0x300) returned 1 [0052.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0052.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0052.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.200] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.200] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.200] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.200] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0052.201] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4358, lpOverlapped=0x0) returned 1 [0052.205] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4360, lpOverlapped=0x0) returned 1 [0052.206] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0052.206] CloseHandle (hObject=0x300) returned 1 [0052.207] CloseHandle (hObject=0x30c) returned 1 [0052.207] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0052.208] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.209] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=60816) returned 1 [0052.209] CloseHandle (hObject=0x30c) returned 1 [0052.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0052.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0052.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.209] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.209] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.209] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.209] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0052.209] ReadFile (in: hFile=0x30c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xed90, lpOverlapped=0x0) returned 1 [0052.215] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xeda0, lpOverlapped=0x0) returned 1 [0052.217] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0052.217] CloseHandle (hObject=0x30c) returned 1 [0052.217] CloseHandle (hObject=0x300) returned 1 [0052.219] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0052.229] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.231] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3726) returned 1 [0052.231] CloseHandle (hObject=0x304) returned 1 [0052.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0052.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0052.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.234] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.234] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.234] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.234] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0052.243] ReadFile (in: hFile=0x304, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xe8e, lpOverlapped=0x0) returned 1 [0052.257] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xe90, lpOverlapped=0x0) returned 1 [0052.258] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0052.258] CloseHandle (hObject=0x304) returned 1 [0052.258] CloseHandle (hObject=0x30c) returned 1 [0052.259] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0052.260] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.260] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18264) returned 1 [0052.260] CloseHandle (hObject=0x30c) returned 1 [0052.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0052.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0052.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.260] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.260] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.260] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.260] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0052.260] ReadFile (in: hFile=0x30c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4758, lpOverlapped=0x0) returned 1 [0052.271] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4760, lpOverlapped=0x0) returned 1 [0052.272] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0052.272] CloseHandle (hObject=0x30c) returned 1 [0052.272] CloseHandle (hObject=0x304) returned 1 [0052.273] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0052.274] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.289] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=77748) returned 1 [0052.289] CloseHandle (hObject=0x304) returned 1 [0052.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0052.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0052.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.290] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.290] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.290] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.290] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0052.290] ReadFile (in: hFile=0x304, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x12fb4, lpOverlapped=0x0) returned 1 [0052.293] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x12fc0, lpOverlapped=0x0) returned 1 [0052.300] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0052.301] CloseHandle (hObject=0x304) returned 1 [0052.301] CloseHandle (hObject=0x30c) returned 1 [0052.303] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0052.304] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.305] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18264) returned 1 [0052.305] CloseHandle (hObject=0x30c) returned 1 [0052.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0052.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0052.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.306] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.306] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.306] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.306] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0052.306] ReadFile (in: hFile=0x30c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4758, lpOverlapped=0x0) returned 1 [0052.308] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4760, lpOverlapped=0x0) returned 1 [0052.309] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0052.309] CloseHandle (hObject=0x30c) returned 1 [0052.309] CloseHandle (hObject=0x304) returned 1 [0052.310] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0052.311] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.311] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3419) returned 1 [0052.311] CloseHandle (hObject=0x304) returned 1 [0052.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0052.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0052.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.312] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.312] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.312] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.312] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0052.314] ReadFile (in: hFile=0x304, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xd5b, lpOverlapped=0x0) returned 1 [0052.324] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xd60, lpOverlapped=0x0) returned 1 [0052.325] WriteFile (in: hFile=0x30c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0052.325] CloseHandle (hObject=0x304) returned 1 [0052.325] CloseHandle (hObject=0x30c) returned 1 [0052.326] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0052.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.331] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=82346) returned 1 [0052.331] CloseHandle (hObject=0x30c) returned 1 [0052.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0052.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0052.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0052.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.331] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.331] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0052.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0052.332] ReadFile (in: hFile=0x30c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x141aa, lpOverlapped=0x0) returned 1 [0052.545] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x141b0, lpOverlapped=0x0) returned 1 [0052.569] WriteFile (in: hFile=0x304, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0052.570] CloseHandle (hObject=0x30c) returned 1 [0052.570] CloseHandle (hObject=0x304) returned 1 [0052.572] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0052.573] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.081] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=77232) returned 1 [0053.081] CloseHandle (hObject=0x328) returned 1 [0053.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0053.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0053.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.086] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.092] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.092] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.094] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.094] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x12db0, lpOverlapped=0x0) returned 1 [0053.117] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x12dc0, lpOverlapped=0x0) returned 1 [0053.119] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.119] CloseHandle (hObject=0x31c) returned 1 [0053.119] CloseHandle (hObject=0x320) returned 1 [0053.122] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0053.123] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.123] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=82962) returned 1 [0053.123] CloseHandle (hObject=0x320) returned 1 [0053.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0053.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0053.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.124] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.124] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.124] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.124] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0053.124] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x14412, lpOverlapped=0x0) returned 1 [0053.127] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x14420, lpOverlapped=0x0) returned 1 [0053.129] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.129] CloseHandle (hObject=0x320) returned 1 [0053.129] CloseHandle (hObject=0x31c) returned 1 [0053.131] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0053.132] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.132] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18776) returned 1 [0053.133] CloseHandle (hObject=0x31c) returned 1 [0053.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0053.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0053.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.133] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.133] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.133] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.133] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.133] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4958, lpOverlapped=0x0) returned 1 [0053.135] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4960, lpOverlapped=0x0) returned 1 [0053.136] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.137] CloseHandle (hObject=0x31c) returned 1 [0053.137] CloseHandle (hObject=0x320) returned 1 [0053.138] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0053.139] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.139] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=6851) returned 1 [0053.139] CloseHandle (hObject=0x320) returned 1 [0053.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0053.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0053.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.139] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.139] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.140] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.140] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0053.141] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x1ac3, lpOverlapped=0x0) returned 1 [0053.414] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x1ad0, lpOverlapped=0x0) returned 1 [0053.433] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0053.433] CloseHandle (hObject=0x320) returned 1 [0053.433] CloseHandle (hObject=0x31c) returned 1 [0053.437] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0053.451] SetEvent (hEvent=0x2e4) returned 1 [0053.451] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.452] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3643) returned 1 [0053.452] CloseHandle (hObject=0x2e0) returned 1 [0053.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0053.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0053.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.452] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.452] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.452] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.452] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.456] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xe3b, lpOverlapped=0x0) returned 1 [0053.458] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xe40, lpOverlapped=0x0) returned 1 [0053.459] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0053.459] CloseHandle (hObject=0x2e0) returned 1 [0053.459] CloseHandle (hObject=0x320) returned 1 [0053.460] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0053.460] SetEvent (hEvent=0x2e4) returned 1 [0053.461] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.461] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=80060) returned 1 [0053.461] CloseHandle (hObject=0x320) returned 1 [0053.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0053.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0053.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.461] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.461] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.461] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.461] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.461] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x138bc, lpOverlapped=0x0) returned 1 [0053.465] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x138c0, lpOverlapped=0x0) returned 1 [0053.469] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.469] CloseHandle (hObject=0x320) returned 1 [0053.469] CloseHandle (hObject=0x2e0) returned 1 [0053.471] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0053.473] SetEvent (hEvent=0x2e4) returned 1 [0053.473] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.474] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18264) returned 1 [0053.474] CloseHandle (hObject=0x2e0) returned 1 [0053.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0053.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0053.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.474] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.474] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.474] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.474] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.474] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4758, lpOverlapped=0x0) returned 1 [0053.476] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4760, lpOverlapped=0x0) returned 1 [0053.477] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.477] CloseHandle (hObject=0x2e0) returned 1 [0053.477] CloseHandle (hObject=0x320) returned 1 [0053.478] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0053.479] SetEvent (hEvent=0x2e4) returned 1 [0053.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.480] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=10125) returned 1 [0053.480] CloseHandle (hObject=0x320) returned 1 [0053.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0053.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0053.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.480] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.480] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.480] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.480] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.482] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x278d, lpOverlapped=0x0) returned 1 [0053.485] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x2790, lpOverlapped=0x0) returned 1 [0053.486] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0053.486] CloseHandle (hObject=0x320) returned 1 [0053.486] CloseHandle (hObject=0x2e0) returned 1 [0053.487] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0053.488] SetEvent (hEvent=0x2e4) returned 1 [0053.488] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.488] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=68226) returned 1 [0053.488] CloseHandle (hObject=0x2e0) returned 1 [0053.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0053.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0053.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.488] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.489] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.489] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.489] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.489] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x10a82, lpOverlapped=0x0) returned 1 [0053.653] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x10a90, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.655] CloseHandle (hObject=0x2e0) returned 1 [0053.655] CloseHandle (hObject=0x320) returned 1 [0053.657] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0053.658] SetEvent (hEvent=0x2e4) returned 1 [0053.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.658] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=65238) returned 1 [0053.658] CloseHandle (hObject=0x320) returned 1 [0053.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0053.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0053.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.659] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.659] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.659] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.659] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0053.661] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xfed6, lpOverlapped=0x0) returned 1 [0053.663] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xfee0, lpOverlapped=0x0) returned 1 [0053.665] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.665] CloseHandle (hObject=0x320) returned 1 [0053.665] CloseHandle (hObject=0x2e0) returned 1 [0053.667] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0053.668] SetEvent (hEvent=0x2e4) returned 1 [0053.668] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.669] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=15192) returned 1 [0053.669] CloseHandle (hObject=0x2e0) returned 1 [0053.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0053.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0053.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0053.669] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0053.669] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.669] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0053.669] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0053.669] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x3b58, lpOverlapped=0x0) returned 1 [0053.671] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x3b60, lpOverlapped=0x0) returned 1 [0053.674] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0053.674] CloseHandle (hObject=0x2e0) returned 1 [0053.674] CloseHandle (hObject=0x320) returned 1 [0053.675] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0053.676] SetEvent (hEvent=0x2e4) returned 1 [0053.676] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0053.676] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3546) returned 1 [0053.676] CloseHandle (hObject=0x320) returned 1 [0053.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0053.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0053.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.212] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.212] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.212] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.212] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.219] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xdda, lpOverlapped=0x0) returned 1 [0054.232] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xde0, lpOverlapped=0x0) returned 1 [0054.234] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0054.234] CloseHandle (hObject=0x2e0) returned 1 [0054.234] CloseHandle (hObject=0x320) returned 1 [0054.235] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0054.236] SetEvent (hEvent=0x2e4) returned 1 [0054.236] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.245] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=19288) returned 1 [0054.245] CloseHandle (hObject=0x31c) returned 1 [0054.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0054.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0054.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.245] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.246] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.246] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.246] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.246] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4b58, lpOverlapped=0x0) returned 1 [0054.257] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4b60, lpOverlapped=0x0) returned 1 [0054.258] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.258] CloseHandle (hObject=0x31c) returned 1 [0054.258] CloseHandle (hObject=0x320) returned 1 [0054.259] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0054.260] SetEvent (hEvent=0x2e4) returned 1 [0054.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.261] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=79296) returned 1 [0054.261] CloseHandle (hObject=0x320) returned 1 [0054.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0054.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0054.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.261] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.261] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0054.261] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x135c0, lpOverlapped=0x0) returned 1 [0054.270] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x135d0, lpOverlapped=0x0) returned 1 [0054.272] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.272] CloseHandle (hObject=0x320) returned 1 [0054.272] CloseHandle (hObject=0x31c) returned 1 [0054.274] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0054.276] SetEvent (hEvent=0x2e4) returned 1 [0054.276] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.276] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=4040) returned 1 [0054.276] CloseHandle (hObject=0x31c) returned 1 [0054.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0054.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0054.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.276] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.276] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.276] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.276] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.278] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xfc8, lpOverlapped=0x0) returned 1 [0054.280] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xfd0, lpOverlapped=0x0) returned 1 [0054.281] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0054.281] CloseHandle (hObject=0x31c) returned 1 [0054.281] CloseHandle (hObject=0x320) returned 1 [0054.282] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0054.283] SetEvent (hEvent=0x2e4) returned 1 [0054.283] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.283] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=82374) returned 1 [0054.283] CloseHandle (hObject=0x320) returned 1 [0054.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0054.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0054.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.283] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.283] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.283] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.284] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0054.284] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x141c6, lpOverlapped=0x0) returned 1 [0054.287] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x141d0, lpOverlapped=0x0) returned 1 [0054.290] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.290] CloseHandle (hObject=0x320) returned 1 [0054.290] CloseHandle (hObject=0x31c) returned 1 [0054.292] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0054.293] SetEvent (hEvent=0x2e4) returned 1 [0054.293] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.293] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18264) returned 1 [0054.294] CloseHandle (hObject=0x31c) returned 1 [0054.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0054.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0054.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.294] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.294] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.294] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.294] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.294] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4758, lpOverlapped=0x0) returned 1 [0054.524] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4760, lpOverlapped=0x0) returned 1 [0054.535] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.536] CloseHandle (hObject=0x31c) returned 1 [0054.536] CloseHandle (hObject=0x320) returned 1 [0054.537] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0054.538] SetEvent (hEvent=0x2e4) returned 1 [0054.538] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.538] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18264) returned 1 [0054.538] CloseHandle (hObject=0x320) returned 1 [0054.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0054.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0054.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.539] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.539] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.539] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.539] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0054.539] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4758, lpOverlapped=0x0) returned 1 [0054.541] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4760, lpOverlapped=0x0) returned 1 [0054.542] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.542] CloseHandle (hObject=0x320) returned 1 [0054.542] CloseHandle (hObject=0x31c) returned 1 [0054.543] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0054.545] SetEvent (hEvent=0x2e4) returned 1 [0054.545] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.545] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3865) returned 1 [0054.545] CloseHandle (hObject=0x31c) returned 1 [0054.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0054.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0054.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.545] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.545] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.545] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.545] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.547] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xf19, lpOverlapped=0x0) returned 1 [0054.549] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf20, lpOverlapped=0x0) returned 1 [0054.550] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0054.550] CloseHandle (hObject=0x31c) returned 1 [0054.550] CloseHandle (hObject=0x320) returned 1 [0054.551] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0054.551] SetEvent (hEvent=0x2e4) returned 1 [0054.552] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.552] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=77680) returned 1 [0054.552] CloseHandle (hObject=0x320) returned 1 [0054.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0054.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0054.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.552] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.552] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.552] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.552] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0054.553] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x12f70, lpOverlapped=0x0) returned 1 [0054.559] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x12f80, lpOverlapped=0x0) returned 1 [0054.561] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.561] CloseHandle (hObject=0x320) returned 1 [0054.561] CloseHandle (hObject=0x31c) returned 1 [0054.563] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0054.564] SetEvent (hEvent=0x2e4) returned 1 [0054.565] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.565] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=17752) returned 1 [0054.565] CloseHandle (hObject=0x31c) returned 1 [0054.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0054.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0054.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.565] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.565] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.565] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.565] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0054.566] ReadFile (in: hFile=0x31c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4558, lpOverlapped=0x0) returned 1 [0054.567] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4560, lpOverlapped=0x0) returned 1 [0054.568] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.568] CloseHandle (hObject=0x31c) returned 1 [0054.568] CloseHandle (hObject=0x320) returned 1 [0054.570] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0054.571] SetEvent (hEvent=0x2e4) returned 1 [0054.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.571] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3859) returned 1 [0054.571] CloseHandle (hObject=0x320) returned 1 [0054.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0054.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0054.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.571] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.571] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.572] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0054.573] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xf13, lpOverlapped=0x0) returned 1 [0054.762] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf20, lpOverlapped=0x0) returned 1 [0054.783] WriteFile (in: hFile=0x31c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0054.783] CloseHandle (hObject=0x320) returned 1 [0054.783] CloseHandle (hObject=0x31c) returned 1 [0054.784] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0054.785] SetEvent (hEvent=0x2e4) returned 1 [0054.785] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0054.798] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=60684) returned 1 [0054.798] CloseHandle (hObject=0x300) returned 1 [0054.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0054.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0054.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.804] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0054.805] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.805] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.805] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0054.805] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xed0c, lpOverlapped=0x0) returned 1 [0054.810] WriteFile (in: hFile=0x334, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xed10, lpOverlapped=0x0) returned 1 [0054.811] WriteFile (in: hFile=0x334, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.811] CloseHandle (hObject=0x300) returned 1 [0054.811] CloseHandle (hObject=0x334) returned 1 [0054.813] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0054.814] SetEvent (hEvent=0x2e4) returned 1 [0054.815] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0054.817] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=4015) returned 1 [0054.817] CloseHandle (hObject=0x300) returned 1 [0054.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0054.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0054.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.817] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0054.817] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.817] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.817] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.827] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xfaf, lpOverlapped=0x0) returned 1 [0054.829] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xfb0, lpOverlapped=0x0) returned 1 [0054.829] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0054.830] CloseHandle (hObject=0x300) returned 1 [0054.830] CloseHandle (hObject=0x318) returned 1 [0054.830] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0054.831] SetEvent (hEvent=0x2e4) returned 1 [0054.831] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.832] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=80254) returned 1 [0054.832] CloseHandle (hObject=0x318) returned 1 [0054.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0054.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0054.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.832] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.832] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.832] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.832] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0054.832] ReadFile (in: hFile=0x318, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x1397e, lpOverlapped=0x0) returned 1 [0054.835] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x13980, lpOverlapped=0x0) returned 1 [0054.838] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.838] CloseHandle (hObject=0x318) returned 1 [0054.838] CloseHandle (hObject=0x300) returned 1 [0054.840] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0054.841] SetEvent (hEvent=0x2e4) returned 1 [0054.841] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0054.842] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18776) returned 1 [0054.842] CloseHandle (hObject=0x300) returned 1 [0054.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0054.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0054.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.842] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0054.842] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.842] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.842] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.843] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4958, lpOverlapped=0x0) returned 1 [0054.844] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4960, lpOverlapped=0x0) returned 1 [0054.845] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0054.846] CloseHandle (hObject=0x300) returned 1 [0054.846] CloseHandle (hObject=0x318) returned 1 [0054.847] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0054.848] SetEvent (hEvent=0x2e4) returned 1 [0054.848] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.848] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=6309) returned 1 [0054.848] CloseHandle (hObject=0x318) returned 1 [0054.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0054.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0054.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0054.848] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0054.848] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.848] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0054.848] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0055.378] ReadFile (in: hFile=0x318, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x18a5, lpOverlapped=0x0) returned 1 [0055.380] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x18b0, lpOverlapped=0x0) returned 1 [0055.381] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0055.381] CloseHandle (hObject=0x318) returned 1 [0055.381] CloseHandle (hObject=0x2e0) returned 1 [0055.382] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0055.383] SetEvent (hEvent=0x2e4) returned 1 [0055.383] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.384] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=14168) returned 1 [0055.384] CloseHandle (hObject=0x2e0) returned 1 [0055.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0055.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0055.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.384] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.384] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.384] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.384] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.384] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x3758, lpOverlapped=0x0) returned 1 [0055.386] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x3760, lpOverlapped=0x0) returned 1 [0055.387] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0055.387] CloseHandle (hObject=0x2e0) returned 1 [0055.387] CloseHandle (hObject=0x318) returned 1 [0055.389] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0055.390] SetEvent (hEvent=0x2e4) returned 1 [0055.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0055.390] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=3069) returned 1 [0055.390] CloseHandle (hObject=0x318) returned 1 [0055.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0055.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0055.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0055.390] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.390] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.390] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0055.392] ReadFile (in: hFile=0x318, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xbfd, lpOverlapped=0x0) returned 1 [0055.394] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xc00, lpOverlapped=0x0) returned 1 [0055.394] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0055.395] CloseHandle (hObject=0x318) returned 1 [0055.395] CloseHandle (hObject=0x2e0) returned 1 [0055.395] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0055.396] SetEvent (hEvent=0x2e4) returned 1 [0055.396] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.396] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=79996) returned 1 [0055.396] CloseHandle (hObject=0x2e0) returned 1 [0055.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0055.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0055.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.397] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.397] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.397] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.397] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.397] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x1387c, lpOverlapped=0x0) returned 1 [0055.400] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x13880, lpOverlapped=0x0) returned 1 [0055.402] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0055.403] CloseHandle (hObject=0x2e0) returned 1 [0055.403] CloseHandle (hObject=0x318) returned 1 [0055.405] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0055.407] SetEvent (hEvent=0x2e4) returned 1 [0055.407] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0055.407] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=18776) returned 1 [0055.407] CloseHandle (hObject=0x318) returned 1 [0055.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0055.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0055.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.408] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0055.408] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.408] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.408] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0055.408] ReadFile (in: hFile=0x318, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x4958, lpOverlapped=0x0) returned 1 [0055.492] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x4960, lpOverlapped=0x0) returned 1 [0055.494] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0055.494] CloseHandle (hObject=0x318) returned 1 [0055.494] CloseHandle (hObject=0x2e0) returned 1 [0055.495] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0055.496] SetEvent (hEvent=0x2e4) returned 1 [0055.496] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.496] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=201796) returned 1 [0055.496] CloseHandle (hObject=0x2e0) returned 1 [0055.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0055.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0055.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.496] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.497] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.497] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.497] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.497] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x31444, lpOverlapped=0x0) returned 1 [0055.775] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x31450, lpOverlapped=0x0) returned 1 [0055.780] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0055.780] CloseHandle (hObject=0x2e0) returned 1 [0055.780] CloseHandle (hObject=0x318) returned 1 [0055.784] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0055.786] SetEvent (hEvent=0x2e4) returned 1 [0055.788] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0055.788] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=93314) returned 1 [0055.788] CloseHandle (hObject=0x318) returned 1 [0055.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0055.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0055.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.789] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0055.789] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.789] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.789] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0055.789] ReadFile (in: hFile=0x318, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x16c82, lpOverlapped=0x0) returned 1 [0055.792] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x16c90, lpOverlapped=0x0) returned 1 [0055.794] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0055.794] CloseHandle (hObject=0x318) returned 1 [0055.794] CloseHandle (hObject=0x2e0) returned 1 [0055.797] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0055.798] SetEvent (hEvent=0x2e4) returned 1 [0055.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.798] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=39050) returned 1 [0055.798] CloseHandle (hObject=0x2e0) returned 1 [0055.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0055.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0055.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0055.799] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.799] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.799] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0055.799] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.802] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x988a, lpOverlapped=0x0) returned 1 [0055.806] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x9890, lpOverlapped=0x0) returned 1 [0055.808] WriteFile (in: hFile=0x318, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0055.808] CloseHandle (hObject=0x2e0) returned 1 [0055.808] CloseHandle (hObject=0x318) returned 1 [0055.809] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0055.810] SetEvent (hEvent=0x2e4) returned 1 [0055.811] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.008] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1150) returned 1 [0056.008] CloseHandle (hObject=0x2e0) returned 1 [0056.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0056.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0056.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.008] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.028] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.028] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.028] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0056.033] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x47e, lpOverlapped=0x0) returned 1 [0056.037] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x480, lpOverlapped=0x0) returned 1 [0056.038] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.038] CloseHandle (hObject=0x2e0) returned 1 [0056.038] CloseHandle (hObject=0x330) returned 1 [0056.039] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0056.039] SetEvent (hEvent=0x2e4) returned 1 [0056.040] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.040] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=894) returned 1 [0056.040] CloseHandle (hObject=0x330) returned 1 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0056.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.040] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.040] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.040] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.040] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0056.040] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x37e, lpOverlapped=0x0) returned 1 [0056.043] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x380, lpOverlapped=0x0) returned 1 [0056.044] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.044] CloseHandle (hObject=0x330) returned 1 [0056.044] CloseHandle (hObject=0x2e0) returned 1 [0056.045] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0056.046] SetEvent (hEvent=0x2e4) returned 1 [0056.046] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.046] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=894) returned 1 [0056.046] CloseHandle (hObject=0x2e0) returned 1 [0056.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0056.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0056.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.047] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.047] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.047] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.047] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0056.047] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x37e, lpOverlapped=0x0) returned 1 [0056.049] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x380, lpOverlapped=0x0) returned 1 [0056.050] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.050] CloseHandle (hObject=0x2e0) returned 1 [0056.050] CloseHandle (hObject=0x330) returned 1 [0056.050] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0056.051] SetEvent (hEvent=0x2e4) returned 1 [0056.051] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.053] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=894) returned 1 [0056.053] CloseHandle (hObject=0x330) returned 1 [0056.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0056.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0056.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.053] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.053] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.053] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.053] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0056.054] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x37e, lpOverlapped=0x0) returned 1 [0056.056] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x380, lpOverlapped=0x0) returned 1 [0056.057] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.057] CloseHandle (hObject=0x330) returned 1 [0056.057] CloseHandle (hObject=0x2e0) returned 1 [0056.057] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0056.058] SetEvent (hEvent=0x2e4) returned 1 [0056.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.059] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1150) returned 1 [0056.059] CloseHandle (hObject=0x2e0) returned 1 [0056.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0056.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0056.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.059] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.059] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0056.061] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x47e, lpOverlapped=0x0) returned 1 [0056.062] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x480, lpOverlapped=0x0) returned 1 [0056.063] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.063] CloseHandle (hObject=0x2e0) returned 1 [0056.063] CloseHandle (hObject=0x330) returned 1 [0056.064] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0056.065] SetEvent (hEvent=0x2e4) returned 1 [0056.065] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.065] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=36710) returned 1 [0056.065] CloseHandle (hObject=0x330) returned 1 [0056.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0056.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0056.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.066] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.066] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.066] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.066] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e0 [0056.066] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x8f66, lpOverlapped=0x0) returned 1 [0056.068] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x8f70, lpOverlapped=0x0) returned 1 [0056.098] WriteFile (in: hFile=0x2e0, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.099] CloseHandle (hObject=0x330) returned 1 [0056.099] CloseHandle (hObject=0x2e0) returned 1 [0056.100] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0056.102] SetEvent (hEvent=0x2e4) returned 1 [0056.102] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.102] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=10134) returned 1 [0056.102] CloseHandle (hObject=0x2e0) returned 1 [0056.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0056.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0056.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0056.102] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.102] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.102] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0056.103] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0056.103] ReadFile (in: hFile=0x2e0, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x2796, lpOverlapped=0x0) returned 1 [0056.372] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x27a0, lpOverlapped=0x0) returned 1 [0056.374] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf2, lpOverlapped=0x0) returned 1 [0056.374] CloseHandle (hObject=0x2e0) returned 1 [0056.374] CloseHandle (hObject=0x330) returned 1 [0056.375] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0056.375] SetEvent (hEvent=0x2e4) returned 1 [0056.376] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.377] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1901056) returned 1 [0056.377] CloseHandle (hObject=0x330) returned 1 [0056.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0056.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0056.385] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.385] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0056.385] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0056.385] ReadFile (in: hFile=0x330, lpBuffer=0xab4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xab4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0056.389] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0056.389] ReadFile (in: hFile=0x330, lpBuffer=0xaf4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xaf4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0056.395] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0056.395] ReadFile (in: hFile=0x330, lpBuffer=0xb34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xb34058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0056.408] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdb8 | out: lpNewFilePointer=0x0) returned 1 [0056.408] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xc0112, lpOverlapped=0x0) returned 1 [0056.882] SetEndOfFile (hFile=0x330) returned 1 [0056.882] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0056.882] WriteFile (in: hFile=0x330, lpBuffer=0xb7414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7414a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0056.884] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0056.884] WriteFile (in: hFile=0x330, lpBuffer=0xb7414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7414a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0056.886] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0056.886] WriteFile (in: hFile=0x330, lpBuffer=0xb7414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7414a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0056.887] CloseHandle (hObject=0x330) returned 1 [0057.549] SetEvent (hEvent=0x2e4) returned 1 [0057.550] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.551] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1163264) returned 1 [0057.551] CloseHandle (hObject=0x300) returned 1 [0057.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0057.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0057.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0057.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.551] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0057.551] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0057.551] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0057.552] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x110100, lpOverlapped=0x0) returned 1 [0058.020] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x110100, lpOverlapped=0x0) returned 1 [0058.399] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xbf00, lpOverlapped=0x0) returned 1 [0058.402] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xbf10, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xbf10, lpOverlapped=0x0) returned 1 [0058.403] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0058.403] CloseHandle (hObject=0x300) returned 1 [0058.403] CloseHandle (hObject=0x330) returned 1 [0058.427] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0058.567] SetEvent (hEvent=0x2e4) returned 1 [0058.567] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.568] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=43131591) returned 1 [0058.568] CloseHandle (hObject=0x338) returned 1 [0058.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0058.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0058.569] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.569] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0058.569] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0058.569] ReadFile (in: hFile=0x338, lpBuffer=0xab4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xab4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0058.576] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0058.576] ReadFile (in: hFile=0x338, lpBuffer=0xaf4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xaf4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0058.634] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0058.634] ReadFile (in: hFile=0x338, lpBuffer=0xb34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xb34058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0058.665] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdb8 | out: lpNewFilePointer=0x0) returned 1 [0058.665] WriteFile (in: hFile=0x338, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xc0112, lpOverlapped=0x0) returned 1 [0059.428] SetEndOfFile (hFile=0x338) returned 1 [0059.429] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0059.429] WriteFile (in: hFile=0x338, lpBuffer=0xb7414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7414a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0059.430] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0059.430] WriteFile (in: hFile=0x338, lpBuffer=0xb7414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7414a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0059.431] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0059.431] WriteFile (in: hFile=0x338, lpBuffer=0xb7414a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7414a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0059.432] CloseHandle (hObject=0x338) returned 1 [0062.351] SetEvent (hEvent=0x2e4) returned 1 [0062.352] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.352] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=2192672) returned 1 [0062.352] CloseHandle (hObject=0x338) returned 1 [0062.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0062.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0062.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.353] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0062.353] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0062.353] ReadFile (in: hFile=0x338, lpBuffer=0xab4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xab4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0062.357] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0062.357] ReadFile (in: hFile=0x338, lpBuffer=0xaf4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xaf4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0062.362] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0062.362] ReadFile (in: hFile=0x338, lpBuffer=0xb34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xb34058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0062.384] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdb8 | out: lpNewFilePointer=0x0) returned 1 [0062.384] WriteFile (in: hFile=0x338, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xc0132, lpOverlapped=0x0) returned 1 [0062.634] SetEndOfFile (hFile=0x338) returned 1 [0062.634] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0062.634] WriteFile (in: hFile=0x338, lpBuffer=0xb7416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7416a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0062.635] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0062.636] WriteFile (in: hFile=0x338, lpBuffer=0xb7416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7416a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0062.638] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0062.638] WriteFile (in: hFile=0x338, lpBuffer=0xb7416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7416a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0062.639] CloseHandle (hObject=0x338) returned 1 [0063.132] SetEvent (hEvent=0x2e4) returned 1 [0063.132] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.165] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=2141433) returned 1 [0063.165] CloseHandle (hObject=0x338) returned 1 [0063.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0063.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0063.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.262] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0063.263] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0063.263] ReadFile (in: hFile=0x338, lpBuffer=0xab4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xab4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0063.625] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0063.625] ReadFile (in: hFile=0x338, lpBuffer=0xaf4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xaf4058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0063.750] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x397fc48 | out: lpNewFilePointer=0x0) returned 1 [0063.750] ReadFile (in: hFile=0x338, lpBuffer=0xb34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x397fc54, lpOverlapped=0x0 | out: lpBuffer=0xb34058*, lpNumberOfBytesRead=0x397fc54*=0x40000, lpOverlapped=0x0) returned 1 [0065.163] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdb8 | out: lpNewFilePointer=0x0) returned 1 [0065.163] WriteFile (in: hFile=0x338, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xc0132, lpOverlapped=0x0) returned 1 [0065.176] SetEndOfFile (hFile=0x338) returned 1 [0065.177] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0065.177] WriteFile (in: hFile=0x338, lpBuffer=0xb7416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7416a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0065.179] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0065.179] WriteFile (in: hFile=0x338, lpBuffer=0xb7416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7416a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0065.289] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fc50 | out: lpNewFilePointer=0x0) returned 1 [0065.289] WriteFile (in: hFile=0x338, lpBuffer=0xb7416a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x397fc5c, lpOverlapped=0x0 | out: lpBuffer=0xb7416a*, lpNumberOfBytesWritten=0x397fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0065.291] CloseHandle (hObject=0x338) returned 1 [0068.971] SetEvent (hEvent=0x2e4) returned 1 [0068.972] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0068.972] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0068.972] CloseHandle (hObject=0x338) returned 1 [0068.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0068.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0068.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0068.973] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0068.973] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0068.973] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0068.973] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0068.974] ReadFile (in: hFile=0x338, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0069.020] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0069.022] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x102, lpOverlapped=0x0) returned 1 [0069.022] CloseHandle (hObject=0x338) returned 1 [0069.023] CloseHandle (hObject=0x314) returned 1 [0069.025] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0069.026] SetEvent (hEvent=0x2e4) returned 1 [0069.026] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0069.027] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0069.027] CloseHandle (hObject=0x314) returned 1 [0069.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0069.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0069.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.027] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0069.027] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0069.027] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0069.027] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x338 [0069.027] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0069.039] WriteFile (in: hFile=0x338, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0069.040] WriteFile (in: hFile=0x338, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0069.041] CloseHandle (hObject=0x314) returned 1 [0069.041] CloseHandle (hObject=0x338) returned 1 [0069.043] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0069.045] SetEvent (hEvent=0x2e4) returned 1 [0069.045] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.063] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1052672) returned 1 [0069.063] CloseHandle (hObject=0x334) returned 1 [0069.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0069.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0069.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.066] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.066] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0069.066] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0069.066] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x330 [0069.068] ReadFile (in: hFile=0x334, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x101000, lpOverlapped=0x0) returned 1 [0069.322] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x101010, lpOverlapped=0x0) returned 1 [0069.345] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x162, lpOverlapped=0x0) returned 1 [0069.345] CloseHandle (hObject=0x334) returned 1 [0069.345] CloseHandle (hObject=0x330) returned 1 [0069.741] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0069.742] SetEvent (hEvent=0x2e4) returned 1 [0069.743] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0069.746] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1118208) returned 1 [0069.746] CloseHandle (hObject=0x330) returned 1 [0069.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0069.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0069.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0069.746] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0069.746] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0069.746] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0069.746] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0069.746] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x110100, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x110100, lpOverlapped=0x0) returned 1 [0070.075] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0xf00, lpOverlapped=0x0) returned 1 [0070.432] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0xf10, lpOverlapped=0x0) returned 1 [0070.432] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0070.432] CloseHandle (hObject=0x330) returned 1 [0070.433] CloseHandle (hObject=0x300) returned 1 [0070.465] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0070.766] SetEvent (hEvent=0x2e4) returned 1 [0070.767] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0070.768] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0070.768] CloseHandle (hObject=0x33c) returned 1 [0070.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0070.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0070.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0070.768] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0070.768] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.768] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.768] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0070.769] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0070.771] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0070.773] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0070.773] CloseHandle (hObject=0x33c) returned 1 [0070.773] CloseHandle (hObject=0x300) returned 1 [0070.775] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0070.776] SetEvent (hEvent=0x2e4) returned 1 [0070.776] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0070.776] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0070.776] CloseHandle (hObject=0x300) returned 1 [0070.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0070.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0070.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0070.777] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0070.777] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.777] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.777] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0070.777] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0070.780] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0070.781] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0070.782] CloseHandle (hObject=0x300) returned 1 [0070.782] CloseHandle (hObject=0x33c) returned 1 [0070.784] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0070.785] SetEvent (hEvent=0x2e4) returned 1 [0070.785] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0070.803] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0070.803] CloseHandle (hObject=0x33c) returned 1 [0070.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0070.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0070.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0070.803] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0070.803] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.803] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.803] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0070.804] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0070.807] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0070.808] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x162, lpOverlapped=0x0) returned 1 [0070.808] CloseHandle (hObject=0x33c) returned 1 [0070.808] CloseHandle (hObject=0x300) returned 1 [0070.811] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0070.812] SetEvent (hEvent=0x2e4) returned 1 [0070.812] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0070.812] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0070.812] CloseHandle (hObject=0x300) returned 1 [0070.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0070.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0070.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0070.813] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0070.813] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.813] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.813] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0070.813] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0070.815] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0070.817] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0070.817] CloseHandle (hObject=0x300) returned 1 [0070.818] CloseHandle (hObject=0x33c) returned 1 [0070.820] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0070.821] SetEvent (hEvent=0x2e4) returned 1 [0070.821] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0070.821] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0070.821] CloseHandle (hObject=0x33c) returned 1 [0070.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0070.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0070.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0070.821] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0070.822] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.822] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0070.822] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0070.822] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0071.064] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0071.067] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0071.067] CloseHandle (hObject=0x33c) returned 1 [0071.067] CloseHandle (hObject=0x300) returned 1 [0071.070] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0071.071] SetEvent (hEvent=0x2e4) returned 1 [0071.072] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0071.072] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0071.073] CloseHandle (hObject=0x300) returned 1 [0071.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0071.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0071.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.073] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0071.073] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0071.073] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0071.073] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0071.074] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0071.077] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0071.079] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x152, lpOverlapped=0x0) returned 1 [0071.079] CloseHandle (hObject=0x300) returned 1 [0071.079] CloseHandle (hObject=0x33c) returned 1 [0071.083] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0071.084] SetEvent (hEvent=0x2e4) returned 1 [0071.085] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0071.085] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0071.085] CloseHandle (hObject=0x33c) returned 1 [0071.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0071.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0071.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.085] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0071.085] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0071.085] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0071.086] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0071.087] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0071.090] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0071.093] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0071.093] CloseHandle (hObject=0x33c) returned 1 [0071.093] CloseHandle (hObject=0x300) returned 1 [0071.095] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0071.097] SetEvent (hEvent=0x2e4) returned 1 [0071.097] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0071.483] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1052672) returned 1 [0071.483] CloseHandle (hObject=0x300) returned 1 [0071.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0071.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0071.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0071.932] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0071.975] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0071.975] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0071.976] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0071.980] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x101000, lpOverlapped=0x0) returned 1 [0072.025] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x101010, lpOverlapped=0x0) returned 1 [0072.200] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x172, lpOverlapped=0x0) returned 1 [0072.200] CloseHandle (hObject=0x300) returned 1 [0072.200] CloseHandle (hObject=0x33c) returned 1 [0072.258] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0072.259] SetEvent (hEvent=0x2e4) returned 1 [0072.260] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.260] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.260] CloseHandle (hObject=0x33c) returned 1 [0072.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0072.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0072.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.261] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.261] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.261] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.261] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0072.262] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.439] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.442] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0072.442] CloseHandle (hObject=0x33c) returned 1 [0072.442] CloseHandle (hObject=0x300) returned 1 [0072.444] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0072.445] SetEvent (hEvent=0x2e4) returned 1 [0072.450] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.450] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.450] CloseHandle (hObject=0x33c) returned 1 [0072.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0072.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0072.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.450] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.450] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.450] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.450] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x32c [0072.452] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.455] WriteFile (in: hFile=0x32c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.457] WriteFile (in: hFile=0x32c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x152, lpOverlapped=0x0) returned 1 [0072.457] CloseHandle (hObject=0x33c) returned 1 [0072.457] CloseHandle (hObject=0x32c) returned 1 [0072.459] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0072.461] SetEvent (hEvent=0x2e4) returned 1 [0072.461] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0072.461] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.461] CloseHandle (hObject=0x32c) returned 1 [0072.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0072.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0072.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.462] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0072.462] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.462] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.462] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0072.462] ReadFile (in: hFile=0x32c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.465] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.467] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0072.467] CloseHandle (hObject=0x32c) returned 1 [0072.467] CloseHandle (hObject=0x33c) returned 1 [0072.469] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0072.471] SetEvent (hEvent=0x2e4) returned 1 [0072.471] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.471] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.471] CloseHandle (hObject=0x33c) returned 1 [0072.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0072.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0072.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.471] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.471] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.472] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.472] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x32c [0072.472] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.474] WriteFile (in: hFile=0x32c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.476] WriteFile (in: hFile=0x32c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0072.477] CloseHandle (hObject=0x33c) returned 1 [0072.477] CloseHandle (hObject=0x32c) returned 1 [0072.479] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0072.480] SetEvent (hEvent=0x2e4) returned 1 [0072.480] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.705] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.705] CloseHandle (hObject=0x314) returned 1 [0072.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0072.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0072.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.705] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.705] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.705] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.705] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x330 [0072.706] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.716] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.718] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0072.718] CloseHandle (hObject=0x314) returned 1 [0072.718] CloseHandle (hObject=0x330) returned 1 [0072.721] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0072.722] SetEvent (hEvent=0x2e4) returned 1 [0072.722] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.724] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.724] CloseHandle (hObject=0x314) returned 1 [0072.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0072.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0072.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.725] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0072.725] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.725] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.725] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x330 [0072.733] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.736] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.738] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0072.738] CloseHandle (hObject=0x314) returned 1 [0072.738] CloseHandle (hObject=0x330) returned 1 [0072.741] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0072.742] SetEvent (hEvent=0x2e4) returned 1 [0072.742] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0072.743] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0072.743] CloseHandle (hObject=0x330) returned 1 [0072.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0072.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0072.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0072.743] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0072.743] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.743] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0072.743] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0072.743] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0072.747] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0072.749] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0072.749] CloseHandle (hObject=0x330) returned 1 [0072.749] CloseHandle (hObject=0x314) returned 1 [0073.128] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0073.129] SetEvent (hEvent=0x2e4) returned 1 [0073.130] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0073.130] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0073.130] CloseHandle (hObject=0x33c) returned 1 [0073.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0073.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0073.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.131] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0073.131] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.131] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.131] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0073.131] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0073.134] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0073.137] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x122, lpOverlapped=0x0) returned 1 [0073.137] CloseHandle (hObject=0x33c) returned 1 [0073.137] CloseHandle (hObject=0x314) returned 1 [0073.140] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0073.142] SetEvent (hEvent=0x2e4) returned 1 [0073.142] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.142] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0073.142] CloseHandle (hObject=0x314) returned 1 [0073.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0073.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0073.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.142] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.143] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.143] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.143] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x330 [0073.146] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0073.149] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0073.151] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x122, lpOverlapped=0x0) returned 1 [0073.151] CloseHandle (hObject=0x314) returned 1 [0073.151] CloseHandle (hObject=0x330) returned 1 [0073.153] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0073.155] SetEvent (hEvent=0x2e4) returned 1 [0073.155] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0073.155] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0073.155] CloseHandle (hObject=0x330) returned 1 [0073.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0073.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0073.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.155] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0073.155] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.156] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.156] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0073.156] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0073.163] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0073.165] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0073.165] CloseHandle (hObject=0x330) returned 1 [0073.165] CloseHandle (hObject=0x314) returned 1 [0073.167] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0073.168] SetEvent (hEvent=0x2e4) returned 1 [0073.168] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.168] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0073.168] CloseHandle (hObject=0x314) returned 1 [0073.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0073.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0073.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0073.169] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0073.169] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.169] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.169] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x330 [0073.169] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0073.455] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x330, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0073.457] CloseHandle (hObject=0x314) returned 1 [0073.457] CloseHandle (hObject=0x330) returned 1 [0073.723] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0073.734] SetEvent (hEvent=0x2e4) returned 1 [0073.745] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0074.112] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1052672) returned 1 [0074.112] CloseHandle (hObject=0x330) returned 1 [0074.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0074.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0074.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0074.112] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0074.112] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0074.112] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0074.112] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0074.112] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x101000, lpOverlapped=0x0) returned 1 [0074.188] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x101010, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0074.239] CloseHandle (hObject=0x330) returned 1 [0074.239] CloseHandle (hObject=0x314) returned 1 [0074.276] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0074.280] SetEvent (hEvent=0x2e4) returned 1 [0074.280] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0074.280] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0074.280] CloseHandle (hObject=0x330) returned 1 [0074.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0074.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0074.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0074.281] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0074.281] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0074.281] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0074.281] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0074.341] ReadFile (in: hFile=0x330, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0074.346] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0074.346] CloseHandle (hObject=0x330) returned 1 [0074.346] CloseHandle (hObject=0x300) returned 1 [0074.348] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0074.349] SetEvent (hEvent=0x2e4) returned 1 [0074.349] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0074.645] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0074.645] CloseHandle (hObject=0x320) returned 1 [0074.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0074.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0074.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0074.645] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0074.645] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0074.645] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0074.645] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0075.675] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0075.682] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0075.684] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0075.684] CloseHandle (hObject=0x320) returned 1 [0075.684] CloseHandle (hObject=0x314) returned 1 [0075.686] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0075.688] SetEvent (hEvent=0x2e4) returned 1 [0075.688] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0075.688] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0075.688] CloseHandle (hObject=0x314) returned 1 [0075.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0075.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0075.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0075.689] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0075.689] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.689] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.689] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0075.689] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0075.693] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0075.694] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x122, lpOverlapped=0x0) returned 1 [0075.695] CloseHandle (hObject=0x314) returned 1 [0075.695] CloseHandle (hObject=0x320) returned 1 [0075.697] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0075.698] SetEvent (hEvent=0x2e4) returned 1 [0075.698] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0075.698] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0075.698] CloseHandle (hObject=0x320) returned 1 [0075.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0075.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0075.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0075.699] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0075.699] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.699] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.699] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0075.703] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0075.705] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0075.708] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0075.708] CloseHandle (hObject=0x320) returned 1 [0075.708] CloseHandle (hObject=0x314) returned 1 [0075.710] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0075.712] SetEvent (hEvent=0x2e4) returned 1 [0075.712] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0075.712] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0075.712] CloseHandle (hObject=0x314) returned 1 [0075.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0075.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0075.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0075.712] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0075.712] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.712] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.712] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0075.713] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0075.715] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0075.717] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0075.717] CloseHandle (hObject=0x314) returned 1 [0075.717] CloseHandle (hObject=0x320) returned 1 [0075.719] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0076.039] SetEvent (hEvent=0x2e4) returned 1 [0076.058] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0076.200] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.200] CloseHandle (hObject=0x324) returned 1 [0076.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0076.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0076.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.200] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0076.200] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.201] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.201] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x328 [0076.201] ReadFile (in: hFile=0x324, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.216] WriteFile (in: hFile=0x328, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.218] WriteFile (in: hFile=0x328, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0076.218] CloseHandle (hObject=0x324) returned 1 [0076.218] CloseHandle (hObject=0x328) returned 1 [0076.221] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0076.222] SetEvent (hEvent=0x2e4) returned 1 [0076.222] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0076.224] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.224] CloseHandle (hObject=0x324) returned 1 [0076.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0076.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0076.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.224] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0076.224] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.225] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.225] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0076.225] ReadFile (in: hFile=0x324, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.228] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.230] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0076.230] CloseHandle (hObject=0x324) returned 1 [0076.231] CloseHandle (hObject=0x33c) returned 1 [0076.233] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0076.234] SetEvent (hEvent=0x2e4) returned 1 [0076.234] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.234] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.234] CloseHandle (hObject=0x33c) returned 1 [0076.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0076.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0076.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.235] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.235] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.235] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.235] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0076.237] ReadFile (in: hFile=0x33c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.240] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.242] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0076.243] CloseHandle (hObject=0x33c) returned 1 [0076.243] CloseHandle (hObject=0x300) returned 1 [0076.245] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0076.246] SetEvent (hEvent=0x2e4) returned 1 [0076.246] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.246] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.246] CloseHandle (hObject=0x300) returned 1 [0076.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0076.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0076.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.247] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.247] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.247] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.247] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0076.247] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.252] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.253] WriteFile (in: hFile=0x33c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x172, lpOverlapped=0x0) returned 1 [0076.253] CloseHandle (hObject=0x300) returned 1 [0076.254] CloseHandle (hObject=0x33c) returned 1 [0076.256] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0076.565] SetEvent (hEvent=0x2e4) returned 1 [0076.567] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0076.568] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.568] CloseHandle (hObject=0x320) returned 1 [0076.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0076.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0076.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.568] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0076.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.568] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0076.569] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.571] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.573] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x162, lpOverlapped=0x0) returned 1 [0076.573] CloseHandle (hObject=0x320) returned 1 [0076.573] CloseHandle (hObject=0x314) returned 1 [0076.575] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0076.577] SetEvent (hEvent=0x2e4) returned 1 [0076.577] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0076.578] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.578] CloseHandle (hObject=0x314) returned 1 [0076.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0076.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0076.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.578] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0076.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.579] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.579] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0076.579] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.584] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.586] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x172, lpOverlapped=0x0) returned 1 [0076.587] CloseHandle (hObject=0x314) returned 1 [0076.587] CloseHandle (hObject=0x320) returned 1 [0076.589] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0076.590] SetEvent (hEvent=0x2e4) returned 1 [0076.590] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0076.590] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.591] CloseHandle (hObject=0x320) returned 1 [0076.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0076.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0076.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.591] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0076.591] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.591] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.591] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0076.591] ReadFile (in: hFile=0x320, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.603] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.605] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0076.605] CloseHandle (hObject=0x320) returned 1 [0076.605] CloseHandle (hObject=0x314) returned 1 [0076.607] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0076.608] SetEvent (hEvent=0x2e4) returned 1 [0076.608] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0076.609] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.609] CloseHandle (hObject=0x314) returned 1 [0076.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0076.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0076.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.610] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0076.610] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.610] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.610] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x320 [0076.610] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.695] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.696] WriteFile (in: hFile=0x320, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0076.697] CloseHandle (hObject=0x314) returned 1 [0076.697] CloseHandle (hObject=0x320) returned 1 [0076.700] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0076.714] SetEvent (hEvent=0x2e4) returned 1 [0076.714] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0076.715] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.715] CloseHandle (hObject=0x32c) returned 1 [0076.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0076.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0076.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.715] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0076.715] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.715] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.715] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0076.716] ReadFile (in: hFile=0x32c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.718] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.720] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0076.721] CloseHandle (hObject=0x32c) returned 1 [0076.721] CloseHandle (hObject=0x300) returned 1 [0076.723] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0076.724] SetEvent (hEvent=0x2e4) returned 1 [0076.724] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.724] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.724] CloseHandle (hObject=0x300) returned 1 [0076.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0076.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0076.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.725] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.725] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.725] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.725] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x32c [0076.725] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.728] WriteFile (in: hFile=0x32c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.730] WriteFile (in: hFile=0x32c, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x142, lpOverlapped=0x0) returned 1 [0076.730] CloseHandle (hObject=0x300) returned 1 [0076.730] CloseHandle (hObject=0x32c) returned 1 [0076.732] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0076.738] SetEvent (hEvent=0x2e4) returned 1 [0076.738] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0076.738] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.738] CloseHandle (hObject=0x32c) returned 1 [0076.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0076.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0076.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.738] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0076.738] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.738] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.738] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0076.739] ReadFile (in: hFile=0x32c, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0076.743] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x132, lpOverlapped=0x0) returned 1 [0076.743] CloseHandle (hObject=0x32c) returned 1 [0076.744] CloseHandle (hObject=0x300) returned 1 [0076.746] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0076.747] SetEvent (hEvent=0x2e4) returned 1 [0076.747] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.748] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=69632) returned 1 [0076.748] CloseHandle (hObject=0x300) returned 1 [0076.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0076.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0076.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0076.748] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0076.748] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.748] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0076.748] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x314 [0077.306] ReadFile (in: hFile=0x300, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x11000, lpOverlapped=0x0) returned 1 [0077.312] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x11010, lpOverlapped=0x0) returned 1 [0077.314] WriteFile (in: hFile=0x314, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x182, lpOverlapped=0x0) returned 1 [0077.314] CloseHandle (hObject=0x300) returned 1 [0077.314] CloseHandle (hObject=0x314) returned 1 [0077.317] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0077.319] SetEvent (hEvent=0x2e4) returned 1 [0077.320] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0077.321] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x397fdf8 | out: lpFileSize=0x397fdf8*=1052672) returned 1 [0077.321] CloseHandle (hObject=0x314) returned 1 [0077.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0077.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0077.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0077.322] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0077.322] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0077.322] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x397fdc0 | out: lpNewFilePointer=0x0) returned 1 [0077.322] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0077.322] ReadFile (in: hFile=0x314, lpBuffer=0xab4020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x397fdcc, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesRead=0x397fdcc*=0x101000, lpOverlapped=0x0) returned 1 [0077.643] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x101010, lpOverlapped=0x0) returned 1 [0077.665] WriteFile (in: hFile=0x300, lpBuffer=0xab4020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x397fdb0, lpOverlapped=0x0 | out: lpBuffer=0xab4020*, lpNumberOfBytesWritten=0x397fdb0*=0x172, lpOverlapped=0x0) returned 1 [0077.665] CloseHandle (hObject=0x314) returned 1 [0077.665] CloseHandle (hObject=0x300) Thread: id = 46 os_tid = 0x13f4 Thread: id = 47 os_tid = 0x1398 Process: id = "2" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x14506000" os_pid = "0x1184" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11a8" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x1180 [0042.091] GetProcessHeap () returned 0x110000 [0042.091] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30) returned 0x1267e0 [0042.091] GetProcessHeap () returned 0x110000 [0042.091] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x3310) returned 0x126b58 [0042.095] GetProcessHeap () returned 0x110000 [0042.095] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x300) returned 0x129e70 [0042.095] GetProcessHeap () returned 0x110000 [0042.095] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x11aeb0 [0042.095] GetTickCount () returned 0x114c332 [0042.095] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xeffdf8, cchData=32 | out: lpLCData="\x03") returned 16 [0042.096] GetProcessHeap () returned 0x110000 [0042.096] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x118448 [0042.096] GetProcessHeap () returned 0x110000 [0042.096] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a178 [0042.096] GetProcessHeap () returned 0x110000 [0042.096] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a390 [0042.096] GetProcessHeap () returned 0x110000 [0042.096] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a5a8 [0042.096] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12a5a8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0042.096] GetProcessHeap () returned 0x110000 [0042.096] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a5a8 | out: hHeap=0x110000) returned 1 [0042.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.096] GetProcessHeap () returned 0x110000 [0042.096] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a178 | out: hHeap=0x110000) returned 1 [0042.096] GetProcessHeap () returned 0x110000 [0042.096] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a390 | out: hHeap=0x110000) returned 1 [0042.096] GetProcessHeap () returned 0x110000 [0042.096] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118448 | out: hHeap=0x110000) returned 1 [0042.096] GetVersion () returned 0x23f00206 [0042.096] GetCurrentProcess () returned 0xffffffff [0042.097] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xeffd8c | out: TokenHandle=0xeffd8c*=0x1dc) returned 1 [0042.097] GetTokenInformation (in: TokenHandle=0x1dc, TokenInformationClass=0x14, TokenInformation=0xeffd84, TokenInformationLength=0x4, ReturnLength=0xeffd88 | out: TokenInformation=0xeffd84, ReturnLength=0xeffd88) returned 1 [0042.097] CloseHandle (hObject=0x1dc) returned 1 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x114b28 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a178 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a390 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a178 | out: hHeap=0x110000) returned 1 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a390 | out: hHeap=0x110000) returned 1 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x114d40 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x112cc0 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x114178 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.097] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x112cc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.097] GetProcessHeap () returned 0x110000 [0042.097] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114d40 | out: hHeap=0x110000) returned 1 [0042.097] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffd44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffd44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x112cc0 | out: hHeap=0x110000) returned 1 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30) returned 0x1265b0 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x2a) returned 0x126460 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x126460, Size=0x52) returned 0x1148f8 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1265b0 | out: hHeap=0x110000) returned 1 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1148f8 | out: hHeap=0x110000) returned 1 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1c) returned 0x112cc0 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1c) returned 0x114d40 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x114178 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x1141a0 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x1148f8 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.098] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1141a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1148f8 | out: hHeap=0x110000) returned 1 [0042.098] GetProcessHeap () returned 0x110000 [0042.098] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.098] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffd2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffd2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1141a0 | out: hHeap=0x110000) returned 1 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11e068 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x11dfd8 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11dfd8, Size=0x72) returned 0x11aa58 [0042.099] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0042.099] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x1dc [0042.099] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x0 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11e068 | out: hHeap=0x110000) returned 1 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11aa58 | out: hHeap=0x110000) returned 1 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x114178 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x1141a0 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x1148f8 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.099] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1141a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.099] GetProcessHeap () returned 0x110000 [0042.099] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1148f8 | out: hHeap=0x110000) returned 1 [0042.099] GetProcessHeap () returned 0x110000 [0042.100] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.100] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffd14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffd14*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.100] GetProcessHeap () returned 0x110000 [0042.100] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1141a0 | out: hHeap=0x110000) returned 1 [0042.100] GetProcessHeap () returned 0x110000 [0042.100] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11dd08 [0042.100] GetProcessHeap () returned 0x110000 [0042.100] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x11e068 [0042.100] GetProcessHeap () returned 0x110000 [0042.100] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11e068, Size=0x72) returned 0x11aa58 [0042.100] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x1e0 [0042.100] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0042.100] CloseHandle (hObject=0x1e0) returned 1 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11dd08 | out: hHeap=0x110000) returned 1 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11aa58 | out: hHeap=0x110000) returned 1 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x114178 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x1141a0 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x1148f8 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.101] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1141a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1148f8 | out: hHeap=0x110000) returned 1 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.101] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffd4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffd4c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1141a0 | out: hHeap=0x110000) returned 1 [0042.101] GetProcessHeap () returned 0x110000 [0042.101] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x60) returned 0x118908 [0042.101] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x114178 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x1141a0 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x1148f8 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.102] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1141a0, nSize=0xf | out: lpDst="") returned 0x1e [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1148f8 | out: hHeap=0x110000) returned 1 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1141a0, Size=0x3a) returned 0x1148f8 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x3a) returned 0x11e0f8 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.102] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x1148f8, nSize=0x1d | out: lpDst="") returned 0x1e [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11e0f8 | out: hHeap=0x110000) returned 1 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1148f8, Size=0x72) returned 0x11aa58 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x72) returned 0x1104a0 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.102] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x11aa58, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1104a0 | out: hHeap=0x110000) returned 1 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11dfd8 [0042.102] GetProcessHeap () returned 0x110000 [0042.102] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3e) returned 0x11e020 [0042.102] GetProcessHeap () returned 0x110000 [0042.103] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x3e) returned 0x11e068 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x10) returned 0x1184c0 [0042.103] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc64 | out: phkResult=0xeffc64*=0x1e4) returned 0x0 [0042.103] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xeffc60, lpData=0x11e068, lpcbData=0xeffc68*=0x3e | out: lpType=0xeffc60*=0x2, lpData=0x11e068*=0x47, lpcbData=0xeffc68*=0x98) returned 0xea [0042.103] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1184c0 | out: hHeap=0x110000) returned 1 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11e068 | out: hHeap=0x110000) returned 1 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11e020, Size=0x7a) returned 0x114b68 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x7a) returned 0x115270 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x11af28 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x10) returned 0x1184c0 [0042.103] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc64 | out: phkResult=0xeffc64*=0x1e4) returned 0x0 [0042.103] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xeffc60, lpData=0x115270, lpcbData=0xeffc68*=0x7a | out: lpType=0xeffc60*=0x2, lpData=0x115270*=0x28, lpcbData=0xeffc68*=0x98) returned 0xea [0042.103] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1184c0 | out: hHeap=0x110000) returned 1 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11af28 | out: hHeap=0x110000) returned 1 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.103] GetProcessHeap () returned 0x110000 [0042.103] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x114b68, Size=0xf2) returned 0x11a1c8 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xf2) returned 0x119058 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x10) returned 0x1183b8 [0042.104] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc64 | out: phkResult=0xeffc64*=0x1e4) returned 0x0 [0042.104] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xeffc60, lpData=0x119058, lpcbData=0xeffc68*=0xf2 | out: lpType=0xeffc60*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xeffc68*=0x98) returned 0x0 [0042.104] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1183b8 | out: hHeap=0x110000) returned 1 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x114178 [0042.104] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc64 | out: phkResult=0xeffc64*=0x1e4) returned 0x0 [0042.104] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffc60, lpData=0x1190f0, lpcbData=0xeffc68*=0x5a | out: lpType=0xeffc60*=0x0, lpData=0x1190f0*=0x1a, lpcbData=0xeffc68*=0x5a) returned 0x2 [0042.104] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.104] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc78 | out: phkResult=0xeffc78*=0x1e4) returned 0x0 [0042.104] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffc74, lpData=0x1190f0, lpcbData=0xeffc7c*=0x5a | out: lpType=0xeffc74*=0x2, lpData=0x1190f0*=0x1a, lpcbData=0xeffc7c*=0x78) returned 0xea [0042.104] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x119058 | out: hHeap=0x110000) returned 1 [0042.104] GetProcessHeap () returned 0x110000 [0042.104] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11a1c8, Size=0x1e2) returned 0x12a178 [0042.104] GetProcessHeap () returned 0x110000 [0042.105] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e2) returned 0x12a368 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x10) returned 0x118448 [0042.105] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc64 | out: phkResult=0xeffc64*=0x1e4) returned 0x0 [0042.105] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xeffc60, lpData=0x12a368, lpcbData=0xeffc68*=0x1e2 | out: lpType=0xeffc60*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xeffc68*=0x98) returned 0x0 [0042.105] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118448 | out: hHeap=0x110000) returned 1 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x114178 [0042.105] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc64 | out: phkResult=0xeffc64*=0x1e4) returned 0x0 [0042.105] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffc60, lpData=0x12a400, lpcbData=0xeffc68*=0x14a | out: lpType=0xeffc60*=0x0, lpData=0x12a400*=0x0, lpcbData=0xeffc68*=0x14a) returned 0x2 [0042.105] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.105] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffc78 | out: phkResult=0xeffc78*=0x1e4) returned 0x0 [0042.105] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffc74, lpData=0x12a400, lpcbData=0xeffc7c*=0x14a | out: lpType=0xeffc74*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xeffc7c*=0x78) returned 0x0 [0042.105] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x114178 | out: hHeap=0x110000) returned 1 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.105] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x12a178, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0042.105] GetProcessHeap () returned 0x110000 [0042.105] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a368 | out: hHeap=0x110000) returned 1 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11dfd8 | out: hHeap=0x110000) returned 1 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x118448 [0042.105] GetProcessHeap () returned 0x110000 [0042.105] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x10) returned 0x1183b8 [0042.105] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x118460 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.106] ExpandEnvironmentStringsW (in: lpSrc="oit.txt", lpDst=0x1183b8, nSize=0x8 | out: lpDst="oit.txt") returned 0x8 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118460 | out: hHeap=0x110000) returned 1 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118448 | out: hHeap=0x110000) returned 1 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a368 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a580 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a798 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a9b0 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12abc8 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12ade0 [0042.106] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12a580, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12aff8 [0042.106] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12aff8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0042.106] GetProcessHeap () returned 0x110000 [0042.106] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12aff8 | out: hHeap=0x110000) returned 1 [0042.106] GetProcessHeap () returned 0x110000 [0042.106] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12aff8 [0042.106] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12aff8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0042.106] GetProcessHeap () returned 0x110000 [0042.107] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12aff8 | out: hHeap=0x110000) returned 1 [0042.107] GetProcessHeap () returned 0x110000 [0042.107] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12aff8 [0042.107] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12aff8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0042.107] GetProcessHeap () returned 0x110000 [0042.107] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12aff8 | out: hHeap=0x110000) returned 1 [0042.107] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=0) returned 1 [0042.550] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xeffd5c | out: phkResult=0xeffd5c*=0x1e4) returned 0x0 [0042.551] RegSetValueExW (hKey=0x1e4, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData=0x12a9b0, cbData=0xe4) returned 0x5 [0042.551] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.552] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xeffd70 | out: phkResult=0xeffd70*=0x1e4) returned 0x0 [0042.552] RegSetValueExW (in: hKey=0x1e4, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe") returned 0x0 [0042.643] RegCloseKey (hKey=0x1e4) returned 0x0 [0042.643] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt"), bFailIfExists=1) returned 0 [0042.643] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt")) returned 0xffffffff [0042.643] GetProcessHeap () returned 0x110000 [0042.643] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x118) returned 0x11a8f0 [0042.643] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 1 [0042.749] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0042.749] GetFileAttributesW (lpFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0042.749] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 0 [0042.751] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oit.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\oit.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0042.751] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a8f0 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1183b8 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a368 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a580 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a798 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a9b0 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12abc8 | out: hHeap=0x110000) returned 1 [0042.751] GetProcessHeap () returned 0x110000 [0042.751] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ade0 | out: hHeap=0x110000) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118908 | out: hHeap=0x110000) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11aa58 | out: hHeap=0x110000) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a178 | out: hHeap=0x110000) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c370 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c0f0 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0042.752] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c0f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c370 | out: hHeap=0x110000) returned 1 [0042.752] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffd84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffd84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c0f0 | out: hHeap=0x110000) returned 1 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x28) returned 0x1207f8 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x1183b8 [0042.752] GetProcessHeap () returned 0x110000 [0042.752] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x190) returned 0x11b038 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x70) returned 0x118908 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x66) returned 0x112f60 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x112f60, Size=0xca) returned 0x118e80 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x184) returned 0x11a6c8 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x118460 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a178 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x250) returned 0x12a390 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xa0) returned 0x11af28 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x94) returned 0x11b688 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x94) returned 0x11a5a0 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.283] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0x11b688, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0043.283] GetProcessHeap () returned 0x110000 [0043.283] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a5a0 | out: hHeap=0x110000) returned 1 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11af28 | out: hHeap=0x110000) returned 1 [0043.283] GetProcessHeap () returned 0x110000 [0043.283] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x70) returned 0x112f60 [0043.283] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x62) returned 0x11aa58 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x62) returned 0x1104a0 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.284] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x11aa58, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1104a0 | out: hHeap=0x110000) returned 1 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11aa58, Size=0xc2) returned 0x11a5a0 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xc2) returned 0x11b558 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.284] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x11a5a0, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b558 | out: hHeap=0x110000) returned 1 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x112f60 | out: hHeap=0x110000) returned 1 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a5e8 [0043.284] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12a5e8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0043.284] GetProcessHeap () returned 0x110000 [0043.284] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a5e8 | out: hHeap=0x110000) returned 1 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x24e) returned 0x12a5e8 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x12a5e8, Size=0x3cc) returned 0x12a5e8 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x96) returned 0x11af28 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11af28, Size=0x140) returned 0x11b248 [0043.284] GetProcessHeap () returned 0x110000 [0043.284] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x6a) returned 0x112f60 [0043.284] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a178 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a390 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b688 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a5a0 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1183b8 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b038 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118908 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a6c8 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c2a8 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c140 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c168 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.285] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c140, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c168 | out: hHeap=0x110000) returned 1 [0043.285] GetProcessHeap () returned 0x110000 [0043.285] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2a8 | out: hHeap=0x110000) returned 1 [0043.285] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffd84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffd84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c140 | out: hHeap=0x110000) returned 1 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x28) returned 0x1207c8 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x118478 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x190) returned 0x11b038 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x70) returned 0x118908 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x66) returned 0x11aa58 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11aa58, Size=0xca) returned 0x11a5a0 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x184) returned 0x11a6c8 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10) returned 0x1183b8 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a178 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x250) returned 0x12a390 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xa0) returned 0x11af28 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x94) returned 0x11b688 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x94) returned 0x11b558 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.286] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0x11b688, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0043.286] GetProcessHeap () returned 0x110000 [0043.286] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b558 | out: hHeap=0x110000) returned 1 [0043.286] GetProcessHeap () returned 0x110000 [0043.286] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11af28 | out: hHeap=0x110000) returned 1 [0043.286] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x70) returned 0x11aa58 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x62) returned 0x1104a0 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x62) returned 0x1150c0 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.287] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x1104a0, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1150c0 | out: hHeap=0x110000) returned 1 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1104a0, Size=0xc2) returned 0x11b558 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0xc2) returned 0x11a468 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0043.287] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x11b558, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a468 | out: hHeap=0x110000) returned 1 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11aa58 | out: hHeap=0x110000) returned 1 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20a) returned 0x12a9c0 [0043.287] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12a9c0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x6c [0043.287] GetProcessHeap () returned 0x110000 [0043.287] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a9c0 | out: hHeap=0x110000) returned 1 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x182) returned 0x12a9c0 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x24e) returned 0x12ab50 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x96) returned 0x11af28 [0043.287] GetProcessHeap () returned 0x110000 [0043.287] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11af28, Size=0x140) returned 0x12ada8 [0043.287] GetProcessHeap () returned 0x110000 [0043.288] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x6a) returned 0x11aa58 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a178 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12a390 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b688 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b558 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118478 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b038 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x118908 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a6c8 | out: hHeap=0x110000) returned 1 [0043.288] GetProcessHeap () returned 0x110000 [0043.288] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x14) returned 0x1212b0 [0043.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f22ee, lpParameter=0x1212b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0043.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f239a, lpParameter=0xeffdbc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0043.289] GetProcessHeap () returned 0x110000 [0043.289] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x14) returned 0x121030 [0043.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f2161, lpParameter=0x121030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0043.290] GetProcessHeap () returned 0x110000 [0043.290] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x14) returned 0x121130 [0043.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f1a76, lpParameter=0x121130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0043.290] GetProcessHeap () returned 0x110000 [0043.290] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x14) returned 0x121110 [0043.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x11f1cc5, lpParameter=0x121110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0043.291] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0xffffffff) returned 0x0 [0043.983] WaitForMultipleObjects (nCount=0x4, lpHandles=0xeffe18*=0x1e4, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 5 os_tid = 0x1178 Thread: id = 6 os_tid = 0x11c4 [0043.324] GetProcessHeap () returned 0x110000 [0043.324] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x440) returned 0x12b7d0 [0043.324] GetProcessHeap () returned 0x110000 [0043.324] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x30) returned 0x1263f0 [0043.324] GetCurrentProcess () returned 0xffffffff [0043.324] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x118f8e0 | out: TokenHandle=0x118f8e0*=0x218) returned 1 [0043.324] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x118f8d8 | out: lpLuid=0x118f8d8*(LowPart=0x14, HighPart=0)) returned 1 [0043.330] AdjustTokenPrivileges (in: TokenHandle=0x218, DisableAllPrivileges=0, NewState=0x118f8c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0043.330] CloseHandle (hObject=0x218) returned 1 [0043.330] GetProcessHeap () returned 0x110000 [0043.330] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1263f0 | out: hHeap=0x110000) returned 1 [0043.330] GetProcessHeap () returned 0x110000 [0043.330] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x434) returned 0x12c408 [0043.331] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0043.346] Process32FirstW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.347] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.347] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.348] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.348] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.349] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.349] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.350] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.350] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.351] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.351] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0043.352] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0043.352] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.352] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.353] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.353] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.354] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.354] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.355] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.355] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.356] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.452] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.452] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.453] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.453] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.454] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.454] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.454] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0043.455] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.455] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0043.456] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.456] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0043.457] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0043.457] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0043.458] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0043.458] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0043.459] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0043.459] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.460] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending windsor.exe")) returned 1 [0043.460] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="appointment_impressed.exe")) returned 1 [0043.461] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mia_swing.exe")) returned 1 [0043.461] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy_ended_vietnamese.exe")) returned 1 [0043.461] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1 [0043.462] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="author_across_ci.exe")) returned 1 [0043.463] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="critics_herbal_amplifier.exe")) returned 1 [0043.463] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0043.464] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lone.exe")) returned 1 [0043.464] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="brook_den.exe")) returned 1 [0043.465] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0043.465] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="registration blue.exe")) returned 1 [0043.466] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="played secure.exe")) returned 1 [0043.466] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="latitudequalificationsheadlines.exe")) returned 1 [0043.467] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0043.467] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicks experienced powell.exe")) returned 1 [0043.468] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcy_laboratory_saving.exe")) returned 1 [0043.468] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_species.exe")) returned 1 [0043.468] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="types.exe")) returned 1 [0043.469] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0043.469] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0043.470] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0043.471] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0043.472] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0043.473] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0043.474] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0043.475] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0043.475] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0043.476] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0043.477] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0043.478] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0043.479] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0043.480] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0043.480] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0043.481] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0043.482] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0043.483] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0043.484] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xe50) returned 0x264 [0043.484] TerminateProcess (hProcess=0x264, uExitCode=0x0) returned 1 [0043.651] CloseHandle (hObject=0x264) returned 1 [0043.651] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0043.657] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0043.661] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0043.665] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0043.666] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0043.667] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x84) returned 0x264 [0043.667] TerminateProcess (hProcess=0x264, uExitCode=0x0) returned 1 [0043.671] CloseHandle (hObject=0x264) returned 1 [0043.671] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0043.672] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0043.673] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0043.673] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0043.674] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0043.675] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0043.675] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0043.676] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0043.677] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0043.677] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0043.678] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0043.679] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0043.679] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0043.680] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0043.681] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0043.681] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0043.682] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0043.683] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0043.683] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0043.684] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0043.684] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0043.685] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="persons_move.exe")) returned 1 [0043.685] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-fantastic.exe")) returned 1 [0043.686] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="releaserefine.exe")) returned 1 [0043.687] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="color-infection-held.exe")) returned 1 [0043.687] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="home marathon dining.exe")) returned 1 [0043.688] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.688] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0043.689] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0043.689] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0043.690] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0043.691] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0043.691] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0043.692] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.692] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1208, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.693] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x129c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11f0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.693] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0043.694] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0043.694] Process32NextW (in: hSnapshot=0x218, lppe=0x118f6b4 | out: lppe=0x118f6b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x11a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0 [0043.695] CloseHandle (hObject=0x218) returned 1 [0043.695] Sleep (dwMilliseconds=0x1f4) [0044.443] GetProcessHeap () returned 0x110000 [0044.443] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c408 | out: hHeap=0x110000) returned 1 [0044.443] GetProcessHeap () returned 0x110000 [0044.443] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12b7d0 | out: hHeap=0x110000) returned 1 [0044.443] GetProcessHeap () returned 0x110000 [0044.443] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1212b0 | out: hHeap=0x110000) returned 1 Thread: id = 7 os_tid = 0x11e0 [0043.363] GetVersion () returned 0x23f00206 [0043.363] GetCurrentProcess () returned 0xffffffff [0043.363] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x270fab4 | out: TokenHandle=0x270fab4*=0x250) returned 1 [0043.363] GetTokenInformation (in: TokenHandle=0x250, TokenInformationClass=0x14, TokenInformation=0x270faac, TokenInformationLength=0x4, ReturnLength=0x270fab0 | out: TokenInformation=0x270faac, ReturnLength=0x270fab0) returned 1 [0043.363] CloseHandle (hObject=0x250) returned 1 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c398 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c190 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c078 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x11af28 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11af28 | out: hHeap=0x110000) returned 1 [0043.364] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c190, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c078 | out: hHeap=0x110000) returned 1 [0043.364] GetProcessHeap () returned 0x110000 [0043.364] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c398 | out: hHeap=0x110000) returned 1 [0043.364] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.365] GetProcessHeap () returned 0x110000 [0043.365] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c190 | out: hHeap=0x110000) returned 1 [0043.365] GetProcessHeap () returned 0x110000 [0043.365] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11e020 [0043.365] GetProcessHeap () returned 0x110000 [0043.365] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x11e068 [0043.365] GetProcessHeap () returned 0x110000 [0043.365] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11e068, Size=0x72) returned 0x1104a0 [0043.365] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x250 [0043.365] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102 [0043.365] CloseHandle (hObject=0x250) returned 1 [0043.365] GetProcessHeap () returned 0x110000 [0043.365] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11e020 | out: hHeap=0x110000) returned 1 [0043.365] GetProcessHeap () returned 0x110000 [0043.365] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1104a0 | out: hHeap=0x110000) returned 1 [0043.365] Sleep (dwMilliseconds=0x3e8) [0044.551] GetProcessHeap () returned 0x110000 [0044.551] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c028 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c140 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x1432c8 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1432c8 | out: hHeap=0x110000) returned 1 [0044.551] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c140, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c028 | out: hHeap=0x110000) returned 1 [0044.551] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.551] GetProcessHeap () returned 0x110000 [0044.551] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c140 | out: hHeap=0x110000) returned 1 [0044.552] GetProcessHeap () returned 0x110000 [0044.552] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11dd50 [0044.552] GetProcessHeap () returned 0x110000 [0044.552] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x11dd98 [0044.552] GetProcessHeap () returned 0x110000 [0044.552] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x11dd98, Size=0x72) returned 0x1440b8 [0044.552] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x28c [0044.552] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x102 [0044.552] CloseHandle (hObject=0x28c) returned 1 [0044.552] GetProcessHeap () returned 0x110000 [0044.552] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11dd50 | out: hHeap=0x110000) returned 1 [0044.552] GetProcessHeap () returned 0x110000 [0044.552] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1440b8 | out: hHeap=0x110000) returned 1 [0044.552] Sleep (dwMilliseconds=0x3e8) [0046.041] GetProcessHeap () returned 0x110000 [0046.041] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c3c0 [0046.041] GetProcessHeap () returned 0x110000 [0046.041] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c028 [0046.041] GetProcessHeap () returned 0x110000 [0046.041] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c280 [0046.041] GetProcessHeap () returned 0x110000 [0046.041] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0046.041] GetProcessHeap () returned 0x110000 [0046.041] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0046.041] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c028, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.041] GetProcessHeap () returned 0x110000 [0046.041] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0046.041] GetProcessHeap () returned 0x110000 [0046.041] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0046.041] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.042] GetProcessHeap () returned 0x110000 [0046.042] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c028 | out: hHeap=0x110000) returned 1 [0046.042] GetProcessHeap () returned 0x110000 [0046.042] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140d30 [0046.042] GetProcessHeap () returned 0x110000 [0046.042] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140988 [0046.042] GetProcessHeap () returned 0x110000 [0046.042] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140988, Size=0x72) returned 0x144238 [0046.042] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0046.043] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0046.043] CloseHandle (hObject=0x2d4) returned 1 [0046.043] GetProcessHeap () returned 0x110000 [0046.043] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140d30 | out: hHeap=0x110000) returned 1 [0046.043] GetProcessHeap () returned 0x110000 [0046.043] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144238 | out: hHeap=0x110000) returned 1 [0046.043] Sleep (dwMilliseconds=0x3e8) [0047.353] GetProcessHeap () returned 0x110000 [0047.353] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c3c0 [0047.353] GetProcessHeap () returned 0x110000 [0047.353] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c280 [0047.353] GetProcessHeap () returned 0x110000 [0047.353] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c028 [0047.353] GetProcessHeap () returned 0x110000 [0047.353] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0047.353] GetProcessHeap () returned 0x110000 [0047.353] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0047.353] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c280, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.353] GetProcessHeap () returned 0x110000 [0047.353] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c028 | out: hHeap=0x110000) returned 1 [0047.353] GetProcessHeap () returned 0x110000 [0047.353] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0047.353] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.354] GetProcessHeap () returned 0x110000 [0047.354] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0047.354] GetProcessHeap () returned 0x110000 [0047.354] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140a18 [0047.354] GetProcessHeap () returned 0x110000 [0047.354] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140820 [0047.354] GetProcessHeap () returned 0x110000 [0047.354] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140820, Size=0x72) returned 0x144238 [0047.354] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0047.354] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0047.354] CloseHandle (hObject=0x2d4) returned 1 [0047.355] GetProcessHeap () returned 0x110000 [0047.355] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140a18 | out: hHeap=0x110000) returned 1 [0047.355] GetProcessHeap () returned 0x110000 [0047.355] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144238 | out: hHeap=0x110000) returned 1 [0047.355] Sleep (dwMilliseconds=0x3e8) [0048.709] GetProcessHeap () returned 0x110000 [0048.709] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0048.709] GetProcessHeap () returned 0x110000 [0048.709] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c028 [0048.709] GetProcessHeap () returned 0x110000 [0048.709] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0048.709] GetProcessHeap () returned 0x110000 [0048.709] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0048.709] GetProcessHeap () returned 0x110000 [0048.709] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0048.709] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c028, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.709] GetProcessHeap () returned 0x110000 [0048.709] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0048.709] GetProcessHeap () returned 0x110000 [0048.709] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0048.709] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.710] GetProcessHeap () returned 0x110000 [0048.710] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c028 | out: hHeap=0x110000) returned 1 [0048.710] GetProcessHeap () returned 0x110000 [0048.710] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140940 [0048.711] GetProcessHeap () returned 0x110000 [0048.711] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140988 [0048.711] GetProcessHeap () returned 0x110000 [0048.711] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140988, Size=0x72) returned 0x1439b8 [0048.711] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0048.711] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0048.711] CloseHandle (hObject=0x2d4) returned 1 [0048.711] GetProcessHeap () returned 0x110000 [0048.711] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140940 | out: hHeap=0x110000) returned 1 [0048.711] GetProcessHeap () returned 0x110000 [0048.711] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1439b8 | out: hHeap=0x110000) returned 1 [0048.711] Sleep (dwMilliseconds=0x3e8) [0050.128] GetProcessHeap () returned 0x110000 [0050.128] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0050.128] GetProcessHeap () returned 0x110000 [0050.128] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0050.128] GetProcessHeap () returned 0x110000 [0050.128] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0050.128] GetProcessHeap () returned 0x110000 [0050.128] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0050.128] GetProcessHeap () returned 0x110000 [0050.128] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0050.128] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.128] GetProcessHeap () returned 0x110000 [0050.128] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0050.128] GetProcessHeap () returned 0x110000 [0050.128] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0050.128] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.129] GetProcessHeap () returned 0x110000 [0050.129] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0050.129] GetProcessHeap () returned 0x110000 [0050.129] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140a18 [0050.129] GetProcessHeap () returned 0x110000 [0050.129] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140820 [0050.129] GetProcessHeap () returned 0x110000 [0050.129] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140820, Size=0x72) returned 0x143fb8 [0050.129] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0050.129] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0050.129] CloseHandle (hObject=0x2d4) returned 1 [0050.129] GetProcessHeap () returned 0x110000 [0050.129] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140a18 | out: hHeap=0x110000) returned 1 [0050.129] GetProcessHeap () returned 0x110000 [0050.129] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143fb8 | out: hHeap=0x110000) returned 1 [0050.129] Sleep (dwMilliseconds=0x3e8) [0051.347] GetProcessHeap () returned 0x110000 [0051.347] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0051.347] GetProcessHeap () returned 0x110000 [0051.347] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0051.347] GetProcessHeap () returned 0x110000 [0051.347] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0051.347] GetProcessHeap () returned 0x110000 [0051.347] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0051.347] GetProcessHeap () returned 0x110000 [0051.347] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0051.347] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.347] GetProcessHeap () returned 0x110000 [0051.347] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0051.347] GetProcessHeap () returned 0x110000 [0051.347] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0051.347] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.348] GetProcessHeap () returned 0x110000 [0051.348] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0051.348] GetProcessHeap () returned 0x110000 [0051.348] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x13ffb0 [0051.348] GetProcessHeap () returned 0x110000 [0051.348] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x13fff8 [0051.348] GetProcessHeap () returned 0x110000 [0051.348] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x13fff8, Size=0x72) returned 0x1439b8 [0051.348] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0051.348] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0051.348] CloseHandle (hObject=0x2d4) returned 1 [0051.348] GetProcessHeap () returned 0x110000 [0051.348] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x13ffb0 | out: hHeap=0x110000) returned 1 [0051.349] GetProcessHeap () returned 0x110000 [0051.349] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1439b8 | out: hHeap=0x110000) returned 1 [0051.349] Sleep (dwMilliseconds=0x3e8) [0052.574] GetProcessHeap () returned 0x110000 [0052.574] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0052.574] GetProcessHeap () returned 0x110000 [0052.574] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0052.574] GetProcessHeap () returned 0x110000 [0052.574] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0052.574] GetProcessHeap () returned 0x110000 [0052.574] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0052.574] GetProcessHeap () returned 0x110000 [0052.574] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0052.574] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.574] GetProcessHeap () returned 0x110000 [0052.574] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0052.574] GetProcessHeap () returned 0x110000 [0052.574] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0052.574] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.575] GetProcessHeap () returned 0x110000 [0052.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0052.575] GetProcessHeap () returned 0x110000 [0052.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140d30 [0052.575] GetProcessHeap () returned 0x110000 [0052.575] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x1408b0 [0052.575] GetProcessHeap () returned 0x110000 [0052.575] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1408b0, Size=0x72) returned 0x144038 [0052.575] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0052.575] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0052.575] CloseHandle (hObject=0x2d4) returned 1 [0052.575] GetProcessHeap () returned 0x110000 [0052.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140d30 | out: hHeap=0x110000) returned 1 [0052.575] GetProcessHeap () returned 0x110000 [0052.575] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144038 | out: hHeap=0x110000) returned 1 [0052.575] Sleep (dwMilliseconds=0x3e8) [0053.729] GetProcessHeap () returned 0x110000 [0053.729] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0053.729] GetProcessHeap () returned 0x110000 [0053.729] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0053.729] GetProcessHeap () returned 0x110000 [0053.729] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0053.729] GetProcessHeap () returned 0x110000 [0053.729] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0053.729] GetProcessHeap () returned 0x110000 [0053.730] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0053.730] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.730] GetProcessHeap () returned 0x110000 [0053.730] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0053.730] GetProcessHeap () returned 0x110000 [0053.730] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0053.730] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.730] GetProcessHeap () returned 0x110000 [0053.730] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0053.730] GetProcessHeap () returned 0x110000 [0053.730] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140c10 [0053.730] GetProcessHeap () returned 0x110000 [0053.730] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x1409d0 [0053.730] GetProcessHeap () returned 0x110000 [0053.730] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1409d0, Size=0x72) returned 0x143db8 [0053.730] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0053.731] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0053.731] CloseHandle (hObject=0x2d4) returned 1 [0053.731] GetProcessHeap () returned 0x110000 [0053.731] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140c10 | out: hHeap=0x110000) returned 1 [0053.731] GetProcessHeap () returned 0x110000 [0053.731] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143db8 | out: hHeap=0x110000) returned 1 [0053.731] Sleep (dwMilliseconds=0x3e8) [0054.952] GetProcessHeap () returned 0x110000 [0054.952] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0054.952] GetProcessHeap () returned 0x110000 [0054.952] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0054.952] GetProcessHeap () returned 0x110000 [0054.952] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0054.953] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0054.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140b38 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140d78 [0054.953] GetProcessHeap () returned 0x110000 [0054.953] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140d78, Size=0x72) returned 0x1441b8 [0054.954] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0054.954] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0054.954] CloseHandle (hObject=0x2d4) returned 1 [0054.954] GetProcessHeap () returned 0x110000 [0054.954] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140b38 | out: hHeap=0x110000) returned 1 [0054.954] GetProcessHeap () returned 0x110000 [0054.954] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1441b8 | out: hHeap=0x110000) returned 1 [0054.954] Sleep (dwMilliseconds=0x3e8) [0056.241] GetProcessHeap () returned 0x110000 [0056.241] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0056.241] GetProcessHeap () returned 0x110000 [0056.241] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0056.241] GetProcessHeap () returned 0x110000 [0056.241] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0056.241] GetProcessHeap () returned 0x110000 [0056.241] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0056.241] GetProcessHeap () returned 0x110000 [0056.241] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0056.241] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.241] GetProcessHeap () returned 0x110000 [0056.241] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0056.241] GetProcessHeap () returned 0x110000 [0056.241] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0056.241] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.242] GetProcessHeap () returned 0x110000 [0056.242] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0056.242] GetProcessHeap () returned 0x110000 [0056.242] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140280 [0056.242] GetProcessHeap () returned 0x110000 [0056.242] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140088 [0056.242] GetProcessHeap () returned 0x110000 [0056.242] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140088, Size=0x72) returned 0x144238 [0056.242] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0056.242] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0056.242] CloseHandle (hObject=0x2d4) returned 1 [0056.242] GetProcessHeap () returned 0x110000 [0056.242] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140280 | out: hHeap=0x110000) returned 1 [0056.242] GetProcessHeap () returned 0x110000 [0056.242] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144238 | out: hHeap=0x110000) returned 1 [0056.242] Sleep (dwMilliseconds=0x3e8) [0057.523] GetProcessHeap () returned 0x110000 [0057.523] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0057.523] GetProcessHeap () returned 0x110000 [0057.523] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0057.523] GetProcessHeap () returned 0x110000 [0057.523] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0057.523] GetProcessHeap () returned 0x110000 [0057.523] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0057.523] GetProcessHeap () returned 0x110000 [0057.523] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0057.523] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.523] GetProcessHeap () returned 0x110000 [0057.523] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0057.523] GetProcessHeap () returned 0x110000 [0057.523] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0057.523] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.524] GetProcessHeap () returned 0x110000 [0057.524] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0057.524] GetProcessHeap () returned 0x110000 [0057.524] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x13ff20 [0057.524] GetProcessHeap () returned 0x110000 [0057.524] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x13ff68 [0057.524] GetProcessHeap () returned 0x110000 [0057.524] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x13ff68, Size=0x72) returned 0x144238 [0057.524] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0057.524] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0057.524] CloseHandle (hObject=0x2d4) returned 1 [0057.524] GetProcessHeap () returned 0x110000 [0057.524] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x13ff20 | out: hHeap=0x110000) returned 1 [0057.524] GetProcessHeap () returned 0x110000 [0057.524] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144238 | out: hHeap=0x110000) returned 1 [0057.524] Sleep (dwMilliseconds=0x3e8) [0058.682] GetProcessHeap () returned 0x110000 [0058.682] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0058.682] GetProcessHeap () returned 0x110000 [0058.682] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0058.682] GetProcessHeap () returned 0x110000 [0058.682] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0058.682] GetProcessHeap () returned 0x110000 [0058.682] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0058.682] GetProcessHeap () returned 0x110000 [0058.682] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0058.682] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.683] GetProcessHeap () returned 0x110000 [0058.683] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0058.683] GetProcessHeap () returned 0x110000 [0058.683] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0058.683] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.684] GetProcessHeap () returned 0x110000 [0058.684] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0058.684] GetProcessHeap () returned 0x110000 [0058.684] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x140550 [0058.684] GetProcessHeap () returned 0x110000 [0058.684] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x140040 [0058.684] GetProcessHeap () returned 0x110000 [0058.684] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x140040, Size=0x72) returned 0x143b38 [0058.684] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0058.684] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0058.684] CloseHandle (hObject=0x2d4) returned 1 [0058.684] GetProcessHeap () returned 0x110000 [0058.684] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x140550 | out: hHeap=0x110000) returned 1 [0058.684] GetProcessHeap () returned 0x110000 [0058.684] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143b38 | out: hHeap=0x110000) returned 1 [0058.684] Sleep (dwMilliseconds=0x3e8) [0060.323] GetProcessHeap () returned 0x110000 [0060.323] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0060.323] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0060.323] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x15fac0 [0060.323] GetProcessHeap () returned 0x110000 [0060.323] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160258 [0060.323] GetProcessHeap () returned 0x110000 [0060.324] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160258, Size=0x72) returned 0x143b38 [0060.324] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0060.324] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0060.324] CloseHandle (hObject=0x2d8) returned 1 [0060.324] GetProcessHeap () returned 0x110000 [0060.324] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15fac0 | out: hHeap=0x110000) returned 1 [0060.324] GetProcessHeap () returned 0x110000 [0060.324] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143b38 | out: hHeap=0x110000) returned 1 [0060.324] Sleep (dwMilliseconds=0x3e8) [0061.438] GetProcessHeap () returned 0x110000 [0061.438] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c2f8 [0061.438] GetProcessHeap () returned 0x110000 [0061.438] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c280 [0061.438] GetProcessHeap () returned 0x110000 [0061.438] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0061.438] GetProcessHeap () returned 0x110000 [0061.438] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0061.438] GetProcessHeap () returned 0x110000 [0061.438] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0061.438] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c280, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.438] GetProcessHeap () returned 0x110000 [0061.438] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0061.438] GetProcessHeap () returned 0x110000 [0061.438] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0061.438] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.439] GetProcessHeap () returned 0x110000 [0061.439] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0061.439] GetProcessHeap () returned 0x110000 [0061.439] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x1609a8 [0061.439] GetProcessHeap () returned 0x110000 [0061.439] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160408 [0061.439] GetProcessHeap () returned 0x110000 [0061.439] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160408, Size=0x72) returned 0x144138 [0061.439] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0061.440] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0061.440] CloseHandle (hObject=0x2d8) returned 1 [0061.440] GetProcessHeap () returned 0x110000 [0061.440] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1609a8 | out: hHeap=0x110000) returned 1 [0061.440] GetProcessHeap () returned 0x110000 [0061.440] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144138 | out: hHeap=0x110000) returned 1 [0061.440] Sleep (dwMilliseconds=0x3e8) [0062.677] GetProcessHeap () returned 0x110000 [0062.677] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0062.677] GetProcessHeap () returned 0x110000 [0062.677] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0062.677] GetProcessHeap () returned 0x110000 [0062.677] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0062.677] GetProcessHeap () returned 0x110000 [0062.677] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0062.677] GetProcessHeap () returned 0x110000 [0062.677] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0062.677] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.677] GetProcessHeap () returned 0x110000 [0062.677] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0062.677] GetProcessHeap () returned 0x110000 [0062.677] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0062.677] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.678] GetProcessHeap () returned 0x110000 [0062.678] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0062.678] GetProcessHeap () returned 0x110000 [0062.678] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x160690 [0062.678] GetProcessHeap () returned 0x110000 [0062.678] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160888 [0062.678] GetProcessHeap () returned 0x110000 [0062.678] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160888, Size=0x72) returned 0x143838 [0062.678] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0062.678] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0062.678] CloseHandle (hObject=0x2d8) returned 1 [0062.678] GetProcessHeap () returned 0x110000 [0062.678] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x160690 | out: hHeap=0x110000) returned 1 [0062.678] GetProcessHeap () returned 0x110000 [0062.678] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143838 | out: hHeap=0x110000) returned 1 [0062.678] Sleep (dwMilliseconds=0x3e8) [0063.769] GetProcessHeap () returned 0x110000 [0063.769] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c2f8 [0063.769] GetProcessHeap () returned 0x110000 [0063.769] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c280 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0063.770] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c280, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0063.770] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x160528 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160720 [0063.770] GetProcessHeap () returned 0x110000 [0063.770] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160720, Size=0x72) returned 0x144338 [0063.770] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0063.771] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0063.771] CloseHandle (hObject=0x2d8) returned 1 [0063.771] GetProcessHeap () returned 0x110000 [0063.771] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x160528 | out: hHeap=0x110000) returned 1 [0063.771] GetProcessHeap () returned 0x110000 [0063.771] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144338 | out: hHeap=0x110000) returned 1 [0063.771] Sleep (dwMilliseconds=0x3e8) [0064.944] GetProcessHeap () returned 0x110000 [0064.944] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0064.944] GetProcessHeap () returned 0x110000 [0064.944] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0064.944] GetProcessHeap () returned 0x110000 [0064.944] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0064.945] GetProcessHeap () returned 0x110000 [0064.945] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0064.945] GetProcessHeap () returned 0x110000 [0064.945] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0064.945] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.945] GetProcessHeap () returned 0x110000 [0064.945] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0064.945] GetProcessHeap () returned 0x110000 [0064.945] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0064.945] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.946] GetProcessHeap () returned 0x110000 [0064.946] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0064.946] GetProcessHeap () returned 0x110000 [0064.946] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x160528 [0064.946] GetProcessHeap () returned 0x110000 [0064.946] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x1609f0 [0064.946] GetProcessHeap () returned 0x110000 [0064.946] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1609f0, Size=0x72) returned 0x1437b8 [0064.946] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0064.946] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0064.946] CloseHandle (hObject=0x2d8) returned 1 [0064.946] GetProcessHeap () returned 0x110000 [0064.946] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x160528 | out: hHeap=0x110000) returned 1 [0064.946] GetProcessHeap () returned 0x110000 [0064.946] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1437b8 | out: hHeap=0x110000) returned 1 [0064.946] Sleep (dwMilliseconds=0x3e8) [0067.760] GetProcessHeap () returned 0x110000 [0067.760] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0067.760] GetProcessHeap () returned 0x110000 [0067.760] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0067.760] GetProcessHeap () returned 0x110000 [0067.760] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0067.760] GetProcessHeap () returned 0x110000 [0067.760] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0067.760] GetProcessHeap () returned 0x110000 [0067.760] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0067.760] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.760] GetProcessHeap () returned 0x110000 [0067.760] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0067.760] GetProcessHeap () returned 0x110000 [0067.760] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0067.760] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.761] GetProcessHeap () returned 0x110000 [0067.761] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0067.761] GetProcessHeap () returned 0x110000 [0067.761] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x1603c0 [0067.761] GetProcessHeap () returned 0x110000 [0067.761] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160840 [0067.761] GetProcessHeap () returned 0x110000 [0067.761] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160840, Size=0x72) returned 0x143bb8 [0067.761] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0067.761] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0067.761] CloseHandle (hObject=0x2d8) returned 1 [0067.761] GetProcessHeap () returned 0x110000 [0067.761] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1603c0 | out: hHeap=0x110000) returned 1 [0067.761] GetProcessHeap () returned 0x110000 [0067.761] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143bb8 | out: hHeap=0x110000) returned 1 [0067.761] Sleep (dwMilliseconds=0x3e8) [0069.073] GetProcessHeap () returned 0x110000 [0069.073] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0069.074] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0069.074] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x160498 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160378 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160378, Size=0x72) returned 0x143938 [0069.074] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0069.074] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0069.074] CloseHandle (hObject=0x2d8) returned 1 [0069.074] GetProcessHeap () returned 0x110000 [0069.074] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x160498 | out: hHeap=0x110000) returned 1 [0069.074] GetProcessHeap () returned 0x110000 [0069.075] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143938 | out: hHeap=0x110000) returned 1 [0069.075] Sleep (dwMilliseconds=0x3e8) [0070.423] GetProcessHeap () returned 0x110000 [0070.423] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c2f8 [0070.423] GetProcessHeap () returned 0x110000 [0070.423] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c3c0 [0070.423] GetProcessHeap () returned 0x110000 [0070.423] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c028 [0070.423] GetProcessHeap () returned 0x110000 [0070.423] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0070.423] GetProcessHeap () returned 0x110000 [0070.423] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0070.423] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c3c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.423] GetProcessHeap () returned 0x110000 [0070.423] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c028 | out: hHeap=0x110000) returned 1 [0070.423] GetProcessHeap () returned 0x110000 [0070.423] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0070.423] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.430] GetProcessHeap () returned 0x110000 [0070.430] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0070.430] GetProcessHeap () returned 0x110000 [0070.430] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x15feb0 [0070.430] GetProcessHeap () returned 0x110000 [0070.430] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x15fac0 [0070.430] GetProcessHeap () returned 0x110000 [0070.430] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x15fac0, Size=0x72) returned 0x143a38 [0070.430] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0070.430] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0070.430] CloseHandle (hObject=0x2d8) returned 1 [0070.430] GetProcessHeap () returned 0x110000 [0070.430] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15feb0 | out: hHeap=0x110000) returned 1 [0070.430] GetProcessHeap () returned 0x110000 [0070.430] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143a38 | out: hHeap=0x110000) returned 1 [0070.430] Sleep (dwMilliseconds=0x3e8) [0071.636] GetProcessHeap () returned 0x110000 [0071.636] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0071.636] GetProcessHeap () returned 0x110000 [0071.636] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c2f8 [0071.636] GetProcessHeap () returned 0x110000 [0071.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0071.637] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c2f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0071.637] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x15fd00 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x160138 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x160138, Size=0x72) returned 0x1439b8 [0071.637] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0071.637] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0071.637] CloseHandle (hObject=0x2d8) returned 1 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x15fd00 | out: hHeap=0x110000) returned 1 [0071.637] GetProcessHeap () returned 0x110000 [0071.637] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1439b8 | out: hHeap=0x110000) returned 1 [0071.637] Sleep (dwMilliseconds=0x3e8) [0072.805] GetProcessHeap () returned 0x110000 [0072.805] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0072.805] GetProcessHeap () returned 0x110000 [0072.805] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c028 [0072.805] GetProcessHeap () returned 0x110000 [0072.805] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0072.805] GetProcessHeap () returned 0x110000 [0072.805] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0072.805] GetProcessHeap () returned 0x110000 [0072.805] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0072.805] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c028, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.805] GetProcessHeap () returned 0x110000 [0072.805] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0072.805] GetProcessHeap () returned 0x110000 [0072.805] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0072.805] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.806] GetProcessHeap () returned 0x110000 [0072.806] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c028 | out: hHeap=0x110000) returned 1 [0072.806] GetProcessHeap () returned 0x110000 [0072.806] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x160210 [0072.806] GetProcessHeap () returned 0x110000 [0072.807] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x1602a0 [0072.807] GetProcessHeap () returned 0x110000 [0072.807] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1602a0, Size=0x72) returned 0x144538 [0072.807] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d8 [0072.807] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0072.807] CloseHandle (hObject=0x2d8) returned 1 [0072.807] GetProcessHeap () returned 0x110000 [0072.807] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x160210 | out: hHeap=0x110000) returned 1 [0072.807] GetProcessHeap () returned 0x110000 [0072.807] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x144538 | out: hHeap=0x110000) returned 1 [0072.807] Sleep (dwMilliseconds=0x3e8) [0074.122] GetProcessHeap () returned 0x110000 [0074.122] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c3c0 [0074.122] GetProcessHeap () returned 0x110000 [0074.122] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c280 [0074.122] GetProcessHeap () returned 0x110000 [0074.122] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0074.122] GetProcessHeap () returned 0x110000 [0074.122] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0074.122] GetProcessHeap () returned 0x110000 [0074.122] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0074.122] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c280, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0074.122] GetProcessHeap () returned 0x110000 [0074.122] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0074.122] GetProcessHeap () returned 0x110000 [0074.122] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0074.122] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0074.269] GetProcessHeap () returned 0x110000 [0074.269] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0074.269] GetProcessHeap () returned 0x110000 [0074.269] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11dfd8 [0074.270] GetProcessHeap () returned 0x110000 [0074.270] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x1602e8 [0074.270] GetProcessHeap () returned 0x110000 [0074.270] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x1602e8, Size=0x72) returned 0x1442b8 [0074.270] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x234 [0074.270] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0074.270] CloseHandle (hObject=0x234) returned 1 [0074.270] GetProcessHeap () returned 0x110000 [0074.270] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11dfd8 | out: hHeap=0x110000) returned 1 [0074.270] GetProcessHeap () returned 0x110000 [0074.270] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1442b8 | out: hHeap=0x110000) returned 1 [0074.270] Sleep (dwMilliseconds=0x3e8) [0075.773] GetProcessHeap () returned 0x110000 [0075.773] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c280 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c0a0 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c2f8 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x115270 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x115270 | out: hHeap=0x110000) returned 1 [0075.774] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c0a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0075.774] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c0a0 | out: hHeap=0x110000) returned 1 [0075.774] GetProcessHeap () returned 0x110000 [0075.774] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11dfd8 [0075.775] GetProcessHeap () returned 0x110000 [0075.775] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x15fac0 [0075.775] GetProcessHeap () returned 0x110000 [0075.775] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x15fac0, Size=0x72) returned 0x143e38 [0075.775] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x234 [0075.775] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0075.775] CloseHandle (hObject=0x234) returned 1 [0075.775] GetProcessHeap () returned 0x110000 [0075.775] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11dfd8 | out: hHeap=0x110000) returned 1 [0075.775] GetProcessHeap () returned 0x110000 [0075.775] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143e38 | out: hHeap=0x110000) returned 1 [0075.775] Sleep (dwMilliseconds=0x3e8) [0077.223] GetProcessHeap () returned 0x110000 [0077.223] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c2f8 [0077.223] GetProcessHeap () returned 0x110000 [0077.223] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c280 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c3c0 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x143248 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x143248 | out: hHeap=0x110000) returned 1 [0077.224] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c280, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c3c0 | out: hHeap=0x110000) returned 1 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c2f8 | out: hHeap=0x110000) returned 1 [0077.224] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x270fa3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x270fa3c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c280 | out: hHeap=0x110000) returned 1 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11dfd8 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x3a) returned 0x15fef8 [0077.224] GetProcessHeap () returned 0x110000 [0077.224] RtlReAllocateHeap (Heap=0x110000, Flags=0x0, Ptr=0x15fef8, Size=0x72) returned 0x1440b8 [0077.224] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x234 [0077.225] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0077.225] CloseHandle (hObject=0x234) returned 1 [0077.225] GetProcessHeap () returned 0x110000 [0077.225] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11dfd8 | out: hHeap=0x110000) returned 1 [0077.225] GetProcessHeap () returned 0x110000 [0077.225] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1440b8 | out: hHeap=0x110000) returned 1 [0077.225] Sleep (dwMilliseconds=0x3e8) Thread: id = 8 os_tid = 0x11d4 [0043.366] GetProcessHeap () returned 0x110000 [0043.366] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x21a) returned 0x12ec28 [0043.366] GetProcessHeap () returned 0x110000 [0043.366] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x28) returned 0x120978 [0043.366] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x250 [0043.366] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x254 [0043.366] GetComputerNameW (in: lpBuffer=0x12ec38, nSize=0x284fc38 | out: lpBuffer="NQDPDE", nSize=0x284fc38) returned 1 [0043.366] GetProcessHeap () returned 0x110000 [0043.366] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c190 [0043.366] GetProcessHeap () returned 0x110000 [0043.366] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x12ee50 [0043.366] GetProcessHeap () returned 0x110000 [0043.366] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x132e58 [0043.367] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x284fbf0 | out: lphEnum=0x284fbf0*=0x11a848) returned 0x0 [0044.896] WNetEnumResourceW (in: hEnum=0x11a848, lpcCount=0x284fbe8, lpBuffer=0x12ee50, lpBufferSize=0x284fbf4 | out: lpcCount=0x284fbe8, lpBuffer=0x12ee50, lpBufferSize=0x284fbf4) returned 0x103 [0044.896] WNetCloseEnum (hEnum=0x11a848) returned 0x0 [0044.896] GetProcessHeap () returned 0x110000 [0044.896] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ee50 | out: hHeap=0x110000) returned 1 [0044.896] GetProcessHeap () returned 0x110000 [0044.896] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x132e58 | out: hHeap=0x110000) returned 1 [0044.896] GetProcessHeap () returned 0x110000 [0044.896] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x147a30 [0044.896] GetProcessHeap () returned 0x110000 [0044.896] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x12ee50 [0044.896] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x284fbd8 | out: lphEnum=0x284fbd8*=0x121270) returned 0x0 [0044.897] WNetEnumResourceW (in: hEnum=0x121270, lpcCount=0x284fbd0, lpBuffer=0x147a30, lpBufferSize=0x284fbdc | out: lpcCount=0x284fbd0, lpBuffer=0x147a30, lpBufferSize=0x284fbdc) returned 0x103 [0044.897] WNetCloseEnum (hEnum=0x121270) returned 0x0 [0044.897] GetProcessHeap () returned 0x110000 [0044.897] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x147a30 | out: hHeap=0x110000) returned 1 [0044.897] GetProcessHeap () returned 0x110000 [0044.897] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ee50 | out: hHeap=0x110000) returned 1 [0044.897] GetProcessHeap () returned 0x110000 [0044.897] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x147a30 [0044.897] GetProcessHeap () returned 0x110000 [0044.897] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x12ee50 [0044.897] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x284fbc0 | out: lphEnum=0x284fbc0*=0x11a848) returned 0x0 [0060.310] WNetEnumResourceW (in: hEnum=0x11a848, lpcCount=0x284fbb8, lpBuffer=0x147a30, lpBufferSize=0x284fbc4 | out: lpcCount=0x284fbb8, lpBuffer=0x147a30, lpBufferSize=0x284fbc4) returned 0x0 [0060.310] GetProcessHeap () returned 0x110000 [0060.310] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x14ba38 [0060.310] GetProcessHeap () returned 0x110000 [0060.310] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x14fa40 [0060.311] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x147a30, lphEnum=0x284fb80 | out: lphEnum=0x284fb80*=0x145860) returned 0x0 [0076.092] WNetEnumResourceW (in: hEnum=0x145860, lpcCount=0x284fb78, lpBuffer=0x14ba38, lpBufferSize=0x284fb84 | out: lpcCount=0x284fb78, lpBuffer=0x14ba38, lpBufferSize=0x284fb84) returned 0x0 [0076.163] WNetEnumResourceW (in: hEnum=0x145860, lpcCount=0x284fb78, lpBuffer=0x14ba38, lpBufferSize=0x284fb84 | out: lpcCount=0x284fb78, lpBuffer=0x14ba38, lpBufferSize=0x284fb84) returned 0x103 [0076.164] WNetCloseEnum (hEnum=0x145860) returned 0x0 [0076.164] GetProcessHeap () returned 0x110000 [0076.164] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x14ba38 | out: hHeap=0x110000) returned 1 [0076.164] GetProcessHeap () returned 0x110000 [0076.164] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x14fa40 | out: hHeap=0x110000) returned 1 [0076.164] WNetEnumResourceW (in: hEnum=0x11a848, lpcCount=0x284fbb8, lpBuffer=0x147a30, lpBufferSize=0x284fbc4 | out: lpcCount=0x284fbb8, lpBuffer=0x147a30, lpBufferSize=0x284fbc4) returned 0x103 [0076.164] WNetCloseEnum (hEnum=0x11a848) returned 0x0 [0076.164] GetProcessHeap () returned 0x110000 [0076.164] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x147a30 | out: hHeap=0x110000) returned 1 [0076.164] GetProcessHeap () returned 0x110000 [0076.164] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ee50 | out: hHeap=0x110000) returned 1 [0076.164] GetProcessHeap () returned 0x110000 [0076.164] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x160a50 [0076.165] GetProcessHeap () returned 0x110000 [0076.165] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x12ee50 [0076.165] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x284fbf0 | out: lphEnum=0x284fbf0*=0x120f50) returned 0x0 [0076.166] WNetEnumResourceW (in: hEnum=0x120f50, lpcCount=0x284fbe8, lpBuffer=0x160a50, lpBufferSize=0x284fbf4 | out: lpcCount=0x284fbe8, lpBuffer=0x160a50, lpBufferSize=0x284fbf4) returned 0x103 [0076.166] WNetCloseEnum (hEnum=0x120f50) returned 0x0 [0076.166] GetProcessHeap () returned 0x110000 [0076.166] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x160a50 | out: hHeap=0x110000) returned 1 [0076.166] GetProcessHeap () returned 0x110000 [0076.166] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12ee50 | out: hHeap=0x110000) returned 1 [0076.166] GetProcessHeap () returned 0x110000 [0076.166] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x160a50 [0076.167] GetProcessHeap () returned 0x110000 [0076.167] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x12ee50 [0076.167] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x284fbd8 | out: lphEnum=0x284fbd8*=0x122f70) returned 0x0 [0076.167] WNetEnumResourceW (in: hEnum=0x122f70, lpcCount=0x284fbd0, lpBuffer=0x160a50, lpBufferSize=0x284fbdc | out: lpcCount=0x284fbd0, lpBuffer=0x160a50, lpBufferSize=0x284fbdc) returned 0x0 [0076.167] GetProcessHeap () returned 0x110000 [0076.167] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x147a30 [0076.167] GetProcessHeap () returned 0x110000 [0076.167] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x14ba38 [0076.167] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x160a90, lphEnum=0x284fb98 | out: lphEnum=0x284fb98*=0x0) returned 0x4c6 [0076.169] GetProcessHeap () returned 0x110000 [0076.169] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x147a30 | out: hHeap=0x110000) returned 1 [0076.169] GetProcessHeap () returned 0x110000 [0076.169] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x14ba38 | out: hHeap=0x110000) returned 1 [0076.169] GetProcessHeap () returned 0x110000 [0076.169] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x4000) returned 0x147a30 [0076.169] GetProcessHeap () returned 0x110000 [0076.169] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x10000) returned 0x14ba38 [0076.169] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x160a70, lphEnum=0x284fb98) Thread: id = 9 os_tid = 0x11cc [0043.388] GetLogicalDrives () returned 0x4 [0043.388] GetProcessHeap () returned 0x110000 [0043.388] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11e458 [0043.388] GetProcessHeap () returned 0x110000 [0043.388] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x28) returned 0x120618 [0043.388] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x264 [0043.388] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x268 [0043.389] GetProcessHeap () returned 0x110000 [0043.389] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c078 [0043.447] GetProcessHeap () returned 0x110000 [0043.447] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c348 [0043.447] GetProcessHeap () returned 0x110000 [0043.447] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c0c8 [0043.447] GetProcessHeap () returned 0x110000 [0043.447] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x11a468 [0043.447] GetProcessHeap () returned 0x110000 [0043.447] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11a468 | out: hHeap=0x110000) returned 1 [0043.447] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c348, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.447] GetProcessHeap () returned 0x110000 [0043.447] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c0c8 | out: hHeap=0x110000) returned 1 [0043.447] GetProcessHeap () returned 0x110000 [0043.447] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c078 | out: hHeap=0x110000) returned 1 [0043.447] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x298ff0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x298ff0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.448] GetProcessHeap () returned 0x110000 [0043.448] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c348 | out: hHeap=0x110000) returned 1 [0043.448] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0xffffffff) returned 0x0 [0043.448] CloseHandle (hObject=0x268) returned 1 [0043.448] CloseHandle (hObject=0x264) returned 1 [0043.448] GetProcessHeap () returned 0x110000 [0043.448] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x120618 | out: hHeap=0x110000) returned 1 [0043.448] GetProcessHeap () returned 0x110000 [0043.448] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11e458 | out: hHeap=0x110000) returned 1 [0043.448] GetProcessHeap () returned 0x110000 [0043.448] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x121130 | out: hHeap=0x110000) returned 1 Thread: id = 10 os_tid = 0x1224 [0043.849] GetLogicalDrives () returned 0x4 [0043.849] GetProcessHeap () returned 0x110000 [0043.849] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x20) returned 0x12c398 [0043.849] GetProcessHeap () returned 0x110000 [0043.850] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x8, Size=0x1e) returned 0x12c208 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x1e) returned 0x12c078 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x90) returned 0x11b688 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11b688 | out: hHeap=0x110000) returned 1 [0043.850] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x12c208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c078 | out: hHeap=0x110000) returned 1 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c398 | out: hHeap=0x110000) returned 1 [0043.850] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2acfc94, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2acfc94*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x12c208 | out: hHeap=0x110000) returned 1 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x40) returned 0x11e140 [0043.850] GetProcessHeap () returned 0x110000 [0043.850] RtlAllocateHeap (HeapHandle=0x110000, Flags=0x0, Size=0x28) returned 0x1206d8 [0043.850] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x264 [0043.850] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x268 [0043.851] CloseHandle (hObject=0x268) returned 1 [0043.851] CloseHandle (hObject=0x264) returned 1 [0043.851] GetProcessHeap () returned 0x110000 [0043.851] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x1206d8 | out: hHeap=0x110000) returned 1 [0043.851] GetProcessHeap () returned 0x110000 [0043.851] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x11e140 | out: hHeap=0x110000) returned 1 [0043.851] GetProcessHeap () returned 0x110000 [0043.851] HeapFree (in: hHeap=0x110000, dwFlags=0x0, lpMem=0x121110 | out: hHeap=0x110000) returned 1 Thread: id = 48 os_tid = 0x13b8 Thread: id = 49 os_tid = 0x13b4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x9fad000" os_pid = "0xd64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11a8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0xd48 [0053.587] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7c8810000 [0053.587] __set_app_type (_Type=0x1) [0053.587] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7c8826d00) returned 0x0 [0053.587] __getmainargs (in: _Argc=0x7ff7c8849200, _Argv=0x7ff7c8849208, _Env=0x7ff7c8849210, _DoWildCard=0, _StartInfo=0x7ff7c884921c | out: _Argc=0x7ff7c8849200, _Argv=0x7ff7c8849208, _Env=0x7ff7c8849210) returned 0 [0053.588] _onexit (_Func=0x7ff7c8827fd0) returned 0x7ff7c8827fd0 [0053.588] _onexit (_Func=0x7ff7c8827fe0) returned 0x7ff7c8827fe0 [0053.588] _onexit (_Func=0x7ff7c8827ff0) returned 0x7ff7c8827ff0 [0053.588] _onexit (_Func=0x7ff7c8828000) returned 0x7ff7c8828000 [0053.588] _onexit (_Func=0x7ff7c8828010) returned 0x7ff7c8828010 [0053.588] _onexit (_Func=0x7ff7c8828020) returned 0x7ff7c8828020 [0053.589] GetCurrentThreadId () returned 0xd48 [0053.589] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd48) returned 0x70 [0053.589] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0053.589] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetThreadUILanguage") returned 0x7ffce913a990 [0053.589] SetThreadUILanguage (LangId=0x0) returned 0x409 [0054.046] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0054.046] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe35c70fa88 | out: phkResult=0xe35c70fa88*=0x0) returned 0x2 [0054.046] VirtualQuery (in: lpAddress=0xe35c70fa74, lpBuffer=0xe35c70f9f0, dwLength=0x30 | out: lpBuffer=0xe35c70f9f0*(BaseAddress=0xe35c70f000, AllocationBase=0xe35c610000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.046] VirtualQuery (in: lpAddress=0xe35c610000, lpBuffer=0xe35c70f9f0, dwLength=0x30 | out: lpBuffer=0xe35c70f9f0*(BaseAddress=0xe35c610000, AllocationBase=0xe35c610000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.046] VirtualQuery (in: lpAddress=0xe35c611000, lpBuffer=0xe35c70f9f0, dwLength=0x30 | out: lpBuffer=0xe35c70f9f0*(BaseAddress=0xe35c611000, AllocationBase=0xe35c610000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.046] VirtualQuery (in: lpAddress=0xe35c614000, lpBuffer=0xe35c70f9f0, dwLength=0x30 | out: lpBuffer=0xe35c70f9f0*(BaseAddress=0xe35c614000, AllocationBase=0xe35c610000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.046] VirtualQuery (in: lpAddress=0xe35c710000, lpBuffer=0xe35c70f9f0, dwLength=0x30 | out: lpBuffer=0xe35c70f9f0*(BaseAddress=0xe35c710000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffff9302, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0054.046] GetConsoleOutputCP () returned 0x1b5 [0054.483] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0054.484] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7c8838150, Add=1) returned 1 [0054.484] _get_osfhandle (_FileHandle=1) returned 0x26c [0054.484] GetConsoleMode (in: hConsoleHandle=0x26c, lpMode=0x7ff7c884fc04 | out: lpMode=0x7ff7c884fc04) returned 0 [0054.484] _get_osfhandle (_FileHandle=0) returned 0x248 [0054.484] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c884fc00 | out: lpMode=0x7ff7c884fc00) returned 0 [0054.484] _get_osfhandle (_FileHandle=1) returned 0x26c [0054.484] SetConsoleMode (hConsoleHandle=0x26c, dwMode=0x0) returned 0 [0054.484] _get_osfhandle (_FileHandle=1) returned 0x26c [0054.484] GetConsoleMode (in: hConsoleHandle=0x26c, lpMode=0x7ff7c884fc08 | out: lpMode=0x7ff7c884fc08) returned 0 [0054.484] _get_osfhandle (_FileHandle=0) returned 0x248 [0054.484] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c884fc0c | out: lpMode=0x7ff7c884fc0c) returned 0 [0054.484] GetEnvironmentStringsW () returned 0x2bd906a5a10* [0054.485] GetProcessHeap () returned 0x2bd906a0000 [0054.485] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xa7c) returned 0x2bd906a64a0 [0054.485] FreeEnvironmentStringsA (penv="A") returned 1 [0054.485] GetProcessHeap () returned 0x2bd906a0000 [0054.485] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x8) returned 0x2bd906a6f30 [0054.485] GetEnvironmentStringsW () returned 0x2bd906a5a10* [0054.485] GetProcessHeap () returned 0x2bd906a0000 [0054.485] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xa7c) returned 0x2bd906a6f50 [0054.485] FreeEnvironmentStringsA (penv="A") returned 1 [0054.485] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe35c70e938 | out: phkResult=0xe35c70e938*=0x7c) returned 0x0 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x0, lpData=0xe35c70e950*=0x4, lpcbData=0xe35c70e934*=0x1000) returned 0x2 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x1, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x0, lpData=0xe35c70e950*=0x1, lpcbData=0xe35c70e934*=0x1000) returned 0x2 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x0, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x40, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x40, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x0, lpData=0xe35c70e950*=0x40, lpcbData=0xe35c70e934*=0x1000) returned 0x2 [0054.485] RegCloseKey (hKey=0x7c) returned 0x0 [0054.485] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe35c70e938 | out: phkResult=0xe35c70e938*=0x7c) returned 0x0 [0054.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x0, lpData=0xe35c70e950*=0x40, lpcbData=0xe35c70e934*=0x1000) returned 0x2 [0054.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x1, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x0, lpData=0xe35c70e950*=0x1, lpcbData=0xe35c70e934*=0x1000) returned 0x2 [0054.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x0, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x9, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x4, lpData=0xe35c70e950*=0x9, lpcbData=0xe35c70e934*=0x4) returned 0x0 [0054.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe35c70e930, lpData=0xe35c70e950, lpcbData=0xe35c70e934*=0x1000 | out: lpType=0xe35c70e930*=0x0, lpData=0xe35c70e950*=0x9, lpcbData=0xe35c70e934*=0x1000) returned 0x2 [0054.486] RegCloseKey (hKey=0x7c) returned 0x0 [0054.486] time (in: timer=0x0 | out: timer=0x0) returned 0x5f09c133 [0054.486] srand (_Seed=0x5f09c133) [0054.486] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0054.486] malloc (_Size=0x4000) returned 0x2bd906754f0 [0054.486] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0054.486] malloc (_Size=0xffce) returned 0x2bd907a0080 [0054.487] ??_V@YAXPEAX@Z () returned 0x2bd907a0080 [0054.487] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2bd907a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0054.487] malloc (_Size=0xffce) returned 0x2bd907b0060 [0054.488] ??_V@YAXPEAX@Z () returned 0x2bd907b0060 [0054.488] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2bd907b0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0054.488] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0054.488] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0054.488] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.488] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0054.488] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0054.488] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0054.488] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0054.489] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0054.489] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0054.489] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0054.489] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0054.489] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0054.489] GetProcessHeap () returned 0x2bd906a0000 [0054.489] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a64a0) returned 1 [0054.489] GetEnvironmentStringsW () returned 0x2bd906a5a10* [0054.489] GetProcessHeap () returned 0x2bd906a0000 [0054.489] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xa94) returned 0x2bd906a7a10 [0054.489] FreeEnvironmentStringsA (penv="A") returned 1 [0054.489] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0054.489] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.489] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0054.489] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0054.489] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0054.489] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0054.489] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0054.489] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0054.489] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0054.489] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0054.489] malloc (_Size=0xffce) returned 0x2bd907c0040 [0054.490] ??_V@YAXPEAX@Z () returned 0x2bd907c0040 [0054.490] GetProcessHeap () returned 0x2bd906a0000 [0054.490] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x40) returned 0x2bd906a84b0 [0054.490] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2bd907c0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0054.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2bd907c0040, lpFilePart=0xe35c70f4b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe35c70f4b0*="Desktop") returned 0x17 [0054.491] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0054.491] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe35c70f1e0 | out: lpFindFileData=0xe35c70f1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2bd906a8500 [0054.491] FindClose (in: hFindFile=0x2bd906a8500 | out: hFindFile=0x2bd906a8500) returned 1 [0054.491] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xe35c70f1e0 | out: lpFindFileData=0xe35c70f1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2bd906a8500 [0054.491] FindClose (in: hFindFile=0x2bd906a8500 | out: hFindFile=0x2bd906a8500) returned 1 [0054.491] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xe35c70f1e0 | out: lpFindFileData=0xe35c70f1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb36b4c5b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb36b4c5b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2bd906a8500 [0054.491] FindClose (in: hFindFile=0x2bd906a8500 | out: hFindFile=0x2bd906a8500) returned 1 [0054.492] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0054.492] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0054.492] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0054.492] GetProcessHeap () returned 0x2bd906a0000 [0054.492] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a7a10) returned 1 [0054.492] GetEnvironmentStringsW () returned 0x2bd906a0fc0* [0054.492] GetProcessHeap () returned 0x2bd906a0000 [0054.492] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xacc) returned 0x2bd906a8500 [0054.492] FreeEnvironmentStringsA (penv="=") returned 1 [0054.492] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2bd907a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0054.492] GetProcessHeap () returned 0x2bd906a0000 [0054.492] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a84b0) returned 1 [0054.492] ??_V@YAXPEAX@Z () returned 0x1 [0054.492] ??_V@YAXPEAX@Z () returned 0x1 [0054.492] GetProcessHeap () returned 0x2bd906a0000 [0054.492] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x4016) returned 0x2bd906a8fe0 [0054.493] GetProcessHeap () returned 0x2bd906a0000 [0054.493] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a8fe0) returned 1 [0054.493] GetConsoleOutputCP () returned 0x1b5 [0055.139] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0055.139] GetUserDefaultLCID () returned 0x409 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7c884bb78, cchData=8 | out: lpLCData=":") returned 2 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe35c70f870, cchData=128 | out: lpLCData="0") returned 2 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe35c70f870, cchData=128 | out: lpLCData="0") returned 2 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe35c70f870, cchData=128 | out: lpLCData="1") returned 2 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7c884bb68, cchData=8 | out: lpLCData="/") returned 2 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7c884bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7c884bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7c884ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7c884ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7c884ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7c884b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7c884b980, cchData=32 | out: lpLCData="Sun") returned 4 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7c884bb58, cchData=8 | out: lpLCData=".") returned 2 [0055.140] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7c884bb40, cchData=8 | out: lpLCData=",") returned 2 [0055.140] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0055.142] GetProcessHeap () returned 0x2bd906a0000 [0055.142] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x0, Size=0x20c) returned 0x2bd906a6560 [0055.142] GetConsoleTitleW (in: lpConsoleTitle=0x2bd906a6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0055.710] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.710] GetFileType (hFile=0x26c) returned 0x3 [0055.710] ApiSetQueryApiSetPresence () returned 0x0 [0055.710] ResolveDelayLoadedAPI () returned 0x7ffcdeb7d990 [0055.713] BrandingFormatString () returned 0x2bd906a6a50 [0055.719] GetVersion () returned 0x3ad7000a [0055.719] _vsnwprintf (in: _Buffer=0xe35c70f9d0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xe35c70f968 | out: _Buffer="10.0.15063") returned 10 [0055.719] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.719] GetFileType (hFile=0x26c) returned 0x3 [0055.719] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7c8857f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0055.720] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7c8857f60, nSize=0x2000, Arguments=0xe35c70f970 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0055.720] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xe35c70f8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f8c8*=0x26, lpOverlapped=0x0) returned 1 [0055.720] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe35c70f998 | out: _Buffer="\r\n") returned 2 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] GetFileType (hFile=0x26c) returned 0x3 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.720] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe35c70f968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f968*=0x2, lpOverlapped=0x0) returned 1 [0055.720] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xe35c70f998 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] GetFileType (hFile=0x26c) returned 0x3 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0055.720] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe35c70f968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f968*=0x34, lpOverlapped=0x0) returned 1 [0055.720] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe35c70f998 | out: _Buffer="\r\n") returned 2 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] GetFileType (hFile=0x26c) returned 0x3 [0055.720] _get_osfhandle (_FileHandle=1) returned 0x26c [0055.720] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.720] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe35c70f968, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f968*=0x2, lpOverlapped=0x0) returned 1 [0055.721] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0055.721] GetProcAddress (hModule=0x7ffce9120000, lpProcName="CopyFileExW") returned 0x7ffce913e830 [0055.721] GetProcAddress (hModule=0x7ffce9120000, lpProcName="IsDebuggerPresent") returned 0x7ffce913e300 [0055.721] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffce6900a40 [0055.721] ??_V@YAXPEAX@Z () returned 0x1 [0055.721] _get_osfhandle (_FileHandle=0) returned 0x248 [0055.721] GetFileType (hFile=0x248) returned 0x3 [0055.721] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0055.722] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xe35c70f7d8 | out: TokenHandle=0xe35c70f7d8*=0x0) returned 0xc000007c [0055.722] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xe35c70f7d8 | out: TokenHandle=0xe35c70f7d8*=0x98) returned 0x0 [0055.722] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0xe35c70f788, TokenInformationLength=0x4, ReturnLength=0xe35c70f790 | out: TokenInformation=0xe35c70f788, ReturnLength=0xe35c70f790) returned 0x0 [0055.722] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0xe35c70f790, TokenInformationLength=0x4, ReturnLength=0xe35c70f788 | out: TokenInformation=0xe35c70f790, ReturnLength=0xe35c70f788) returned 0x0 [0055.722] NtClose (Handle=0x98) returned 0x0 [0055.722] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xe35c70f7a0, nSize=0x0, Arguments=0xe35c70f7a8 | out: lpBuffer="᧰遪ʽ") returned 0xf [0055.723] GetProcessHeap () returned 0x2bd906a0000 [0055.723] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x218) returned 0x2bd906a6c30 [0055.724] GetConsoleTitleW (in: lpConsoleTitle=0xe35c70f7f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0056.250] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0056.258] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0056.977] GetProcessHeap () returned 0x2bd906a0000 [0056.977] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a6c30) returned 1 [0056.977] LocalFree (hMem=0x2bd906a19f0) returned 0x0 [0056.978] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe35c70f618 | out: _Buffer="\r\n") returned 2 [0056.978] _get_osfhandle (_FileHandle=1) returned 0x26c [0056.978] GetFileType (hFile=0x26c) returned 0x3 [0056.978] _get_osfhandle (_FileHandle=1) returned 0x26c [0056.978] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0056.979] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe35c70f5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f5e8*=0x2, lpOverlapped=0x0) returned 1 [0056.979] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0056.979] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2bd907a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.979] malloc (_Size=0x107ce) returned 0x2bd907b0060 [0056.979] _vsnwprintf (in: _Buffer=0x2bd907b0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe35c70f628 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0056.979] _vsnwprintf (in: _Buffer=0x2bd907b008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe35c70f628 | out: _Buffer=">") returned 1 [0056.980] _get_osfhandle (_FileHandle=1) returned 0x26c [0056.980] GetFileType (hFile=0x26c) returned 0x3 [0056.980] _get_osfhandle (_FileHandle=1) returned 0x26c [0056.980] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0056.980] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe35c70f618, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f618*=0x18, lpOverlapped=0x0) returned 1 [0056.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.980] GetFileType (hFile=0x248) returned 0x3 [0056.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0056.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0056.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0056.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0056.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0056.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0056.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0056.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0056.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0056.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0056.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0056.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0056.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0056.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0056.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0056.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0056.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0056.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe35c70f978, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0xe35c70f978*=0x1, lpOverlapped=0x0) returned 1 [0056.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0056.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.986] GetFileType (hFile=0x248) returned 0x3 [0056.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0056.986] _get_osfhandle (_FileHandle=1) returned 0x26c [0056.986] GetFileType (hFile=0x26c) returned 0x3 [0056.986] _get_osfhandle (_FileHandle=1) returned 0x26c [0056.986] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0056.986] WriteFile (in: hFile=0x26c, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xe35c70f918, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0xe35c70f918*=0x24, lpOverlapped=0x0) returned 1 [0056.986] GetProcessHeap () returned 0x2bd906a0000 [0056.986] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x4012) returned 0x2bd906a8fe0 [0056.986] GetProcessHeap () returned 0x2bd906a0000 [0056.986] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a8fe0) returned 1 [0056.987] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0056.987] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0056.987] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0056.987] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0056.987] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0056.987] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0056.987] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0056.987] GetProcessHeap () returned 0x2bd906a0000 [0056.987] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xb0) returned 0x2bd906a67b0 [0056.987] GetProcessHeap () returned 0x2bd906a0000 [0056.987] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x22) returned 0x2bd906a6a50 [0056.988] GetProcessHeap () returned 0x2bd906a0000 [0056.988] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x48) returned 0x2bd906a6a80 [0056.988] GetConsoleOutputCP () returned 0x1b5 [0057.557] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0057.557] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.790] GetConsoleTitleW (in: lpConsoleTitle=0xe35c70f760, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0058.193] malloc (_Size=0xffce) returned 0x2bd907c0840 [0058.194] ??_V@YAXPEAX@Z () returned 0x2bd907c0840 [0058.194] malloc (_Size=0xffce) returned 0x2bd907d0820 [0058.194] ??_V@YAXPEAX@Z () returned 0x2bd907d0820 [0058.195] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0058.195] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0058.195] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0058.195] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0058.195] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0058.195] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0058.195] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0058.195] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0058.196] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0058.196] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0058.196] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0058.196] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0058.196] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0058.196] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0058.196] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0058.196] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0058.196] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0058.196] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0058.196] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0058.196] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0058.196] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0058.196] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0058.196] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0058.196] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0058.196] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0058.196] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0058.196] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0058.196] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0058.196] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0058.196] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0058.196] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0058.196] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0058.196] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0058.196] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0058.196] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0058.196] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0058.196] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0058.196] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0058.196] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0058.196] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0058.196] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0058.196] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0058.196] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0058.196] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0058.196] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0058.196] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0058.196] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0058.197] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0058.197] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0058.197] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0058.197] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0058.197] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0058.197] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0058.197] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0058.197] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0058.197] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0058.197] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0058.197] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0058.197] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0058.197] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0058.197] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0058.197] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0058.197] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0058.197] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0058.197] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0058.197] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0058.197] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0058.197] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0058.197] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0058.197] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0058.197] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0058.197] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0058.197] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0058.197] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0058.197] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0058.197] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0058.197] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0058.197] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0058.197] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0058.197] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0058.197] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0058.197] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0058.197] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0058.197] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0058.197] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0058.197] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0058.197] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0058.198] ??_V@YAXPEAX@Z () returned 0x1 [0058.198] GetProcessHeap () returned 0x2bd906a0000 [0058.198] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xffde) returned 0x2bd906a8fe0 [0058.199] GetProcessHeap () returned 0x2bd906a0000 [0058.199] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x5a) returned 0x2bd906a19f0 [0058.199] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0058.199] malloc (_Size=0xffce) returned 0x2bd907d0820 [0058.199] ??_V@YAXPEAX@Z () returned 0x2bd907d0820 [0058.199] GetProcessHeap () returned 0x2bd906a0000 [0058.199] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x1ffac) returned 0x2bd906b8fd0 [0058.202] SetErrorMode (uMode=0x0) returned 0x0 [0058.202] SetErrorMode (uMode=0x1) returned 0x0 [0058.202] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2bd906b8fe0, lpFilePart=0xe35c70efe0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe35c70efe0*="Desktop") returned 0x17 [0058.202] SetErrorMode (uMode=0x0) returned 0x1 [0058.202] GetProcessHeap () returned 0x2bd906a0000 [0058.202] RtlReAllocateHeap (Heap=0x2bd906a0000, Flags=0x0, Ptr=0x2bd906b8fd0, Size=0x52) returned 0x2bd906b8fd0 [0058.202] GetProcessHeap () returned 0x2bd906a0000 [0058.202] RtlSizeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, MemoryPointer=0x2bd906b8fd0) returned 0x52 [0058.202] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0058.202] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.202] GetProcessHeap () returned 0x2bd906a0000 [0058.202] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x1bc) returned 0x2bd906a8320 [0058.202] GetProcessHeap () returned 0x2bd906a0000 [0058.202] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x368) returned 0x2bd906b9040 [0058.210] GetProcessHeap () returned 0x2bd906a0000 [0058.210] RtlReAllocateHeap (Heap=0x2bd906a0000, Flags=0x0, Ptr=0x2bd906b9040, Size=0x1be) returned 0x2bd906b9040 [0058.210] GetProcessHeap () returned 0x2bd906a0000 [0058.210] RtlSizeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, MemoryPointer=0x2bd906b9040) returned 0x1be [0058.211] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.211] GetProcessHeap () returned 0x2bd906a0000 [0058.211] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xe8) returned 0x2bd906a6c30 [0058.212] GetProcessHeap () returned 0x2bd906a0000 [0058.212] RtlReAllocateHeap (Heap=0x2bd906a0000, Flags=0x0, Ptr=0x2bd906a6c30, Size=0x7e) returned 0x2bd906a6c30 [0058.212] GetProcessHeap () returned 0x2bd906a0000 [0058.212] RtlSizeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, MemoryPointer=0x2bd906a6c30) returned 0x7e [0058.212] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.212] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe35c70ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe35c70ed50) returned 0xffffffffffffffff [0058.214] GetLastError () returned 0x2 [0058.214] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.214] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe35c70ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe35c70ed50) returned 0xffffffffffffffff [0058.217] GetLastError () returned 0x2 [0058.217] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.217] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe35c70ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe35c70ed50) returned 0x2bd906a6cc0 [0058.217] GetProcessHeap () returned 0x2bd906a0000 [0058.217] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x0, Size=0x28) returned 0x2bd906a1a60 [0058.217] FindClose (in: hFindFile=0x2bd906a6cc0 | out: hFindFile=0x2bd906a6cc0) returned 1 [0058.217] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xe35c70ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe35c70ed50) returned 0xffffffffffffffff [0058.218] GetLastError () returned 0x2 [0058.218] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xe35c70ed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe35c70ed50) returned 0x2bd906a6cc0 [0058.218] GetProcessHeap () returned 0x2bd906a0000 [0058.218] RtlReAllocateHeap (Heap=0x2bd906a0000, Flags=0x0, Ptr=0x2bd906a1a60, Size=0x8) returned 0x2bd906a1a60 [0058.218] FindClose (in: hFindFile=0x2bd906a6cc0 | out: hFindFile=0x2bd906a6cc0) returned 1 [0058.218] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0058.218] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0058.218] ??_V@YAXPEAX@Z () returned 0x1 [0058.218] GetConsoleTitleW (in: lpConsoleTitle=0xe35c70f2d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0058.686] GetProcessHeap () returned 0x2bd906a0000 [0058.686] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x21c) returned 0x2bd906a6cc0 [0058.686] GetConsoleTitleW (in: lpConsoleTitle=0x2bd906a6cd0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0059.088] GetProcessHeap () returned 0x2bd906a0000 [0059.088] RtlReAllocateHeap (Heap=0x2bd906a0000, Flags=0x0, Ptr=0x2bd906a6cc0, Size=0xc2) returned 0x2bd906a6cc0 [0059.088] GetProcessHeap () returned 0x2bd906a0000 [0059.088] RtlSizeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, MemoryPointer=0x2bd906a6cc0) returned 0xc2 [0059.088] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0059.496] GetProcessHeap () returned 0x2bd906a0000 [0059.496] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a6cc0) returned 1 [0059.497] InitializeProcThreadAttributeList (in: lpAttributeList=0xe35c70f1f0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe35c70f0e0 | out: lpAttributeList=0xe35c70f1f0, lpSize=0xe35c70f0e0) returned 1 [0059.497] UpdateProcThreadAttribute (in: lpAttributeList=0xe35c70f1f0, dwFlags=0x0, Attribute=0x60001, lpValue=0xe35c70f0cc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe35c70f1f0, lpPreviousValue=0x0) returned 1 [0059.498] GetStartupInfoW (in: lpStartupInfo=0xe35c70f180 | out: lpStartupInfo=0xe35c70f180*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x26c, hStdError=0x26c)) [0059.500] GetProcessHeap () returned 0x2bd906a0000 [0059.500] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x20) returned 0x2bd906a6cc0 [0059.501] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0059.501] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0059.503] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.508] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.510] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.510] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0059.510] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0059.510] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0059.511] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0059.511] GetProcessHeap () returned 0x2bd906a0000 [0059.511] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a6cc0) returned 1 [0059.512] GetProcessHeap () returned 0x2bd906a0000 [0059.512] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0x12) returned 0x2bd906a1a80 [0059.512] _get_osfhandle (_FileHandle=1) returned 0x26c [0059.512] SetConsoleMode (hConsoleHandle=0x26c, dwMode=0x0) returned 0 [0059.513] _get_osfhandle (_FileHandle=0) returned 0x248 [0059.517] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0059.517] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe35c70f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe35c70f0e8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xe35c70f0e8*(hProcess=0x9c, hThread=0x98, dwProcessId=0xf24, dwThreadId=0xef0)) returned 1 [0060.291] CloseHandle (hObject=0x98) returned 1 [0060.291] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.291] GetProcessHeap () returned 0x2bd906a0000 [0060.291] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a8500) returned 1 [0060.291] GetEnvironmentStringsW () returned 0x2bd906a8500* [0060.292] GetProcessHeap () returned 0x2bd906a0000 [0060.292] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xacc) returned 0x2bd906b93b0 [0060.292] FreeEnvironmentStringsA (penv="=") returned 1 [0060.292] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcea380000 [0060.292] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQueryInformationProcess") returned 0x7ffcea4256b0 [0060.292] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0xe35c70e5e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xe35c70e5e8, ReturnLength=0x0) returned 0x0 [0060.292] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x2e16e38000, lpBuffer=0xe35c70e620, nSize=0x7a0, lpNumberOfBytesRead=0xe35c70e5e0 | out: lpBuffer=0xe35c70e620*, lpNumberOfBytesRead=0xe35c70e5e0*=0x7a0) returned 1 [0060.296] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0076.076] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xe35c70f068 | out: lpExitCode=0xe35c70f068*=0x2) returned 1 [0076.076] CloseHandle (hObject=0x9c) returned 1 [0076.076] _vsnwprintf (in: _Buffer=0xe35c70f238, _BufferCount=0x13, _Format="%08X", _ArgList=0xe35c70f078 | out: _Buffer="00000002") returned 8 [0076.076] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0076.077] GetProcessHeap () returned 0x2bd906a0000 [0076.077] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906b93b0) returned 1 [0076.077] GetEnvironmentStringsW () returned 0x2bd906ba990* [0076.077] GetProcessHeap () returned 0x2bd906a0000 [0076.077] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xaf2) returned 0x2bd906bb490 [0076.077] FreeEnvironmentStringsA (penv="=") returned 1 [0076.077] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.077] GetProcessHeap () returned 0x2bd906a0000 [0076.077] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906bb490) returned 1 [0076.077] GetEnvironmentStringsW () returned 0x2bd906ba990* [0076.078] GetProcessHeap () returned 0x2bd906a0000 [0076.078] RtlAllocateHeap (HeapHandle=0x2bd906a0000, Flags=0x8, Size=0xaf2) returned 0x2bd906bb490 [0076.078] FreeEnvironmentStringsA (penv="=") returned 1 [0076.078] GetProcessHeap () returned 0x2bd906a0000 [0076.078] RtlFreeHeap (HeapHandle=0x2bd906a0000, Flags=0x0, BaseAddress=0x2bd906a1a80) returned 1 [0076.078] DeleteProcThreadAttributeList (in: lpAttributeList=0xe35c70f1f0 | out: lpAttributeList=0xe35c70f1f0) [0076.078] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0076.757] ??_V@YAXPEAX@Z () returned 0x1 [0076.757] _get_osfhandle (_FileHandle=1) returned 0x26c [0076.757] SetConsoleMode (hConsoleHandle=0x26c, dwMode=0x0) returned 0 [0076.757] _get_osfhandle (_FileHandle=1) returned 0x26c [0076.757] GetConsoleMode (in: hConsoleHandle=0x26c, lpMode=0x7ff7c884fc08 | out: lpMode=0x7ff7c884fc08) returned 0 [0076.757] _get_osfhandle (_FileHandle=0) returned 0x248 [0076.757] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7c884fc0c | out: lpMode=0x7ff7c884fc0c) returned 0 [0076.758] GetConsoleOutputCP () returned 0x1b5 [0077.399] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0077.399] SetThreadUILanguage (LangId=0x0) Thread: id = 37 os_tid = 0xf4c Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x14f33000" os_pid = "0xd40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11a8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0xd74 [0053.402] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7c8810000 [0053.402] __set_app_type (_Type=0x1) [0053.402] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7c8826d00) returned 0x0 [0053.403] __getmainargs (in: _Argc=0x7ff7c8849200, _Argv=0x7ff7c8849208, _Env=0x7ff7c8849210, _DoWildCard=0, _StartInfo=0x7ff7c884921c | out: _Argc=0x7ff7c8849200, _Argv=0x7ff7c8849208, _Env=0x7ff7c8849210) returned 0 [0053.403] _onexit (_Func=0x7ff7c8827fd0) returned 0x7ff7c8827fd0 [0053.403] _onexit (_Func=0x7ff7c8827fe0) returned 0x7ff7c8827fe0 [0053.403] _onexit (_Func=0x7ff7c8827ff0) returned 0x7ff7c8827ff0 [0053.403] _onexit (_Func=0x7ff7c8828000) returned 0x7ff7c8828000 [0053.404] _onexit (_Func=0x7ff7c8828010) returned 0x7ff7c8828010 [0053.404] _onexit (_Func=0x7ff7c8828020) returned 0x7ff7c8828020 [0053.404] GetCurrentThreadId () returned 0xd74 [0053.404] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd74) returned 0x70 [0053.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0053.405] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetThreadUILanguage") returned 0x7ffce913a990 [0053.405] SetThreadUILanguage (LangId=0x0) returned 0x409 [0053.914] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0053.914] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x54a22ff7e8 | out: phkResult=0x54a22ff7e8*=0x0) returned 0x2 [0053.914] VirtualQuery (in: lpAddress=0x54a22ff7d4, lpBuffer=0x54a22ff750, dwLength=0x30 | out: lpBuffer=0x54a22ff750*(BaseAddress=0x54a22ff000, AllocationBase=0x54a2200000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.914] VirtualQuery (in: lpAddress=0x54a2200000, lpBuffer=0x54a22ff750, dwLength=0x30 | out: lpBuffer=0x54a22ff750*(BaseAddress=0x54a2200000, AllocationBase=0x54a2200000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.914] VirtualQuery (in: lpAddress=0x54a2201000, lpBuffer=0x54a22ff750, dwLength=0x30 | out: lpBuffer=0x54a22ff750*(BaseAddress=0x54a2201000, AllocationBase=0x54a2200000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.914] VirtualQuery (in: lpAddress=0x54a2204000, lpBuffer=0x54a22ff750, dwLength=0x30 | out: lpBuffer=0x54a22ff750*(BaseAddress=0x54a2204000, AllocationBase=0x54a2200000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.914] VirtualQuery (in: lpAddress=0x54a2300000, lpBuffer=0x54a22ff750, dwLength=0x30 | out: lpBuffer=0x54a22ff750*(BaseAddress=0x54a2300000, AllocationBase=0x54a2300000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.914] GetConsoleOutputCP () returned 0x1b5 [0054.306] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0054.315] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7c8838150, Add=1) returned 1 [0054.316] _get_osfhandle (_FileHandle=1) returned 0x294 [0054.316] GetConsoleMode (in: hConsoleHandle=0x294, lpMode=0x7ff7c884fc04 | out: lpMode=0x7ff7c884fc04) returned 0 [0054.316] _get_osfhandle (_FileHandle=0) returned 0x288 [0054.316] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7c884fc00 | out: lpMode=0x7ff7c884fc00) returned 0 [0054.316] _get_osfhandle (_FileHandle=1) returned 0x294 [0054.316] SetConsoleMode (hConsoleHandle=0x294, dwMode=0x0) returned 0 [0054.318] _get_osfhandle (_FileHandle=1) returned 0x294 [0054.319] GetConsoleMode (in: hConsoleHandle=0x294, lpMode=0x7ff7c884fc08 | out: lpMode=0x7ff7c884fc08) returned 0 [0054.320] _get_osfhandle (_FileHandle=0) returned 0x288 [0054.321] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff7c884fc0c | out: lpMode=0x7ff7c884fc0c) returned 0 [0054.323] GetEnvironmentStringsW () returned 0x1d8cfc25a10* [0054.329] GetProcessHeap () returned 0x1d8cfc20000 [0054.331] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xa7c) returned 0x1d8cfc264a0 [0054.331] FreeEnvironmentStringsA (penv="A") returned 1 [0054.331] GetProcessHeap () returned 0x1d8cfc20000 [0054.331] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x8) returned 0x1d8cfc26f30 [0054.331] GetEnvironmentStringsW () returned 0x1d8cfc25a10* [0054.333] GetProcessHeap () returned 0x1d8cfc20000 [0054.334] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xa7c) returned 0x1d8cfc26f50 [0054.335] FreeEnvironmentStringsA (penv="A") returned 1 [0054.335] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x54a22fe698 | out: phkResult=0x54a22fe698*=0x7c) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x0, lpData=0x54a22fe6b0*=0x4, lpcbData=0x54a22fe694*=0x1000) returned 0x2 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x1, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x0, lpData=0x54a22fe6b0*=0x1, lpcbData=0x54a22fe694*=0x1000) returned 0x2 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x0, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x40, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x40, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x0, lpData=0x54a22fe6b0*=0x40, lpcbData=0x54a22fe694*=0x1000) returned 0x2 [0054.336] RegCloseKey (hKey=0x7c) returned 0x0 [0054.336] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x54a22fe698 | out: phkResult=0x54a22fe698*=0x7c) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x0, lpData=0x54a22fe6b0*=0x40, lpcbData=0x54a22fe694*=0x1000) returned 0x2 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x1, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x0, lpData=0x54a22fe6b0*=0x1, lpcbData=0x54a22fe694*=0x1000) returned 0x2 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x0, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x9, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x4, lpData=0x54a22fe6b0*=0x9, lpcbData=0x54a22fe694*=0x4) returned 0x0 [0054.336] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x54a22fe690, lpData=0x54a22fe6b0, lpcbData=0x54a22fe694*=0x1000 | out: lpType=0x54a22fe690*=0x0, lpData=0x54a22fe6b0*=0x9, lpcbData=0x54a22fe694*=0x1000) returned 0x2 [0054.336] RegCloseKey (hKey=0x7c) returned 0x0 [0054.336] time (in: timer=0x0 | out: timer=0x0) returned 0x5f09c133 [0054.336] srand (_Seed=0x5f09c133) [0054.336] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0054.337] malloc (_Size=0x4000) returned 0x1d8cfed54f0 [0054.337] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0054.337] malloc (_Size=0xffce) returned 0x1d8cfd20080 [0054.337] ??_V@YAXPEAX@Z () returned 0x1d8cfd20080 [0054.338] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d8cfd20080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0054.338] malloc (_Size=0xffce) returned 0x1d8cfd30060 [0054.338] ??_V@YAXPEAX@Z () returned 0x1d8cfd30060 [0054.339] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d8cfd30060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0054.339] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0054.339] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0054.339] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.339] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0054.339] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0054.339] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0054.339] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0054.339] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0054.339] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0054.339] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0054.339] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0054.339] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0054.340] GetProcessHeap () returned 0x1d8cfc20000 [0054.340] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc264a0) returned 1 [0054.340] GetEnvironmentStringsW () returned 0x1d8cfc25a10* [0054.340] GetProcessHeap () returned 0x1d8cfc20000 [0054.340] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xa94) returned 0x1d8cfc27a10 [0054.340] FreeEnvironmentStringsA (penv="A") returned 1 [0054.340] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0054.340] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.340] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0054.340] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0054.340] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0054.340] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0054.340] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0054.340] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0054.340] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0054.340] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0054.340] malloc (_Size=0xffce) returned 0x1d8cfd40040 [0054.340] ??_V@YAXPEAX@Z () returned 0x1d8cfd40040 [0054.341] GetProcessHeap () returned 0x1d8cfc20000 [0054.341] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x40) returned 0x1d8cfc284b0 [0054.341] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d8cfd40040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0054.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1d8cfd40040, lpFilePart=0x54a22ff210 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x54a22ff210*="Desktop") returned 0x17 [0054.341] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0054.342] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x54a22fef40 | out: lpFindFileData=0x54a22fef40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1d8cfc28500 [0054.342] FindClose (in: hFindFile=0x1d8cfc28500 | out: hFindFile=0x1d8cfc28500) returned 1 [0054.342] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x54a22fef40 | out: lpFindFileData=0x54a22fef40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1d8cfc28500 [0054.342] FindClose (in: hFindFile=0x1d8cfc28500 | out: hFindFile=0x1d8cfc28500) returned 1 [0054.342] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x54a22fef40 | out: lpFindFileData=0x54a22fef40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb36b4c5b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb36b4c5b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1d8cfc28500 [0054.342] FindClose (in: hFindFile=0x1d8cfc28500 | out: hFindFile=0x1d8cfc28500) returned 1 [0054.342] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0054.343] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0054.343] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0054.343] GetProcessHeap () returned 0x1d8cfc20000 [0054.343] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc27a10) returned 1 [0054.343] GetEnvironmentStringsW () returned 0x1d8cfc20fc0* [0054.343] GetProcessHeap () returned 0x1d8cfc20000 [0054.343] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xacc) returned 0x1d8cfc28500 [0054.343] FreeEnvironmentStringsA (penv="=") returned 1 [0054.343] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d8cfd20080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0054.343] GetProcessHeap () returned 0x1d8cfc20000 [0054.343] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc284b0) returned 1 [0054.343] ??_V@YAXPEAX@Z () returned 0x1 [0054.343] ??_V@YAXPEAX@Z () returned 0x1 [0054.343] GetProcessHeap () returned 0x1d8cfc20000 [0054.343] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x4016) returned 0x1d8cfc28fe0 [0054.344] GetProcessHeap () returned 0x1d8cfc20000 [0054.344] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc28fe0) returned 1 [0054.344] GetConsoleOutputCP () returned 0x1b5 [0054.862] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0054.862] GetUserDefaultLCID () returned 0x409 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7c884bb78, cchData=8 | out: lpLCData=":") returned 2 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x54a22ff5d0, cchData=128 | out: lpLCData="0") returned 2 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x54a22ff5d0, cchData=128 | out: lpLCData="0") returned 2 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x54a22ff5d0, cchData=128 | out: lpLCData="1") returned 2 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7c884bb68, cchData=8 | out: lpLCData="/") returned 2 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7c884bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7c884bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7c884ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7c884ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7c884ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7c884b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7c884b980, cchData=32 | out: lpLCData="Sun") returned 4 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7c884bb58, cchData=8 | out: lpLCData=".") returned 2 [0054.863] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7c884bb40, cchData=8 | out: lpLCData=",") returned 2 [0054.863] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0054.865] GetProcessHeap () returned 0x1d8cfc20000 [0054.865] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, Size=0x20c) returned 0x1d8cfc26560 [0054.865] GetConsoleTitleW (in: lpConsoleTitle=0x1d8cfc26560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0055.409] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.409] GetFileType (hFile=0x294) returned 0x3 [0055.418] ApiSetQueryApiSetPresence () returned 0x0 [0055.418] ResolveDelayLoadedAPI () returned 0x7ffcdeb7d990 [0055.765] BrandingFormatString () returned 0x1d8cfc26a50 [0055.769] GetVersion () returned 0x3ad7000a [0055.769] _vsnwprintf (in: _Buffer=0x54a22ff730, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x54a22ff6c8 | out: _Buffer="10.0.15063") returned 10 [0055.770] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.770] GetFileType (hFile=0x294) returned 0x3 [0055.770] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7c8857f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0055.770] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7c8857f60, nSize=0x2000, Arguments=0x54a22ff6d0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0055.770] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.770] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0055.770] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x54a22ff628, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff628*=0x26, lpOverlapped=0x0) returned 1 [0055.770] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x54a22ff6f8 | out: _Buffer="\r\n") returned 2 [0055.770] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.771] GetFileType (hFile=0x294) returned 0x3 [0055.771] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.771] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x54a22ff6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff6c8*=0x2, lpOverlapped=0x0) returned 1 [0055.771] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x54a22ff6f8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0055.771] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.771] GetFileType (hFile=0x294) returned 0x3 [0055.771] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0055.771] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x54a22ff6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff6c8*=0x34, lpOverlapped=0x0) returned 1 [0055.771] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x54a22ff6f8 | out: _Buffer="\r\n") returned 2 [0055.771] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.771] GetFileType (hFile=0x294) returned 0x3 [0055.771] _get_osfhandle (_FileHandle=1) returned 0x294 [0055.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.771] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x54a22ff6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff6c8*=0x2, lpOverlapped=0x0) returned 1 [0055.771] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0055.772] GetProcAddress (hModule=0x7ffce9120000, lpProcName="CopyFileExW") returned 0x7ffce913e830 [0055.772] GetProcAddress (hModule=0x7ffce9120000, lpProcName="IsDebuggerPresent") returned 0x7ffce913e300 [0055.772] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffce6900a40 [0055.772] ??_V@YAXPEAX@Z () returned 0x1 [0055.772] _get_osfhandle (_FileHandle=0) returned 0x288 [0055.772] GetFileType (hFile=0x288) returned 0x3 [0055.772] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0055.772] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x54a22ff538 | out: TokenHandle=0x54a22ff538*=0x0) returned 0xc000007c [0055.772] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x54a22ff538 | out: TokenHandle=0x54a22ff538*=0x98) returned 0x0 [0055.772] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x54a22ff4e8, TokenInformationLength=0x4, ReturnLength=0x54a22ff4f0 | out: TokenInformation=0x54a22ff4e8, ReturnLength=0x54a22ff4f0) returned 0x0 [0055.772] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x54a22ff4f0, TokenInformationLength=0x4, ReturnLength=0x54a22ff4e8 | out: TokenInformation=0x54a22ff4f0, ReturnLength=0x54a22ff4e8) returned 0x0 [0055.772] NtClose (Handle=0x98) returned 0x0 [0055.772] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x54a22ff500, nSize=0x0, Arguments=0x54a22ff508 | out: lpBuffer="᧰쿂ǘ") returned 0xf [0055.773] GetProcessHeap () returned 0x1d8cfc20000 [0055.773] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x218) returned 0x1d8cfc26c30 [0055.773] GetConsoleTitleW (in: lpConsoleTitle=0x54a22ff550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0056.371] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0056.371] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0057.091] GetProcessHeap () returned 0x1d8cfc20000 [0057.091] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc26c30) returned 1 [0057.091] LocalFree (hMem=0x1d8cfc219f0) returned 0x0 [0057.091] _vsnwprintf (in: _Buffer=0x7ff7c8857f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x54a22ff378 | out: _Buffer="\r\n") returned 2 [0057.092] _get_osfhandle (_FileHandle=1) returned 0x294 [0057.092] GetFileType (hFile=0x294) returned 0x3 [0057.092] _get_osfhandle (_FileHandle=1) returned 0x294 [0057.092] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0057.092] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x54a22ff348, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff348*=0x2, lpOverlapped=0x0) returned 1 [0057.092] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0057.092] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1d8cfd20080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0057.092] malloc (_Size=0x107ce) returned 0x1d8cfd30060 [0057.092] _vsnwprintf (in: _Buffer=0x1d8cfd30060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x54a22ff388 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0057.092] _vsnwprintf (in: _Buffer=0x1d8cfd3008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x54a22ff388 | out: _Buffer=">") returned 1 [0057.092] _get_osfhandle (_FileHandle=1) returned 0x294 [0057.092] GetFileType (hFile=0x294) returned 0x3 [0057.092] _get_osfhandle (_FileHandle=1) returned 0x294 [0057.092] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0057.092] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x54a22ff378, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff378*=0x18, lpOverlapped=0x0) returned 1 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] GetFileType (hFile=0x288) returned 0x3 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.093] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.093] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.093] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.093] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.093] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0057.093] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.093] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.093] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.094] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.094] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.094] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.094] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.094] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.094] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0057.094] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.094] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.095] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.095] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.095] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.095] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.095] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.095] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.095] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0057.095] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.096] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0057.096] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.096] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.097] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0057.097] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.097] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.098] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0057.098] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.099] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0057.099] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.099] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0057.099] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.099] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0057.099] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.099] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0057.099] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.099] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0057.155] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.155] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.155] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0057.155] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.155] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.156] ReadFile (in: hFile=0x288, lpBuffer=0x7ff7c8849970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x54a22ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesRead=0x54a22ff6d8*=0x1, lpOverlapped=0x0) returned 1 [0057.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=1, lpWideCharStr=0x7ff7c8853c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0057.157] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.157] GetFileType (hFile=0x288) returned 0x3 [0057.157] _get_osfhandle (_FileHandle=0) returned 0x288 [0057.157] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0057.157] _get_osfhandle (_FileHandle=1) returned 0x294 [0057.157] GetFileType (hFile=0x294) returned 0x3 [0057.157] _get_osfhandle (_FileHandle=1) returned 0x294 [0057.157] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff7c8849970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0057.157] WriteFile (in: hFile=0x294, lpBuffer=0x7ff7c8849970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x54a22ff678, lpOverlapped=0x0 | out: lpBuffer=0x7ff7c8849970*, lpNumberOfBytesWritten=0x54a22ff678*=0x2f, lpOverlapped=0x0) returned 1 [0057.157] GetProcessHeap () returned 0x1d8cfc20000 [0057.157] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x4012) returned 0x1d8cfc28fe0 [0057.157] GetProcessHeap () returned 0x1d8cfc20000 [0057.157] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc28fe0) returned 1 [0057.157] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0057.157] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0057.158] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0057.158] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0057.158] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0057.158] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0057.158] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0057.158] GetProcessHeap () returned 0x1d8cfc20000 [0057.158] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xb0) returned 0x1d8cfc267b0 [0057.158] GetProcessHeap () returned 0x1d8cfc20000 [0057.158] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x1c) returned 0x1d8cfc26a50 [0057.158] GetProcessHeap () returned 0x1d8cfc20000 [0057.158] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x64) returned 0x1d8cfc219f0 [0057.159] GetConsoleOutputCP () returned 0x1b5 [0057.601] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7c884fbb0 | out: lpCPInfo=0x7ff7c884fbb0) returned 1 [0057.601] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.882] GetConsoleTitleW (in: lpConsoleTitle=0x54a22ff4c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0058.479] malloc (_Size=0xffce) returned 0x1d8cfd40840 [0058.479] ??_V@YAXPEAX@Z () returned 0x1d8cfd40840 [0058.480] malloc (_Size=0xffce) returned 0x1d8cfd50820 [0058.480] ??_V@YAXPEAX@Z () returned 0x1d8cfd50820 [0058.481] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0058.481] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0058.481] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0058.481] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0058.481] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0058.481] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0058.481] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0058.481] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0058.481] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0058.481] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0058.481] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0058.481] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0058.481] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0058.481] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0058.481] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0058.481] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0058.481] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0058.481] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0058.481] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0058.481] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0058.481] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0058.481] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0058.481] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0058.481] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0058.481] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0058.481] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0058.481] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0058.481] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0058.481] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0058.481] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0058.482] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0058.482] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0058.482] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0058.482] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0058.482] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0058.482] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0058.482] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0058.482] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0058.482] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0058.482] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0058.482] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0058.482] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0058.482] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0058.482] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0058.482] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0058.482] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0058.482] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0058.482] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0058.482] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0058.482] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0058.482] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0058.482] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0058.482] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0058.482] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0058.482] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0058.482] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0058.482] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0058.482] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0058.482] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0058.482] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0058.482] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0058.482] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0058.482] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0058.482] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0058.482] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0058.482] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0058.482] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0058.482] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0058.483] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0058.483] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0058.483] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0058.483] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0058.483] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0058.483] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0058.483] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0058.483] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0058.483] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0058.483] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0058.483] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0058.483] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0058.483] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0058.483] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0058.483] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0058.483] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0058.483] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0058.483] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0058.483] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0058.483] ??_V@YAXPEAX@Z () returned 0x1 [0058.483] GetProcessHeap () returned 0x1d8cfc20000 [0058.483] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xffde) returned 0x1d8cfc28fe0 [0058.484] GetProcessHeap () returned 0x1d8cfc20000 [0058.484] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x70) returned 0x1d8cfc28320 [0058.484] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0058.484] malloc (_Size=0xffce) returned 0x1d8cfd50820 [0058.484] ??_V@YAXPEAX@Z () returned 0x1d8cfd50820 [0058.484] GetProcessHeap () returned 0x1d8cfc20000 [0058.484] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x1ffac) returned 0x1d8cfc38fd0 [0058.487] SetErrorMode (uMode=0x0) returned 0x0 [0058.487] SetErrorMode (uMode=0x1) returned 0x0 [0058.487] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1d8cfc38fe0, lpFilePart=0x54a22fed40 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x54a22fed40*="Desktop") returned 0x17 [0058.487] SetErrorMode (uMode=0x0) returned 0x1 [0058.487] GetProcessHeap () returned 0x1d8cfc20000 [0058.487] RtlReAllocateHeap (Heap=0x1d8cfc20000, Flags=0x0, Ptr=0x1d8cfc38fd0, Size=0x4c) returned 0x1d8cfc38fd0 [0058.487] GetProcessHeap () returned 0x1d8cfc20000 [0058.487] RtlSizeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, MemoryPointer=0x1d8cfc38fd0) returned 0x4c [0058.487] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0058.487] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.487] GetProcessHeap () returned 0x1d8cfc20000 [0058.487] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x1bc) returned 0x1d8cfc26c30 [0058.487] GetProcessHeap () returned 0x1d8cfc20000 [0058.487] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x368) returned 0x1d8cfc39030 [0058.493] GetProcessHeap () returned 0x1d8cfc20000 [0058.493] RtlReAllocateHeap (Heap=0x1d8cfc20000, Flags=0x0, Ptr=0x1d8cfc39030, Size=0x1be) returned 0x1d8cfc39030 [0058.493] GetProcessHeap () returned 0x1d8cfc20000 [0058.493] RtlSizeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, MemoryPointer=0x1d8cfc39030) returned 0x1be [0058.493] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7c884bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.493] GetProcessHeap () returned 0x1d8cfc20000 [0058.493] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xe8) returned 0x1d8cfc26e00 [0058.493] GetProcessHeap () returned 0x1d8cfc20000 [0058.493] RtlReAllocateHeap (Heap=0x1d8cfc20000, Flags=0x0, Ptr=0x1d8cfc26e00, Size=0x7e) returned 0x1d8cfc26e00 [0058.493] GetProcessHeap () returned 0x1d8cfc20000 [0058.493] RtlSizeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, MemoryPointer=0x1d8cfc26e00) returned 0x7e [0058.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.494] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x54a22feab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x54a22feab0) returned 0xffffffffffffffff [0058.494] GetLastError () returned 0x2 [0058.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.494] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x54a22feab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x54a22feab0) returned 0xffffffffffffffff [0058.495] GetLastError () returned 0x2 [0058.495] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.495] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x54a22feab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x54a22feab0) returned 0x1d8cfc26e90 [0058.495] GetProcessHeap () returned 0x1d8cfc20000 [0058.495] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, Size=0x28) returned 0x1d8cfc26ef0 [0058.495] FindClose (in: hFindFile=0x1d8cfc26e90 | out: hFindFile=0x1d8cfc26e90) returned 1 [0058.495] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x54a22feab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x54a22feab0) returned 0xffffffffffffffff [0058.496] GetLastError () returned 0x2 [0058.496] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x54a22feab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x54a22feab0) returned 0x1d8cfc26e90 [0058.496] GetProcessHeap () returned 0x1d8cfc20000 [0058.496] RtlReAllocateHeap (Heap=0x1d8cfc20000, Flags=0x0, Ptr=0x1d8cfc26ef0, Size=0x8) returned 0x1d8cfc26ef0 [0058.496] FindClose (in: hFindFile=0x1d8cfc26e90 | out: hFindFile=0x1d8cfc26e90) returned 1 [0058.496] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0058.496] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0058.496] ??_V@YAXPEAX@Z () returned 0x1 [0058.496] GetConsoleTitleW (in: lpConsoleTitle=0x54a22ff030, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0058.913] GetProcessHeap () returned 0x1d8cfc20000 [0058.913] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x21c) returned 0x1d8cfc39200 [0058.913] GetConsoleTitleW (in: lpConsoleTitle=0x1d8cfc39210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0059.275] GetProcessHeap () returned 0x1d8cfc20000 [0059.275] RtlReAllocateHeap (Heap=0x1d8cfc20000, Flags=0x0, Ptr=0x1d8cfc39200, Size=0xd8) returned 0x1d8cfc39200 [0059.275] GetProcessHeap () returned 0x1d8cfc20000 [0059.275] RtlSizeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, MemoryPointer=0x1d8cfc39200) returned 0xd8 [0059.275] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0059.954] GetProcessHeap () returned 0x1d8cfc20000 [0059.954] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc39200) returned 1 [0059.954] InitializeProcThreadAttributeList (in: lpAttributeList=0x54a22fef50, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x54a22fee40 | out: lpAttributeList=0x54a22fef50, lpSize=0x54a22fee40) returned 1 [0059.954] UpdateProcThreadAttribute (in: lpAttributeList=0x54a22fef50, dwFlags=0x0, Attribute=0x60001, lpValue=0x54a22fee2c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x54a22fef50, lpPreviousValue=0x0) returned 1 [0059.954] GetStartupInfoW (in: lpStartupInfo=0x54a22feee0 | out: lpStartupInfo=0x54a22feee0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x288, hStdOutput=0x294, hStdError=0x294)) [0059.954] GetProcessHeap () returned 0x1d8cfc20000 [0059.954] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x20) returned 0x1d8cfc21a60 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0059.954] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0059.955] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0059.955] GetProcessHeap () returned 0x1d8cfc20000 [0059.955] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc21a60) returned 1 [0059.955] GetProcessHeap () returned 0x1d8cfc20000 [0059.955] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0x12) returned 0x1d8cfc26f10 [0059.955] _get_osfhandle (_FileHandle=1) returned 0x294 [0059.955] SetConsoleMode (hConsoleHandle=0x294, dwMode=0x0) returned 0 [0059.955] _get_osfhandle (_FileHandle=0) returned 0x288 [0059.955] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0059.955] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x54a22fee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x54a22fee48 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x54a22fee48*(hProcess=0x9c, hThread=0x98, dwProcessId=0xd70, dwThreadId=0x908)) returned 1 [0060.467] CloseHandle (hObject=0x98) returned 1 [0060.467] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.467] GetProcessHeap () returned 0x1d8cfc20000 [0060.467] RtlFreeHeap (HeapHandle=0x1d8cfc20000, Flags=0x0, BaseAddress=0x1d8cfc28500) returned 1 [0060.467] GetEnvironmentStringsW () returned 0x1d8cfc284b0* [0060.467] GetProcessHeap () returned 0x1d8cfc20000 [0060.467] RtlAllocateHeap (HeapHandle=0x1d8cfc20000, Flags=0x8, Size=0xacc) returned 0x1d8cfc394a0 [0060.467] FreeEnvironmentStringsA (penv="=") returned 1 [0060.467] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcea380000 [0060.467] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQueryInformationProcess") returned 0x7ffcea4256b0 [0060.468] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x54a22fe348, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x54a22fe348, ReturnLength=0x0) returned 0x0 [0060.468] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x4681587000, lpBuffer=0x54a22fe380, nSize=0x7a0, lpNumberOfBytesRead=0x54a22fe340 | out: lpBuffer=0x54a22fe380*, lpNumberOfBytesRead=0x54a22fe340*=0x7a0) returned 1 [0060.468] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 36 os_tid = 0xf28 Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x16e33000" os_pid = "0xdb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xd40" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x6ec Thread: id = 29 os_tid = 0x55c Thread: id = 31 os_tid = 0x7b8 Thread: id = 33 os_tid = 0xbec Thread: id = 35 os_tid = 0xba0 Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x43409000" os_pid = "0xc1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xd64" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0xa7c Thread: id = 24 os_tid = 0x58c Thread: id = 30 os_tid = 0x6a4 Thread: id = 32 os_tid = 0x860 Thread: id = 34 os_tid = 0xe9c Process: id = "7" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x145c0000" os_pid = "0xf24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xd64" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xef0 Thread: id = 40 os_tid = 0xf94 Thread: id = 42 os_tid = 0x864 Thread: id = 43 os_tid = 0xb0 Thread: id = 44 os_tid = 0x1368 Process: id = "8" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x3ae72000" os_pid = "0xd70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xd40" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 39 os_tid = 0x908 [0061.983] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff721fc0000 [0061.983] __set_app_type (_Type=0x1) [0061.983] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff721fca1c0) returned 0x0 [0061.984] __wgetmainargs (in: _Argc=0x7ff721fd7668, _Argv=0x7ff721fd7670, _Env=0x7ff721fd7678, _DoWildCard=0, _StartInfo=0x7ff721fd7684 | out: _Argc=0x7ff721fd7668, _Argv=0x7ff721fd7670, _Env=0x7ff721fd7678) returned 0 [0061.984] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.984] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff721fc0000 [0061.984] _vsnwprintf (in: _Buffer=0x7ff721fd9b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x46816f79f8 | out: _Buffer="netsh>") returned 6 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eb80 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e7e0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eba0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ea20 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e780 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e520 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e840 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e8c0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e8e0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ea80 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ec20 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e8a0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e6a0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e980 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ec00 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ec40 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eac0 [0061.985] GetProcessHeap () returned 0x2225da60000 [0061.985] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e9a0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e6c0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e720 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e800 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e860 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e4e0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ebc0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e960 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ebe0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e940 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e740 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eaa0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ec60 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eb40 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e500 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e680 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e560 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e900 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e7a0 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e820 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e540 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e580 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.986] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e920 [0061.986] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e5a0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e6e0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e5c0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e9c0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e700 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e880 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e760 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e9e0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ea00 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ea40 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e7c0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eb60 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e5e0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e600 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eae0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ea60 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e620 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eb00 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e640 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6e660 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6eb20 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.987] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fdb0 [0061.987] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70210 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fed0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70290 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70230 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70250 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fff0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da703d0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70270 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fd70 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da701b0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da702b0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fd90 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70070 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fe30 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70390 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da703b0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da703f0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fe50 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da702d0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70410 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da700f0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da702f0 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.988] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fe70 [0061.988] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fe90 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fd50 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70030 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70310 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70050 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6feb0 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70330 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fef0 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70350 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70370 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70430 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70450 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70470 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70490 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fd10 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ff10 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fd30 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70190 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fdd0 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70090 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da700b0 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ff50 [0061.989] GetProcessHeap () returned 0x2225da60000 [0061.989] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da700d0 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70130 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fdf0 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ff30 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6fe10 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ff70 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70170 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ff90 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ffb0 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da6ffd0 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70010 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70110 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70150 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da701f0 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da701d0 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70960 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70520 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70920 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70720 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70780 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70640 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70c60 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.990] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70b60 [0061.990] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70c40 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70a20 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70980 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70c80 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da709c0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70a40 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70900 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70840 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70940 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da706a0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70540 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da707e0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da709a0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da707a0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da709e0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70a00 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70600 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da708e0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da705c0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da706e0 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70a60 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70680 [0061.991] GetProcessHeap () returned 0x2225da60000 [0061.991] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da707c0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70ca0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70aa0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70a80 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70580 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da706c0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70ac0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70560 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70660 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da705a0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70620 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da705e0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70700 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70b80 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70860 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70740 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70760 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70ae0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70800 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70820 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da708c0 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70b00 [0061.992] GetProcessHeap () returned 0x2225da60000 [0061.992] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70b20 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70880 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da708a0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70b40 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70ba0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70bc0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70be0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70c00 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70c20 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70e50 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70db0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70f10 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70f30 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da710f0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70e10 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71170 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71130 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da713b0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.993] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da711d0 [0061.993] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71390 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70e30 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71210 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70df0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70f50 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da710d0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71230 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71030 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70f70 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71310 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70ed0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da712f0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da711f0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da70eb0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71110 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da713f0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da712d0 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da71330 [0061.994] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0061.994] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0061.994] GetProcessHeap () returned 0x2225da60000 [0061.994] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x28) returned 0x2225da68830 [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x2) returned 0x2225da6dab0 [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x14) returned 0x2225da71090 [0061.995] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x0) returned 1 [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x58) returned 0x2225da656c0 [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x0) returned 1 [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0xb0) returned 0x2225da65040 [0061.995] GetProcessHeap () returned 0x2225da60000 [0061.995] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da656c0) returned 1 [0061.995] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffce6880000 [0061.997] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x46816f79a8 | out: phkResult=0x46816f79a8*=0xb4) returned 0x0 [0061.998] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x46816f79e0, lpcbMaxValueNameLen=0x46816f79f0, lpcbMaxValueLen=0x46816f79e8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x46816f79e0*=0x14, lpcbMaxValueNameLen=0x46816f79f0, lpcbMaxValueLen=0x46816f79e8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0061.998] GetProcessHeap () returned 0x2225da60000 [0061.998] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x8, Size=0x16) returned 0x2225da71350 [0061.998] GetProcessHeap () returned 0x2225da60000 [0061.998] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x8, Size=0x23) returned 0x2225da688f0 [0061.998] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="2", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0061.998] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0061.998] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0061.998] GetProcessHeap () returned 0x2225da60000 [0061.998] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x50) returned 0x2225da718a0 [0061.998] GetProcessHeap () returned 0x2225da60000 [0061.998] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x4) returned 0x2225da6db90 [0061.998] GetProcessHeap () returned 0x2225da60000 [0061.998] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x14) returned 0x2225da71150 [0061.998] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0061.998] GetProcessHeap () returned 0x2225da60000 [0061.998] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da68830) returned 1 [0061.998] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcdeaf0000 [0062.682] GetProcAddress (hModule=0x7ffcdeaf0000, lpProcName="InitHelperDll") returned 0x7ffcdeaf1310 [0062.682] InitHelperDll () returned 0x0 [0062.685] RegisterHelper () returned 0x0 [0062.685] GetProcessHeap () returned 0x2225da60000 [0062.685] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x108) returned 0x2225da642f0 [0062.686] GetProcessHeap () returned 0x2225da60000 [0062.686] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da65040) returned 1 [0063.130] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="4", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0063.130] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0063.130] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0063.130] GetProcessHeap () returned 0x2225da60000 [0063.130] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x78) returned 0x2225da65040 [0063.130] GetProcessHeap () returned 0x2225da60000 [0063.130] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x4) returned 0x2225da6db60 [0063.130] GetProcessHeap () returned 0x2225da60000 [0063.130] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1a) returned 0x2225da68650 [0063.130] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0063.130] GetProcessHeap () returned 0x2225da60000 [0063.130] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da718a0) returned 1 [0063.130] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcca290000 [0069.647] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ffcea250000 [0069.648] GetVersion () returned 0x3ad7000a [0069.648] SetErrorMode (uMode=0x0) returned 0x0 [0069.648] SetErrorMode (uMode=0x8001) returned 0x0 [0069.648] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x2225da82bf0 [0069.648] LocalFree (hMem=0x2225da82bf0) returned 0x0 [0069.648] GetVersion () returned 0x3ad7000a [0069.649] GlobalLock (hMem=0x2225f320008) returned 0x2225da82bf0 [0069.649] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2225da82e10 [0069.650] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x2225da79360 [0069.650] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x2225da713d0 [0069.650] malloc (_Size=0x100) returned 0x2225dd06df0 [0069.650] __dllonexit () returned 0x7ffcc9e21200 [0069.650] __dllonexit () returned 0x7ffcc9e211f0 [0069.650] __dllonexit () returned 0x7ffcc9e21240 [0069.650] __dllonexit () returned 0x7ffcc9e212a0 [0069.650] __dllonexit () returned 0x7ffcc9e21390 [0069.650] __dllonexit () returned 0x7ffcc9e213a0 [0069.651] __dllonexit () returned 0x7ffcc9e21420 [0069.651] __dllonexit () returned 0x7ffcc9e214c0 [0069.651] __dllonexit () returned 0x7ffcc9e212c0 [0069.651] __dllonexit () returned 0x7ffcc9e459c0 [0069.651] __dllonexit () returned 0x7ffcc9e212e0 [0069.651] __dllonexit () returned 0x7ffcc9e21470 [0069.651] __dllonexit () returned 0x7ffcc9e21490 [0069.651] __dllonexit () returned 0x7ffcc9e214e0 [0069.651] __dllonexit () returned 0x7ffcc9e21500 [0069.651] __dllonexit () returned 0x7ffcc9e21520 [0069.651] __dllonexit () returned 0x7ffcc9e21550 [0069.651] __dllonexit () returned 0x7ffcc9e21610 [0069.652] __dllonexit () returned 0x7ffcc9e21050 [0069.652] __dllonexit () returned 0x7ffcc9e21070 [0069.652] __dllonexit () returned 0x7ffcc9e21030 [0069.655] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc19d [0069.655] __dllonexit () returned 0x7ffcc9e459a0 [0069.655] __dllonexit () returned 0x7ffcc9e45980 [0069.656] __dllonexit () returned 0x7ffcc9e459b0 [0069.656] __dllonexit () returned 0x7ffcc9e45990 [0069.656] GetVersion () returned 0x3ad7000a [0069.656] GetVersion () returned 0x3ad7000a [0069.656] GetVersion () returned 0x3ad7000a [0069.656] __dllonexit () returned 0x7ffcc9e328e0 [0069.656] __dllonexit () returned 0x7ffcc9e32910 [0069.656] __dllonexit () returned 0x7ffcc9e21300 [0069.656] __dllonexit () returned 0x7ffcc9e213b0 [0069.656] __dllonexit () returned 0x7ffcc9e213d0 [0069.656] __dllonexit () returned 0x7ffcc9e326e0 [0069.657] GetVersion () returned 0x3ad7000a [0069.657] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0069.657] GetSystemMetrics (nIndex=11) returned 32 [0069.657] GetSystemMetrics (nIndex=12) returned 32 [0069.657] GetSystemMetrics (nIndex=2) returned 17 [0069.657] GetSystemMetrics (nIndex=3) returned 17 [0069.657] GetDC (hWnd=0x0) returned 0x60100ce [0069.657] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0069.657] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0069.657] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0069.658] GetSysColor (nIndex=15) returned 0xf0f0f0 [0069.658] GetSysColor (nIndex=16) returned 0xa0a0a0 [0069.658] GetSysColor (nIndex=20) returned 0xffffff [0069.658] GetSysColor (nIndex=18) returned 0x0 [0069.658] GetSysColor (nIndex=6) returned 0x646464 [0069.658] GetSysColorBrush (nIndex=15) returned 0x100072 [0069.658] GetSysColorBrush (nIndex=6) returned 0x10007a [0069.658] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0069.658] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0069.658] __dllonexit () returned 0x7ffcc9e21450 [0069.658] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc19e [0069.658] __dllonexit () returned 0x7ffcc9e326c0 [0069.658] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0069.658] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0069.658] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0069.658] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0069.658] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0069.658] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0069.658] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0069.659] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0069.659] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0069.659] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0069.659] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc07a [0069.659] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc083 [0069.659] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc19e [0069.659] __dllonexit () returned 0x7ffcc9e459d0 [0069.659] __dllonexit () returned 0x7ffcc9e459f0 [0069.660] __dllonexit () returned 0x7ffcc9e45a00 [0069.660] __dllonexit () returned 0x7ffcc9e45a10 [0069.660] __dllonexit () returned 0x7ffcc9e45a20 [0069.660] GetCursorPos (in: lpPoint=0x7ffcc9f65ae8 | out: lpPoint=0x7ffcc9f65ae8*(x=1179, y=450)) returned 1 [0069.660] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2225da814f0 [0069.660] LocalReAlloc (hMem=0x2225da713d0, uBytes=0x18, uFlags=0x2) returned 0x2225da653a0 [0069.660] GetCurrentThread () returned 0xfffffffffffffffe [0069.660] GetCurrentThreadId () returned 0x908 [0069.660] __dllonexit () returned 0x7ffcc9e21620 [0069.661] SetErrorMode (uMode=0x0) returned 0x8001 [0069.661] SetErrorMode (uMode=0x8001) returned 0x0 [0069.661] GetModuleFileNameW (in: hModule=0x7ffcc9e20000, lpFilename=0x46816f6980, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0069.661] wcscpy_s (in: _Destination=0x46816f6b90, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0069.661] FindResourceW (hModule=0x7ffcc9e20000, lpName=0xe01, lpType=0x6) returned 0x2225da30bb0 [0069.946] LoadStringW (in: hInstance=0x7ffcc9e20000, uID=0xe000, lpBuffer=0x46816f6da0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0069.947] wcscpy_s (in: _Destination=0x46816f69b4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0069.947] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0069.948] malloc (_Size=0x80) returned 0x2225dd06e10 [0069.948] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x2225da83160 [0069.949] GetSystemDirectoryA (in: lpBuffer=0x46816f7020, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0069.949] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0069.949] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0069.949] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0069.949] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0069.953] GetProcAddress (hModule=0x7ffcca290000, lpProcName="InitHelperDll") returned 0x7ffcca2a5850 [0069.953] InitHelperDll () returned 0x0 [0069.954] RegisterHelper () returned 0x0 [0069.954] GetProcessHeap () returned 0x2225da60000 [0069.954] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x160) returned 0x2225da7ac50 [0069.954] GetProcessHeap () returned 0x2225da60000 [0069.954] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da642f0) returned 1 [0069.954] RegisterHelper () returned 0x0 [0069.954] GetProcessHeap () returned 0x2225da60000 [0069.954] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1b8) returned 0x2225da7cea0 [0069.954] GetProcessHeap () returned 0x2225da60000 [0069.954] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7ac50) returned 1 [0069.956] RegisterHelper () returned 0x0 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x210) returned 0x2225da7ac50 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7cea0) returned 1 [0069.956] RegisterHelper () returned 0x0 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x268) returned 0x2225da7cea0 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7ac50) returned 1 [0069.956] RegisterHelper () returned 0x0 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x2c0) returned 0x2225da85270 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7cea0) returned 1 [0069.956] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="authfwcfg", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0069.956] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0069.956] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0xa0) returned 0x2225da652e0 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x14) returned 0x2225da70e70 [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1c) returned 0x2225da795d0 [0069.956] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0069.956] GetProcessHeap () returned 0x2225da60000 [0069.956] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da65040) returned 1 [0069.957] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9d30000 [0070.906] GetProcAddress (hModule=0x7ffcc9d30000, lpProcName="InitHelperDll") returned 0x7ffcc9d31430 [0070.906] InitHelperDll () returned 0x0 [0070.923] RegisterHelper () returned 0x0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x318) returned 0x2225da7cea0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da85270) returned 1 [0070.923] RegisterHelper () returned 0x0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x370) returned 0x2225da85d50 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7cea0) returned 1 [0070.923] RegisterHelper () returned 0x0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x3c8) returned 0x2225da7cea0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da85d50) returned 1 [0070.923] RegisterHelper () returned 0x0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x420) returned 0x2225da85d50 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7cea0) returned 1 [0070.923] RegisterHelper () returned 0x0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x478) returned 0x2225da7cea0 [0070.923] GetProcessHeap () returned 0x2225da60000 [0070.923] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da85d50) returned 1 [0070.923] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="dhcpclient", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0070.923] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0070.923] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0070.924] GetProcessHeap () returned 0x2225da60000 [0070.924] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0xc8) returned 0x2225da78f80 [0070.924] GetProcessHeap () returned 0x2225da60000 [0070.924] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x16) returned 0x2225da85cb0 [0070.924] GetProcessHeap () returned 0x2225da60000 [0070.924] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x22) returned 0x2225da795a0 [0070.924] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0070.924] GetProcessHeap () returned 0x2225da60000 [0070.924] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da652e0) returned 1 [0070.924] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9d20000 [0071.363] GetProcAddress (hModule=0x7ffcc9d20000, lpProcName="InitHelperDll") returned 0x7ffcc9d21610 [0071.364] InitHelperDll () returned 0x0 [0071.364] RegisterHelper () returned 0x0 [0071.364] GetProcessHeap () returned 0x2225da60000 [0071.364] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x4d0) returned 0x2225da86560 [0071.364] GetProcessHeap () returned 0x2225da60000 [0071.364] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da7cea0) returned 1 [0071.364] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="dot3cfg", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0071.364] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0071.364] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0071.364] GetProcessHeap () returned 0x2225da60000 [0071.364] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0xf0) returned 0x2225da642f0 [0071.364] GetProcessHeap () returned 0x2225da60000 [0071.364] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da85c10 [0071.364] GetProcessHeap () returned 0x2225da60000 [0071.364] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x18) returned 0x2225da85a90 [0071.364] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0071.364] GetProcessHeap () returned 0x2225da60000 [0071.364] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da78f80) returned 1 [0071.364] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9c50000 [0072.363] GetProcAddress (hModule=0x7ffcc9c50000, lpProcName="InitHelperDll") returned 0x7ffcc9c51100 [0072.363] InitHelperDll () returned 0x0 [0072.363] RegisterHelper () returned 0x0 [0072.363] GetProcessHeap () returned 0x2225da60000 [0072.363] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x528) returned 0x2225da87660 [0072.363] GetProcessHeap () returned 0x2225da60000 [0072.363] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da86560) returned 1 [0072.363] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="fwcfg", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0072.363] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0072.363] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0072.363] GetProcessHeap () returned 0x2225da60000 [0072.363] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x118) returned 0x2225da85270 [0072.363] GetProcessHeap () returned 0x2225da60000 [0072.363] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0xc) returned 0x2225da85a10 [0072.363] GetProcessHeap () returned 0x2225da60000 [0072.363] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x14) returned 0x2225da85610 [0072.363] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0072.363] GetProcessHeap () returned 0x2225da60000 [0072.363] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da642f0) returned 1 [0072.363] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9b60000 [0072.380] GetProcAddress (hModule=0x7ffcc9b60000, lpProcName="InitHelperDll") returned 0x7ffcc9b611f0 [0072.380] InitHelperDll () returned 0x0 [0072.380] RegisterHelper () returned 0x0 [0072.380] GetProcessHeap () returned 0x2225da60000 [0072.380] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x580) returned 0x2225da87b90 [0072.380] GetProcessHeap () returned 0x2225da60000 [0072.381] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da87660) returned 1 [0072.381] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="hnetmon", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0072.381] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0072.381] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0072.381] GetProcessHeap () returned 0x2225da60000 [0072.381] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x140) returned 0x2225da85390 [0072.381] GetProcessHeap () returned 0x2225da60000 [0072.381] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da85970 [0072.381] GetProcessHeap () returned 0x2225da60000 [0072.381] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x18) returned 0x2225da857b0 [0072.381] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0072.381] GetProcessHeap () returned 0x2225da60000 [0072.381] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da85270) returned 1 [0072.381] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9b50000 [0073.533] GetProcAddress (hModule=0x7ffcc9b50000, lpProcName="InitHelperDll") returned 0x7ffcc9b52060 [0073.533] InitHelperDll () returned 0x0 [0073.533] RegisterHelper () returned 0x0 [0073.533] GetProcessHeap () returned 0x2225da60000 [0073.533] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x5d8) returned 0x2225da8fd00 [0073.534] GetProcessHeap () returned 0x2225da60000 [0073.534] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da87b90) returned 1 [0073.534] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="netiohlp", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0073.534] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0073.534] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0073.534] GetProcessHeap () returned 0x2225da60000 [0073.534] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x168) returned 0x2225da87660 [0073.534] GetProcessHeap () returned 0x2225da60000 [0073.534] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x12) returned 0x2225da85c50 [0073.534] GetProcessHeap () returned 0x2225da60000 [0073.534] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1a) returned 0x2225da86070 [0073.534] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0073.534] GetProcessHeap () returned 0x2225da60000 [0073.534] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da85390) returned 1 [0073.534] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9590000 [0074.276] GetProcAddress (hModule=0x7ffcc9590000, lpProcName="InitHelperDll") returned 0x7ffcc95a5f80 [0074.276] InitHelperDll () returned 0x0 [0074.276] RegisterHelper () returned 0x0 [0074.276] GetProcessHeap () returned 0x2225da60000 [0074.276] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x630) returned 0x2225da91b00 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da8fd00) returned 1 [0074.277] RegisterHelper () returned 0x0 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x688) returned 0x2225da92140 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da91b00) returned 1 [0074.277] RegisterHelper () returned 0x0 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x6e0) returned 0x2225da927d0 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da92140) returned 1 [0074.277] RegisterHelper () returned 0x0 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x738) returned 0x2225da91b00 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da927d0) returned 1 [0074.277] RegisterHelper () returned 0x0 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x790) returned 0x2225da92240 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da91b00) returned 1 [0074.277] RegisterHelper () returned 0x0 [0074.277] GetProcessHeap () returned 0x2225da60000 [0074.277] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x7e8) returned 0x2225da929e0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da92240) returned 1 [0074.278] RegisterHelper () returned 0x0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x840) returned 0x2225da931d0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da929e0) returned 1 [0074.278] RegisterHelper () returned 0x0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x898) returned 0x2225da91b00 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da931d0) returned 1 [0074.278] RegisterHelper () returned 0x0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x8f0) returned 0x2225da923a0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da91b00) returned 1 [0074.278] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="nettrace", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0074.278] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0074.278] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x190) returned 0x2225da877d0 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x12) returned 0x2225da85890 [0074.278] GetProcessHeap () returned 0x2225da60000 [0074.278] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1a) returned 0x2225da90570 [0074.279] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0074.279] GetProcessHeap () returned 0x2225da60000 [0074.279] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da87660) returned 1 [0074.279] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9460000 [0076.090] GetProcAddress (hModule=0x7ffcc9460000, lpProcName="InitHelperDll") returned 0x7ffcc94615d0 [0076.090] InitHelperDll () returned 0x0 [0076.090] RegisterHelper () returned 0x0 [0076.090] GetProcessHeap () returned 0x2225da60000 [0076.090] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x948) returned 0x2225daa7500 [0076.090] GetProcessHeap () returned 0x2225da60000 [0076.090] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da923a0) returned 1 [0076.090] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="nshhttp", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0076.090] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0076.090] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0076.090] GetProcessHeap () returned 0x2225da60000 [0076.090] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1b8) returned 0x2225da87b70 [0076.090] GetProcessHeap () returned 0x2225da60000 [0076.090] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x10) returned 0x2225da91e90 [0076.090] GetProcessHeap () returned 0x2225da60000 [0076.090] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x18) returned 0x2225da91cb0 [0076.091] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0076.091] GetProcessHeap () returned 0x2225da60000 [0076.091] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da877d0) returned 1 [0076.091] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc9390000 [0076.361] GetProcAddress (hModule=0x7ffcc9390000, lpProcName="InitHelperDll") returned 0x7ffcc93910e0 [0076.361] InitHelperDll () returned 0x0 [0076.361] RegisterHelper () returned 0x0 [0076.361] GetProcessHeap () returned 0x2225da60000 [0076.361] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x9a0) returned 0x2225daa7e50 [0076.361] GetProcessHeap () returned 0x2225da60000 [0076.361] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225daa7500) returned 1 [0076.361] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x2225da71350, lpcchValueName=0x46816f79a0, lpReserved=0x0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8 | out: lpValueName="nshipsec", lpcchValueName=0x46816f79a0, lpType=0x0, lpData=0x2225da688f0, lpcbData=0x46816f79f8) returned 0x0 [0076.362] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0076.362] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0076.362] GetProcessHeap () returned 0x2225da60000 [0076.362] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1e0) returned 0x2225da87660 [0076.362] GetProcessHeap () returned 0x2225da60000 [0076.362] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x12) returned 0x2225da91c90 [0076.362] GetProcessHeap () returned 0x2225da60000 [0076.362] RtlAllocateHeap (HeapHandle=0x2225da60000, Flags=0x0, Size=0x1a) returned 0x2225da95d50 [0076.362] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0076.362] GetProcessHeap () returned 0x2225da60000 [0076.362] RtlFreeHeap (HeapHandle=0x2225da60000, Flags=0x0, BaseAddress=0x2225da87b70) returned 1 [0076.362] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) Thread: id = 41 os_tid = 0xf90 Thread: id = 45 os_tid = 0x13f0 Process: id = "9" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x3460a000" os_pid = "0xd48" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0xa1c" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xd4c [0137.625] GetProcessHeap () returned 0xfd0000 [0137.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x30) returned 0xfe3678 [0137.626] GetProcessHeap () returned 0xfd0000 [0137.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x3310) returned 0xff0960 [0137.631] GetProcessHeap () returned 0xfd0000 [0137.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x300) returned 0xfe2f58 [0137.631] GetProcessHeap () returned 0xfd0000 [0137.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfefcb0 [0137.632] GetTickCount () returned 0x1138a54 [0137.632] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xeffc30, cchData=32 | out: lpLCData="\x03") returned 16 [0137.632] GetProcessHeap () returned 0xfd0000 [0137.632] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee3e0 [0137.632] GetProcessHeap () returned 0xfd0000 [0137.632] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfee740 [0137.632] GetProcessHeap () returned 0xfd0000 [0137.632] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfeef28 [0137.632] GetProcessHeap () returned 0xfd0000 [0137.632] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfef140 [0137.632] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xfef140, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0137.632] GetProcessHeap () returned 0xfd0000 [0137.632] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef140 | out: hHeap=0xfd0000) returned 1 [0137.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee740 | out: hHeap=0xfd0000) returned 1 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfeef28 | out: hHeap=0xfd0000) returned 1 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee3e0 | out: hHeap=0xfd0000) returned 1 [0137.633] GetVersion () returned 0x23f00206 [0137.633] GetCurrentProcess () returned 0xffffffff [0137.633] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xeffbc4 | out: TokenHandle=0xeffbc4*=0x1fc) returned 1 [0137.633] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x14, TokenInformation=0xeffbbc, TokenInformationLength=0x4, ReturnLength=0xeffbc0 | out: TokenInformation=0xeffbbc, ReturnLength=0xeffbc0) returned 1 [0137.633] CloseHandle (hObject=0x1fc) returned 1 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfdb188 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfee740 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfeef28 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee740 | out: hHeap=0xfd0000) returned 1 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfeef28 | out: hHeap=0xfd0000) returned 1 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfdb1b0 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfdb2a0 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfee400 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0137.633] GetProcessHeap () returned 0xfd0000 [0137.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0137.634] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfdb2a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee400 | out: hHeap=0xfd0000) returned 1 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdb1b0 | out: hHeap=0xfd0000) returned 1 [0137.634] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffb7c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffb7c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdb2a0 | out: hHeap=0xfd0000) returned 1 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x30) returned 0xfe3720 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x2a) returned 0xfe3870 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe3870, Size=0x52) returned 0xfdf0b0 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe3720 | out: hHeap=0xfd0000) returned 1 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdf0b0 | out: hHeap=0xfd0000) returned 1 [0137.634] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1c) returned 0xfdb1b0 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1c) returned 0xfdb2a0 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfee608 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfee388 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfee590 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0137.635] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfee388, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee590 | out: hHeap=0xfd0000) returned 1 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee608 | out: hHeap=0xfd0000) returned 1 [0137.635] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffb64, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffb64*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee388 | out: hHeap=0xfd0000) returned 1 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0xfe2950 [0137.635] GetProcessHeap () returned 0xfd0000 [0137.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0xfe2a70 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2a70, Size=0x72) returned 0xfe2590 [0137.636] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0137.636] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x1fc [0137.636] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2950 | out: hHeap=0xfd0000) returned 1 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2590 | out: hHeap=0xfd0000) returned 1 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef3b8 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef0e8 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0137.636] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef0e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0137.636] GetProcessHeap () returned 0xfd0000 [0137.636] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3b8 | out: hHeap=0xfd0000) returned 1 [0137.636] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffb4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffb4c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0e8 | out: hHeap=0xfd0000) returned 1 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0xfe2710 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0xfe2a70 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2a70, Size=0x72) returned 0xfe2590 [0137.637] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0137.637] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x200 [0137.637] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2710 | out: hHeap=0xfd0000) returned 1 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2590 | out: hHeap=0xfd0000) returned 1 [0137.637] ReleaseMutex (hMutex=0x200) returned 1 [0137.637] CloseHandle (hObject=0x200) returned 1 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfef730 [0137.637] GetProcessHeap () returned 0xfd0000 [0137.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfdf0b0 [0137.637] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0137.637] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0137.637] Wow64DisableWow64FsRedirection (in: OldValue=0xeffbc0 | out: OldValue=0xeffbc0*=0x0) returned 1 [0137.638] GetProcessHeap () returned 0xfd0000 [0137.638] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdf0b0 | out: hHeap=0xfd0000) returned 1 [0137.638] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xfef730, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0137.638] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xeffb68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xeffbb0 | out: lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpProcessInformation=0xeffbb0*(hProcess=0x204, hThread=0x200, dwProcessId=0xd58, dwThreadId=0xd5c)) returned 1 [0137.661] CloseHandle (hObject=0x204) returned 1 [0137.661] CloseHandle (hObject=0x200) returned 1 [0137.661] GetProcessHeap () returned 0xfd0000 [0137.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfdf0b0 [0137.661] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0137.661] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0137.661] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0137.661] GetProcessHeap () returned 0xfd0000 [0137.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdf0b0 | out: hHeap=0xfd0000) returned 1 [0137.661] GetProcessHeap () returned 0xfd0000 [0137.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef730 | out: hHeap=0xfd0000) returned 1 [0137.661] Sleep (dwMilliseconds=0x1388) [0142.667] GetProcessHeap () returned 0xfd0000 [0142.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef3b8 [0142.667] GetProcessHeap () returned 0xfd0000 [0142.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef138 [0142.667] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfeef80 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.668] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfeef80 | out: hHeap=0xfd0000) returned 1 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3b8 | out: hHeap=0xfd0000) returned 1 [0142.668] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffb84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffb84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef138 | out: hHeap=0xfd0000) returned 1 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x60) returned 0xfe0490 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef160 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef0e8 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef2f0 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.668] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xfef0e8, nSize=0xf | out: lpDst="") returned 0x1e [0142.668] GetProcessHeap () returned 0xfd0000 [0142.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2f0 | out: hHeap=0xfd0000) returned 1 [0142.668] GetProcessHeap () returned 0xfd0000 [0142.669] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfef0e8, Size=0x3a) returned 0xfe2a70 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x3a) returned 0xfe2ab8 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.669] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xfe2a70, nSize=0x1d | out: lpDst="") returned 0x1e [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2ab8 | out: hHeap=0xfd0000) returned 1 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2a70, Size=0x72) returned 0xfe2590 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x72) returned 0xfdfdd8 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.669] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xfe2590, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdfdd8 | out: hHeap=0xfd0000) returned 1 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0xfe2bd8 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3e) returned 0xfe2710 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x3e) returned 0xfe2c20 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.669] GetProcessHeap () returned 0xfd0000 [0142.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x10) returned 0xfee6c8 [0142.669] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffa9c | out: phkResult=0xeffa9c*=0x204) returned 0x0 [0142.669] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0xeffa98, lpData=0xfe2c20, lpcbData=0xeffaa0*=0x3e | out: lpType=0xeffa98*=0x2, lpData=0xfe2c20*=0x0, lpcbData=0xeffaa0*=0x98) returned 0xea [0142.669] RegCloseKey (hKey=0x204) returned 0x0 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee6c8 | out: hHeap=0xfd0000) returned 1 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2c20 | out: hHeap=0xfd0000) returned 1 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2710, Size=0x7a) returned 0xfe2e18 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x7a) returned 0xfe3e20 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe0600 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x10) returned 0xfee698 [0142.670] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffa9c | out: phkResult=0xeffa9c*=0x204) returned 0x0 [0142.670] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0xeffa98, lpData=0xfe3e20, lpcbData=0xeffaa0*=0x7a | out: lpType=0xeffa98*=0x2, lpData=0xfe3e20*=0x0, lpcbData=0xeffaa0*=0x98) returned 0xea [0142.670] RegCloseKey (hKey=0x204) returned 0x0 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee698 | out: hHeap=0xfd0000) returned 1 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0600 | out: hHeap=0xfd0000) returned 1 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe3e20 | out: hHeap=0xfd0000) returned 1 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2e18, Size=0xf2) returned 0xfe1898 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xf2) returned 0xfe1730 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.670] GetProcessHeap () returned 0xfd0000 [0142.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x10) returned 0xfee680 [0142.670] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffa9c | out: phkResult=0xeffa9c*=0x204) returned 0x0 [0142.670] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0xeffa98, lpData=0xfe1730, lpcbData=0xeffaa0*=0xf2 | out: lpType=0xeffa98*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xeffaa0*=0x98) returned 0x0 [0142.670] RegCloseKey (hKey=0x204) returned 0x0 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee680 | out: hHeap=0xfd0000) returned 1 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef548 [0142.671] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffa9c | out: phkResult=0xeffa9c*=0x204) returned 0x0 [0142.671] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffa98, lpData=0xfe17c8, lpcbData=0xeffaa0*=0x5a | out: lpType=0xeffa98*=0x0, lpData=0xfe17c8*=0x1a, lpcbData=0xeffaa0*=0x5a) returned 0x2 [0142.671] RegCloseKey (hKey=0x204) returned 0x0 [0142.671] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffab0 | out: phkResult=0xeffab0*=0x204) returned 0x0 [0142.671] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffaac, lpData=0xfe17c8, lpcbData=0xeffab4*=0x5a | out: lpType=0xeffaac*=0x2, lpData=0xfe17c8*=0x1a, lpcbData=0xeffab4*=0x78) returned 0xea [0142.671] RegCloseKey (hKey=0x204) returned 0x0 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef548 | out: hHeap=0xfd0000) returned 1 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1730 | out: hHeap=0xfd0000) returned 1 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe1898, Size=0x1e2) returned 0xfef730 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e2) returned 0xfee740 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x10) returned 0xfee6f8 [0142.671] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffa9c | out: phkResult=0xeffa9c*=0x204) returned 0x0 [0142.671] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0xeffa98, lpData=0xfee740, lpcbData=0xeffaa0*=0x1e2 | out: lpType=0xeffa98*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xeffaa0*=0x98) returned 0x0 [0142.671] RegCloseKey (hKey=0x204) returned 0x0 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee6f8 | out: hHeap=0xfd0000) returned 1 [0142.671] GetProcessHeap () returned 0xfd0000 [0142.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef3e0 [0142.672] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffa9c | out: phkResult=0xeffa9c*=0x204) returned 0x0 [0142.672] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffa98, lpData=0xfee7d8, lpcbData=0xeffaa0*=0x14a | out: lpType=0xeffa98*=0x0, lpData=0xfee7d8*=0x61, lpcbData=0xeffaa0*=0x14a) returned 0x2 [0142.672] RegCloseKey (hKey=0x204) returned 0x0 [0142.672] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xeffab0 | out: phkResult=0xeffab0*=0x204) returned 0x0 [0142.672] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0xeffaac, lpData=0xfee7d8, lpcbData=0xeffab4*=0x14a | out: lpType=0xeffaac*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xeffab4*=0x78) returned 0x0 [0142.672] RegCloseKey (hKey=0x204) returned 0x0 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.672] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xfef730, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee740 | out: hHeap=0xfd0000) returned 1 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2bd8 | out: hHeap=0xfd0000) returned 1 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee6e0 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x10) returned 0xfee710 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee6f8 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.672] ExpandEnvironmentStringsW (in: lpSrc="oit.txt", lpDst=0xfee710, nSize=0x8 | out: lpDst="oit.txt") returned 0x8 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee6f8 | out: hHeap=0xfd0000) returned 1 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee6e0 | out: hHeap=0xfd0000) returned 1 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfee740 [0142.672] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff3f28 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff4140 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff4358 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff4570 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff4788 [0142.673] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xff3f28, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff49a0 [0142.673] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xff49a0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff49a0 | out: hHeap=0xfd0000) returned 1 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff49a0 [0142.673] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xff49a0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff49a0 | out: hHeap=0xfd0000) returned 1 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff49a0 [0142.673] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xff49a0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0142.673] GetProcessHeap () returned 0xfd0000 [0142.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff49a0 | out: hHeap=0xfd0000) returned 1 [0142.673] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=0) returned 1 [0142.698] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xeffb94 | out: phkResult=0xeffb94*=0x204) returned 0x0 [0142.698] RegSetValueExW (hKey=0x204, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData=0xff4358, cbData=0xe4) returned 0x5 [0142.698] RegCloseKey (hKey=0x204) returned 0x0 [0142.698] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xeffba8 | out: phkResult=0xeffba8*=0x204) returned 0x0 [0142.698] RegSetValueExW (in: hKey=0x204, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe") returned 0x0 [0142.699] RegCloseKey (hKey=0x204) returned 0x0 [0142.699] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt"), bFailIfExists=1) returned 0 [0142.699] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt")) returned 0xffffffff [0142.699] GetProcessHeap () returned 0xfd0000 [0142.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x118) returned 0xfe2428 [0142.699] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 0 [0142.700] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0142.700] GetFileAttributesW (lpFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0142.700] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 0 [0142.701] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0142.701] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee710 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee740 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff3f28 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff4140 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff4358 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff4570 | out: hHeap=0xfd0000) returned 1 [0142.701] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff4788 | out: hHeap=0xfd0000) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2590 | out: hHeap=0xfd0000) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef730 | out: hHeap=0xfd0000) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef4f8 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef4d0 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef6b0 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.702] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef4d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef4f8 | out: hHeap=0xfd0000) returned 1 [0142.702] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffbbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffbbc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef4d0 | out: hHeap=0xfd0000) returned 1 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0xfe7568 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee680 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x190) returned 0xfe3c38 [0142.702] GetProcessHeap () returned 0xfd0000 [0142.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x70) returned 0xfe0490 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x66) returned 0xfdebd8 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfdebd8, Size=0xca) returned 0xfe0600 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x184) returned 0xfe1d98 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee668 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfef730 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x250) returned 0xfee740 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xa0) returned 0xfe2e18 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x94) returned 0xfe1c70 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x94) returned 0xfe1b38 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe19f8 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe19f8 | out: hHeap=0xfd0000) returned 1 [0142.703] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0xfe1c70, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1b38 | out: hHeap=0xfd0000) returned 1 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x70) returned 0xfdebd8 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x62) returned 0xfd70a0 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x62) returned 0xfe2590 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.703] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xfd70a0, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0142.703] GetProcessHeap () returned 0xfd0000 [0142.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2590 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfd70a0, Size=0xc2) returned 0xfe1b38 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xc2) returned 0xfe19f8 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.704] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xfe1b38, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe19f8 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdebd8 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff3f28 [0142.704] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xff3f28, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff3f28 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x24e) returned 0xff3f28 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xff3f28, Size=0x3cc) returned 0xff3f28 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x96) returned 0xfe2e18 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2e18, Size=0x140) returned 0xfee998 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x6a) returned 0xfdebd8 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef730 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee740 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1c70 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1b38 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee680 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe3c38 | out: hHeap=0xfd0000) returned 1 [0142.704] GetProcessHeap () returned 0xfd0000 [0142.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1d98 | out: hHeap=0xfd0000) returned 1 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef4d0 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef570 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef6b0 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.705] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef570, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef4d0 | out: hHeap=0xfd0000) returned 1 [0142.705] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xeffbbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xeffbbc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0xfe74d8 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee710 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x190) returned 0xfe3c38 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x70) returned 0xfe0490 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x66) returned 0xfd70a0 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.705] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfd70a0, Size=0xca) returned 0xfe1c70 [0142.705] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x184) returned 0xfe1d98 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee6e0 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xfef730 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x250) returned 0xfee740 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xa0) returned 0xfe2e18 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x94) returned 0xfe1b38 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x94) returned 0xfe19f8 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe32e8 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe32e8 | out: hHeap=0xfd0000) returned 1 [0142.706] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0xfe1b38, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe19f8 | out: hHeap=0xfd0000) returned 1 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x70) returned 0xfd70a0 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x62) returned 0xfe2590 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x62) returned 0xfdfdd8 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.706] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xfe2590, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfdfdd8 | out: hHeap=0xfd0000) returned 1 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2590, Size=0xc2) returned 0xfe19f8 [0142.706] GetProcessHeap () returned 0xfd0000 [0142.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xc2) returned 0xfe32e8 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2e18 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2e18 | out: hHeap=0xfd0000) returned 1 [0142.707] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xfe19f8, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe32e8 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfd70a0 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20a) returned 0xff4300 [0142.707] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xff4300, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff4300 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x182) returned 0xff4300 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x24e) returned 0xff4490 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x96) returned 0xfe2e18 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2e18, Size=0x140) returned 0xff46e8 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x6a) returned 0xfd70a0 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef730 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee740 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1b38 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe19f8 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee710 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe3c38 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0142.707] GetProcessHeap () returned 0xfd0000 [0142.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1d98 | out: hHeap=0xfd0000) returned 1 [0142.708] GetProcessHeap () returned 0xfd0000 [0142.708] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x14) returned 0xfe86a0 [0142.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9722ee, lpParameter=0xfe86a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0142.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x97239a, lpParameter=0xeffbf4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0142.709] GetProcessHeap () returned 0xfd0000 [0142.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x14) returned 0xfe8700 [0142.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x972161, lpParameter=0xfe8700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0142.709] GetProcessHeap () returned 0xfd0000 [0142.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x14) returned 0xfe85c0 [0142.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x971a76, lpParameter=0xfe85c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0142.710] GetProcessHeap () returned 0xfd0000 [0142.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x14) returned 0xfe86c0 [0142.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x971cc5, lpParameter=0xfe86c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0142.713] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0xffffffff) returned 0x0 [0193.809] WaitForMultipleObjects (nCount=0x4, lpHandles=0xeffc50*=0x204, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 51 os_tid = 0xd50 Thread: id = 52 os_tid = 0xd54 Thread: id = 81 os_tid = 0xde0 [0142.717] GetProcessHeap () returned 0xfd0000 [0142.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x440) returned 0xff4f00 [0142.717] GetProcessHeap () returned 0xfd0000 [0142.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x30) returned 0xfe3448 [0142.717] GetCurrentProcess () returned 0xffffffff [0142.717] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x2bef850 | out: TokenHandle=0x2bef850*=0x240) returned 1 [0142.717] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2bef848 | out: lpLuid=0x2bef848*(LowPart=0x14, HighPart=0)) returned 1 [0142.722] AdjustTokenPrivileges (in: TokenHandle=0x240, DisableAllPrivileges=0, NewState=0x2bef838*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0142.722] CloseHandle (hObject=0x240) returned 1 [0142.722] GetProcessHeap () returned 0xfd0000 [0142.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe3448 | out: hHeap=0xfd0000) returned 1 [0142.722] GetProcessHeap () returned 0xfd0000 [0142.722] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x434) returned 0xff73d8 [0142.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0142.789] Process32FirstW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.789] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.790] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.790] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.791] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.791] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.792] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.792] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.792] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.793] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0142.793] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0142.794] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.794] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.795] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.795] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.795] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.796] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.796] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.797] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.797] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.797] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.798] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.798] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.799] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.799] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.800] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.800] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.800] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0142.801] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0142.801] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0142.802] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.802] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0142.803] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.803] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0142.804] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.804] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0142.805] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.805] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0142.805] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0142.806] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0142.806] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.807] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0142.808] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0142.808] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0142.808] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.809] Process32NextW (in: hSnapshot=0x28c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0142.809] CloseHandle (hObject=0x28c) returned 1 [0142.809] Sleep (dwMilliseconds=0x1f4) [0143.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0143.634] Process32FirstW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.634] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0143.635] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0143.635] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.636] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0143.636] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.637] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0143.637] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0143.637] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0143.638] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0143.638] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0143.639] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.639] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.640] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0143.640] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.640] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.641] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.641] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.642] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.642] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.642] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.643] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.643] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.644] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.644] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0143.645] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.645] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0143.645] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0143.646] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0143.646] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0143.647] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0143.647] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0143.647] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.648] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0143.648] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0143.649] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0143.649] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0143.650] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0143.650] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0143.651] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0143.651] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0143.651] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0143.652] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0143.652] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0143.653] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.653] Process32NextW (in: hSnapshot=0x348, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0143.654] CloseHandle (hObject=0x348) returned 1 [0143.654] Sleep (dwMilliseconds=0x1f4) [0144.354] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0144.360] Process32FirstW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.360] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.361] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.361] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.361] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.362] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.362] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.362] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.363] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.363] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0144.364] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0144.364] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.364] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.365] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.365] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.365] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.366] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.366] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.367] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.367] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.367] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.368] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.368] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.368] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.369] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.369] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.370] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.370] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0144.370] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0144.371] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0144.371] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0144.372] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0144.372] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.372] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0144.373] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0144.373] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.373] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0144.374] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0144.374] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0144.375] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0144.375] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0144.375] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0144.376] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0144.376] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.376] Process32NextW (in: hSnapshot=0x338, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0144.377] CloseHandle (hObject=0x338) returned 1 [0144.377] Sleep (dwMilliseconds=0x1f4) [0145.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0145.111] Process32FirstW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.112] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.112] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.112] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.113] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.113] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.114] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.114] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.114] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.115] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.115] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.115] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.116] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.116] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.117] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.117] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.117] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.118] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.118] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.118] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.119] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.119] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.120] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.120] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.120] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.121] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.121] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.122] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0145.122] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0145.122] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0145.123] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.123] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.123] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.124] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0145.124] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.125] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.125] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.125] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.126] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.126] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.127] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0145.127] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0145.127] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0145.128] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.128] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0145.129] CloseHandle (hObject=0x358) returned 1 [0145.129] Sleep (dwMilliseconds=0x1f4) [0145.850] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0145.871] Process32FirstW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.871] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.872] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.872] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.872] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.873] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.873] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.874] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.874] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.875] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.875] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.875] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.876] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.876] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.877] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.877] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.877] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.878] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.878] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.879] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.879] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.879] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.880] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.880] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.880] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.881] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.881] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.882] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0145.882] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0145.882] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0145.883] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.883] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.884] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.884] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0145.884] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.885] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.885] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.886] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.886] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.886] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.887] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0145.887] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0145.888] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0145.888] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.888] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0145.889] CloseHandle (hObject=0x36c) returned 1 [0145.889] Sleep (dwMilliseconds=0x1f4) [0146.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0146.574] Process32FirstW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.575] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.575] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.575] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.576] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0146.576] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.577] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0146.577] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0146.586] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0146.590] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0146.598] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0146.602] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.605] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.614] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0146.620] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.621] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.621] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.621] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.622] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.622] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.623] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.623] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.624] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.624] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.624] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0146.625] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.625] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.626] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0146.626] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0146.627] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0146.628] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0146.628] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0146.629] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.630] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0146.630] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0146.631] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0146.632] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0146.632] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0146.633] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0146.634] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0146.634] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0146.635] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0146.635] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0146.636] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.637] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0146.637] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0146.638] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0146.638] CloseHandle (hObject=0x35c) returned 1 [0146.638] Sleep (dwMilliseconds=0x1f4) [0147.337] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0147.353] Process32FirstW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.353] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.354] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.354] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.355] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.355] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.356] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.356] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.357] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.357] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0147.357] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0147.358] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.358] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.359] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.359] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.360] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.360] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.361] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.361] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.361] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.362] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.362] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.363] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.363] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.364] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.364] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.364] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.365] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0147.365] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0147.366] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0147.366] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.367] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0147.367] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.367] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0147.368] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.369] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.369] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0147.369] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0147.370] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0147.370] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0147.371] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0147.371] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0147.372] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0147.372] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.372] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0147.373] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0147.373] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0147.374] CloseHandle (hObject=0x368) returned 1 [0147.374] Sleep (dwMilliseconds=0x1f4) [0148.106] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0148.111] Process32FirstW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.111] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.112] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.112] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.113] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.113] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.113] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.114] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.114] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.115] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.115] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.115] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.116] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.116] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.117] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.117] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.118] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.118] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.119] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.119] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.120] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.120] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.120] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.121] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.121] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0148.122] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.122] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.123] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0148.123] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0148.123] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0148.124] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.124] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0148.125] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.125] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0148.126] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.126] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.126] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0148.127] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0148.127] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0148.128] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0148.128] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0148.129] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0148.129] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0148.129] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.130] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0148.130] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0148.131] Process32NextW (in: hSnapshot=0x35c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0148.131] CloseHandle (hObject=0x35c) returned 1 [0148.131] Sleep (dwMilliseconds=0x1f4) [0148.829] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0148.853] Process32FirstW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.854] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.855] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.855] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.856] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.856] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.856] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.857] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.857] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.858] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.858] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0148.859] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.859] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.859] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.860] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.860] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.861] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.861] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.861] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.862] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.862] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.863] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.863] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.864] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.864] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0148.864] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.865] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.865] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0148.866] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0148.866] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0148.867] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.867] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0148.867] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.868] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0148.869] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0148.869] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.870] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0148.870] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0148.870] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0148.871] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0148.871] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0148.872] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0148.872] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0148.872] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.873] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0148.873] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0148.874] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0148.874] CloseHandle (hObject=0x370) returned 1 [0148.874] Sleep (dwMilliseconds=0x1f4) [0149.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0149.610] Process32FirstW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.610] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.611] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.611] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.612] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.612] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.613] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.613] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.613] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.614] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0149.614] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0149.615] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.615] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.616] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.616] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.616] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.617] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.617] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.618] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.619] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.619] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.619] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.620] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.620] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.621] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.621] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.622] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.622] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0149.622] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0149.623] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0149.623] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0149.624] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0149.624] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.625] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0149.625] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0149.625] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.626] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0149.626] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0149.627] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0149.627] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0149.628] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0149.628] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0149.628] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0149.629] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.629] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0149.630] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0149.630] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0149.631] CloseHandle (hObject=0x360) returned 1 [0149.631] Sleep (dwMilliseconds=0x1f4) [0150.353] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0150.357] Process32FirstW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.358] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.358] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.359] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.359] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.360] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.360] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.361] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.361] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.362] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.362] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.362] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.363] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.363] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.364] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.364] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.365] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.365] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.366] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.366] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.366] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.367] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.367] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.368] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.369] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.369] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.370] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.370] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0150.371] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0150.371] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0150.371] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0150.372] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0150.372] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.373] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0150.373] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0150.374] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.374] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0150.375] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0150.375] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0150.375] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0150.376] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0150.376] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0150.377] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0150.377] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.378] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0150.378] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0150.379] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0150.379] CloseHandle (hObject=0x360) returned 1 [0150.379] Sleep (dwMilliseconds=0x1f4) [0151.170] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0151.174] Process32FirstW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.174] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.175] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.175] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.176] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.176] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.177] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.177] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.177] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.178] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0151.178] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0151.179] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.179] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.180] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.180] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.180] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.181] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.182] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.182] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.182] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.183] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.183] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.184] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.184] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.185] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.185] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.186] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.186] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0151.186] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0151.187] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0151.187] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.188] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0151.188] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.189] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0151.189] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.190] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.190] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0151.191] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0151.191] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0151.191] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0151.192] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0151.192] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0151.193] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0151.193] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.194] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0151.194] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0151.195] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0151.195] CloseHandle (hObject=0x358) returned 1 [0151.195] Sleep (dwMilliseconds=0x1f4) [0151.933] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0151.938] Process32FirstW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.938] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.939] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.939] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.939] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.940] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.940] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.941] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.941] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.941] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0151.942] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0151.942] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.943] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.943] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.944] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.944] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.944] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.945] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.945] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.946] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.946] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.947] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.947] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.948] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.948] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.948] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.949] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.949] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0151.950] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0151.950] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0151.951] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.951] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0151.951] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.952] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0151.952] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.953] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.953] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0151.954] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0151.954] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0151.954] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0151.955] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0151.955] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0151.956] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0151.956] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.956] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0151.957] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0151.957] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0151.958] CloseHandle (hObject=0x360) returned 1 [0151.958] Sleep (dwMilliseconds=0x1f4) [0152.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0152.710] Process32FirstW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.710] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.710] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.711] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.711] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.718] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.721] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.728] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.729] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.729] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.730] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.730] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.731] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.731] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.731] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.732] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.732] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.733] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.733] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.734] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.734] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.734] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.735] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.735] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.736] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.736] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.737] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.737] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0152.737] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0152.738] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0152.738] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.739] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0152.739] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.740] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0152.740] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.740] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.741] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0152.741] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0152.742] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0152.742] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0152.742] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0152.743] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0152.744] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0152.744] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.744] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0152.745] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0152.745] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0152.746] CloseHandle (hObject=0x36c) returned 1 [0152.746] Sleep (dwMilliseconds=0x1f4) [0154.521] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0154.528] Process32FirstW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.529] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.529] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.530] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.530] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.531] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.531] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.532] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.532] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.533] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0154.533] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0154.534] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.534] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.535] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.535] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.535] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.536] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.536] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.537] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.537] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.538] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.538] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.539] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.539] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.539] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0154.540] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.540] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.541] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0154.541] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0154.542] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0154.542] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0154.543] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0154.543] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.544] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0154.544] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0154.545] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0154.545] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0154.545] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0154.546] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0154.546] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0154.547] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0154.547] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0154.548] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0154.548] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.549] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0154.549] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0154.550] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0154.550] CloseHandle (hObject=0x370) returned 1 [0154.550] Sleep (dwMilliseconds=0x1f4) [0155.298] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0155.338] Process32FirstW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.338] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.339] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.339] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.340] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.341] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.341] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.342] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.343] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.343] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.344] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.344] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.345] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.345] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.346] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.346] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.347] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.347] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.348] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.349] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.349] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.350] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.350] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.351] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.352] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.352] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.353] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.354] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0155.354] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0155.355] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0155.356] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.356] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0155.357] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.357] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0155.358] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.358] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.359] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0155.359] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0155.360] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0155.360] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.361] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0155.361] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0155.362] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0155.362] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.363] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0155.363] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0155.364] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0155.365] CloseHandle (hObject=0x344) returned 1 [0155.365] Sleep (dwMilliseconds=0x1f4) [0156.378] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0156.382] Process32FirstW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.382] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.383] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.383] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.384] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.384] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.385] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.385] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.386] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.386] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.387] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.387] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.388] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.388] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.389] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.389] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.389] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.390] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.390] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.391] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.391] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.392] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.392] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.393] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.394] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.394] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.395] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.395] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0156.395] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0156.396] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0156.396] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.397] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0156.397] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.398] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0156.398] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.399] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.399] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0156.400] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0156.400] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0156.401] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0156.401] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0156.402] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0156.402] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0156.402] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.403] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0156.403] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0156.404] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0156.404] CloseHandle (hObject=0x358) returned 1 [0156.404] Sleep (dwMilliseconds=0x1f4) [0157.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0157.186] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.186] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.187] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.187] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.188] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.188] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.188] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.189] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.189] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.190] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.190] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.191] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.191] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.192] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.192] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.193] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.193] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.194] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.194] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.195] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.195] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.196] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.196] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.197] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.197] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.198] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.198] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.199] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0157.199] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0157.200] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0157.200] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.200] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0157.201] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.201] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0157.202] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.202] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0157.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0157.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0157.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.205] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0157.205] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0157.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0157.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0157.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0157.208] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0157.208] CloseHandle (hObject=0x37c) returned 1 [0157.209] Sleep (dwMilliseconds=0x1f4) [0157.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0157.963] Process32FirstW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.964] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.964] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.964] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.965] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.965] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.967] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.968] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.968] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.968] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.969] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.969] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.970] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.970] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.971] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.971] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.972] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.972] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.973] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.973] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.974] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.974] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.975] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.975] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.975] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.976] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.976] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.977] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0157.977] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0157.978] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0157.978] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.979] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0157.979] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.980] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0157.980] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.980] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.981] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0157.981] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0157.982] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0157.982] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.983] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0157.983] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0157.984] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0157.984] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.984] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0157.985] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0157.985] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0157.986] CloseHandle (hObject=0x384) returned 1 [0157.986] Sleep (dwMilliseconds=0x1f4) [0159.826] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0159.832] Process32FirstW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.832] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.833] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.833] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.834] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.834] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.834] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.835] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.835] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.836] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.836] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.837] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.837] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.838] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.838] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.839] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.839] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.839] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.840] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.840] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.841] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.842] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.842] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.842] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.843] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.843] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.844] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.844] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0159.845] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0159.845] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0159.846] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.846] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0159.846] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.847] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0159.847] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.848] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.848] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0159.849] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0159.849] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0159.850] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0159.850] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0159.851] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0159.851] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0159.851] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.852] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0159.852] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0159.853] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0159.853] CloseHandle (hObject=0x368) returned 1 [0159.853] Sleep (dwMilliseconds=0x1f4) [0160.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0160.555] Process32FirstW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.556] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.556] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.557] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.557] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.558] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.558] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.559] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.559] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.560] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.561] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.561] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.562] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.562] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.562] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.563] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.563] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.564] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.564] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.565] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.565] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.566] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.566] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.636] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.644] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.644] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.645] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.645] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0160.645] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0160.646] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0160.646] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.647] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0160.648] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.648] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.649] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.649] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0160.650] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0160.650] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0160.650] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.651] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0160.651] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0160.652] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0160.652] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.653] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0160.653] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0160.654] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0160.654] CloseHandle (hObject=0x388) returned 1 [0160.654] Sleep (dwMilliseconds=0x1f4) [0161.390] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0161.394] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.394] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x70, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.395] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.395] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.396] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.396] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.397] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.398] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.398] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.398] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.399] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.399] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.400] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.400] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.401] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.401] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.402] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.402] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.403] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.403] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.403] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.404] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.404] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.405] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.405] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.406] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.406] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.407] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.407] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0161.407] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0161.408] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.408] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0161.409] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.409] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.410] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.410] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.411] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.411] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.411] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.412] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0161.412] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0161.413] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0161.413] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.414] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0161.414] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0161.414] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0161.415] CloseHandle (hObject=0x37c) returned 1 [0161.415] Sleep (dwMilliseconds=0x1f4) [0162.116] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0162.120] Process32FirstW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.120] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.121] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.121] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.122] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.122] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.125] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.125] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.126] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.126] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.130] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.131] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.131] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.131] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.132] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.132] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.133] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.133] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.133] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.134] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.135] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.135] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.135] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.136] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.136] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.137] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.137] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.137] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.138] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.138] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0162.139] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0162.139] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0162.140] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.140] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.141] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.141] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0162.141] CloseHandle (hObject=0x38c) returned 1 [0162.141] Sleep (dwMilliseconds=0x1f4) [0162.905] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0162.909] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.910] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.910] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.911] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.911] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.912] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.912] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.913] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.913] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.914] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.914] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.914] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.915] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.915] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.916] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.917] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.917] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.918] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.918] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.918] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.919] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.919] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.920] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.920] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.921] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.921] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.922] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.922] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.923] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.923] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.923] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.924] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.924] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.925] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.925] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.926] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.926] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.927] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.927] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.928] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0162.928] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0162.928] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0162.929] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.929] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.930] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0162.930] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0162.931] CloseHandle (hObject=0x37c) returned 1 [0162.931] Sleep (dwMilliseconds=0x1f4) [0163.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0163.844] Process32FirstW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.845] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.845] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.846] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.846] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.846] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.847] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.847] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.848] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.848] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.849] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.849] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.850] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.850] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.851] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.851] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.851] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.852] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.852] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.853] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.854] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.854] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.854] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.855] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.855] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.856] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.856] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.857] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0163.857] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0163.858] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0163.858] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.858] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0163.859] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.859] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.860] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.860] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0163.861] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0163.861] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0163.862] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0163.862] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0163.862] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0163.863] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0163.863] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.864] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0163.864] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0163.865] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0163.865] CloseHandle (hObject=0x394) returned 1 [0163.865] Sleep (dwMilliseconds=0x1f4) [0164.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0164.551] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.551] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.552] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.552] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.553] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.568] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.569] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.569] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.570] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.570] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0164.571] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0164.571] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.572] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.572] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.573] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.573] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.574] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.574] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.575] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.576] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.577] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.577] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.578] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.578] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.579] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.579] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.580] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.580] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0164.581] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0164.581] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0164.582] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.582] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0164.583] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.583] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.584] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.584] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0164.585] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0164.585] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0164.586] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0164.586] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0164.587] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0164.587] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0164.588] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.588] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0164.589] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0164.589] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0164.590] CloseHandle (hObject=0x398) returned 1 [0164.590] Sleep (dwMilliseconds=0x1f4) [0165.213] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0165.274] Process32FirstW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.274] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.275] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.275] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.276] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.276] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.277] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.277] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.278] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.278] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.279] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.279] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.280] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.280] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.281] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.281] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.282] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.282] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.283] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.283] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.284] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.284] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.285] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.285] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.286] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.286] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.287] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.287] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0165.288] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0165.288] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0165.289] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.289] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.290] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.290] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.291] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.291] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0165.292] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0165.292] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0165.293] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.293] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0165.294] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0165.294] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0165.295] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.295] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0165.296] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0165.296] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0165.297] CloseHandle (hObject=0x388) returned 1 [0165.297] Sleep (dwMilliseconds=0x1f4) [0165.961] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0165.976] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.977] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.977] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.978] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.978] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.979] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.979] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.980] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.980] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.981] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.981] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.982] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.982] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.983] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.983] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.984] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.984] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.985] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.986] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.986] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.987] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.987] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.987] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.988] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.988] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.989] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.989] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.990] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0165.990] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0165.991] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0165.991] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.992] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.992] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.993] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.993] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.994] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0165.994] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0165.995] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0165.995] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0165.996] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0165.996] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0165.997] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0165.997] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.998] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0165.998] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0165.999] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0165.999] CloseHandle (hObject=0x398) returned 1 [0166.000] Sleep (dwMilliseconds=0x1f4) [0166.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0166.721] Process32FirstW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.721] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.721] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.722] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.722] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.723] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.724] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.724] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.725] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.725] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.725] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.726] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.726] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.727] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.728] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.728] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.728] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.729] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.729] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.730] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.730] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.731] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.731] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.732] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.733] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.733] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.734] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.734] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0166.735] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0166.735] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0166.736] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.736] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0166.737] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.737] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.738] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.738] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0166.739] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0166.739] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0166.739] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.740] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0166.740] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0166.741] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0166.741] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.742] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0166.742] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0166.743] Process32NextW (in: hSnapshot=0x38c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0166.743] CloseHandle (hObject=0x38c) returned 1 [0166.743] Sleep (dwMilliseconds=0x1f4) [0167.455] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0167.460] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.460] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.461] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.461] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.462] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.462] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.463] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.463] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.464] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.464] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.465] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.465] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.466] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.468] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.468] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.469] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.469] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.469] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.470] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.471] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.471] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.471] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.472] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.472] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.473] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.473] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.474] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.474] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0167.475] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0167.475] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0167.476] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.476] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0167.477] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.477] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.478] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.478] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0167.479] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0167.479] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0167.480] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.480] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0167.481] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0167.481] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0167.482] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.483] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0167.484] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0167.484] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0167.485] CloseHandle (hObject=0x398) returned 1 [0167.485] Sleep (dwMilliseconds=0x1f4) [0168.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0168.194] Process32FirstW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.194] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.195] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.196] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.196] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.196] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.197] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.197] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.198] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.198] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.199] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.199] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.200] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.200] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.201] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.201] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.202] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.202] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.203] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.203] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.204] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.204] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.205] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.205] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.206] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.206] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.207] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.207] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0168.208] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0168.208] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0168.209] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.209] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0168.210] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.210] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.211] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.211] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0168.212] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0168.213] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0168.213] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.214] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0168.214] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0168.215] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0168.215] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.216] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.216] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.217] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0168.217] CloseHandle (hObject=0x384) returned 1 [0168.217] Sleep (dwMilliseconds=0x1f4) [0168.898] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0168.902] Process32FirstW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.903] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.903] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.904] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.904] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.905] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.905] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.906] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.906] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.907] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.907] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.908] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.908] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.909] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.909] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.910] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.910] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.911] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.911] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.912] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.912] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.913] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.913] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.914] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.914] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.915] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.916] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.916] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0168.917] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0168.917] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0168.918] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.918] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0168.918] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.919] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.919] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.920] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0168.920] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0168.921] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0168.922] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.922] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0168.923] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0168.923] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0168.924] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.924] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.925] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.925] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0168.926] CloseHandle (hObject=0x360) returned 1 [0168.926] Sleep (dwMilliseconds=0x1f4) [0169.596] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0169.604] Process32FirstW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.604] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.605] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.605] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.606] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.606] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.606] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.607] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.607] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.608] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.611] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.612] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.612] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.612] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.613] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.613] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.614] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.614] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.615] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.615] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.615] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.616] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.616] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.617] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.617] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.617] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.618] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.618] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0169.619] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0169.619] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0169.620] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.620] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0169.621] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.621] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.622] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.622] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0169.623] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0169.623] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0169.624] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.624] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0169.624] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0169.625] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0169.625] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0169.626] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0169.626] Process32NextW (in: hSnapshot=0x358, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0169.627] CloseHandle (hObject=0x358) returned 1 [0169.627] Sleep (dwMilliseconds=0x1f4) [0170.248] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0170.253] Process32FirstW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.253] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.254] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.254] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.254] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.255] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.255] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.256] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.256] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.257] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.282] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.282] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.299] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.299] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.299] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.300] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.300] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.301] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.301] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.302] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.302] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.302] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.303] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.303] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.304] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.304] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.304] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.305] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.305] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.306] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.306] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.307] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.307] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.308] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.308] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.309] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.309] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.310] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.310] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.310] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0170.311] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0170.311] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0170.312] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0170.312] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0170.312] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0170.313] CloseHandle (hObject=0x360) returned 1 [0170.313] Sleep (dwMilliseconds=0x1f4) [0170.942] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0170.957] Process32FirstW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.957] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.958] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.958] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.959] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.959] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.960] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.960] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.961] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.961] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.962] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.962] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.962] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.963] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.963] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.964] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.964] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.965] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.965] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.965] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.966] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.966] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.967] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.967] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.968] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.968] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.969] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.969] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.969] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.970] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.970] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.971] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.971] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.972] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.972] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.973] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.973] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.973] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.974] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.974] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0170.975] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0170.975] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0170.976] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0170.976] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0170.976] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0170.977] CloseHandle (hObject=0x370) returned 1 [0170.977] Sleep (dwMilliseconds=0x1f4) [0171.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0171.636] Process32FirstW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.636] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.636] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.637] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.637] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.638] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.638] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.639] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.639] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.640] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.640] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.641] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.641] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.641] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.642] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.642] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.643] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.643] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.644] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.644] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.645] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.645] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.646] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.646] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.646] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.647] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.647] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.648] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0171.648] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0171.649] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0171.651] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.651] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0171.652] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.652] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.653] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.653] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0171.654] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0171.654] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0171.655] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.655] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0171.656] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0171.656] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0171.657] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0171.657] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0171.658] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0171.658] CloseHandle (hObject=0x36c) returned 1 [0171.658] Sleep (dwMilliseconds=0x1f4) [0172.314] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0172.318] Process32FirstW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.319] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.319] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.320] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.320] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.321] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.321] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.322] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.322] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.322] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.323] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.323] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.324] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.324] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.324] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.325] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.326] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.326] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.326] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.327] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.327] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.328] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.328] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.329] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.329] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.330] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.330] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.331] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0172.331] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0172.331] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0172.332] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.332] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0172.333] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.333] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.334] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.334] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0172.335] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0172.335] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0172.335] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0172.336] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0172.336] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0172.337] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0172.337] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0172.338] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0172.338] Process32NextW (in: hSnapshot=0x36c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0172.339] CloseHandle (hObject=0x36c) returned 1 [0172.339] Sleep (dwMilliseconds=0x1f4) [0172.955] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0172.959] Process32FirstW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.960] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.960] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.961] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.961] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.962] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.962] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.963] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.963] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.964] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.964] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.964] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.965] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.965] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.966] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.967] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.967] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.968] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.968] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.969] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.969] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.970] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.970] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.970] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.971] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.971] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.972] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.972] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0172.973] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0172.973] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0172.974] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.974] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0172.975] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.975] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.976] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.976] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0172.977] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0172.977] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0172.978] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0172.978] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0172.978] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0172.979] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0172.979] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0172.980] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0172.980] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0172.981] CloseHandle (hObject=0x394) returned 1 [0172.981] Sleep (dwMilliseconds=0x1f4) [0173.708] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0173.715] Process32FirstW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.715] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.716] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.716] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.717] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.717] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.718] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.718] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.719] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.720] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.720] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.721] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.721] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.721] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.722] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.722] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.723] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.724] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.724] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.725] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.725] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.726] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.726] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.727] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.727] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.728] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.728] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.729] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0173.729] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0173.730] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0173.730] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.731] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0173.731] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.732] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.732] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.733] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0173.734] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0173.734] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0173.735] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.735] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0173.736] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0173.736] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0173.737] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0173.737] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0173.738] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0173.738] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0173.739] CloseHandle (hObject=0x25c) returned 1 [0173.739] Sleep (dwMilliseconds=0x1f4) [0174.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0174.417] Process32FirstW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.418] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.419] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.419] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.420] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.420] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.421] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.421] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.422] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.422] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.423] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.423] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.424] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.424] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.425] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.425] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.426] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.426] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.427] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.427] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.428] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.428] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.429] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.429] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.430] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.430] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.431] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.431] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0174.432] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0174.433] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0174.433] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.433] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0174.434] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.434] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.435] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.435] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0174.436] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0174.436] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0174.437] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0174.438] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0174.438] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0174.439] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0174.439] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0174.440] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0174.440] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0174.441] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0174.441] CloseHandle (hObject=0x394) returned 1 [0174.441] Sleep (dwMilliseconds=0x1f4) [0175.141] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0175.175] Process32FirstW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.176] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.176] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.177] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.177] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.178] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.178] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.179] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.179] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.180] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.180] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.181] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.181] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.182] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.182] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.183] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.183] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.184] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.184] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.185] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.185] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.186] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.186] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.187] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.187] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.188] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.188] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.189] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.189] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.190] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.190] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.191] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.191] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.192] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.192] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.193] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.193] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.194] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.194] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.195] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0175.195] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0175.196] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0175.196] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0175.197] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0175.197] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0175.198] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0175.198] CloseHandle (hObject=0x25c) returned 1 [0175.198] Sleep (dwMilliseconds=0x1f4) [0175.812] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0175.817] Process32FirstW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.818] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.818] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.819] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.819] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.820] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.820] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.821] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.821] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.822] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.822] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.823] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.823] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.824] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.824] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.825] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.825] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.826] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.826] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.827] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.827] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.828] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.828] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.829] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.829] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.830] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.830] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.831] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.831] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.832] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.832] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.832] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.833] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.834] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.834] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.834] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.835] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.835] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.836] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.836] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0175.837] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0175.838] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0175.838] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0175.839] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0175.839] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0175.840] Process32NextW (in: hSnapshot=0x394, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0175.840] CloseHandle (hObject=0x394) returned 1 [0175.840] Sleep (dwMilliseconds=0x1f4) [0176.703] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0176.707] Process32FirstW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.708] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0176.709] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0176.709] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.710] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0176.710] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.711] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0176.711] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0176.712] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0176.712] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0176.713] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0176.713] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.714] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.714] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0176.715] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.715] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.716] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.716] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.717] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.717] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.718] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.718] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.719] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.719] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.720] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0176.720] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.721] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0176.721] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0176.722] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0176.722] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0176.723] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0176.723] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0176.724] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.724] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0176.725] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0176.725] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0176.726] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0176.726] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0176.727] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0176.727] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0176.728] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0176.728] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0176.728] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0176.729] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0176.730] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0176.730] Process32NextW (in: hSnapshot=0x388, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0176.731] CloseHandle (hObject=0x388) returned 1 [0176.731] Sleep (dwMilliseconds=0x1f4) [0177.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0177.348] Process32FirstW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.365] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.366] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.366] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.366] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.367] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.367] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.368] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.368] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.369] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.369] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.370] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.370] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.371] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.372] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.372] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.372] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.387] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.388] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.388] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.389] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.390] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.390] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.391] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.391] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.392] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.392] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.393] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0177.393] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.394] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.394] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.395] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.395] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.396] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.396] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.448] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.448] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.449] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.449] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.450] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0177.450] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0177.451] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0177.452] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.452] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.453] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0177.453] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0177.454] CloseHandle (hObject=0x370) returned 1 [0177.454] Sleep (dwMilliseconds=0x1f4) [0178.081] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0178.097] Process32FirstW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.098] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.098] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.099] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.099] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.100] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.100] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.101] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.101] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.102] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.103] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.113] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.113] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.114] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.115] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.116] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.116] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.117] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.118] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.118] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.119] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.119] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.120] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.120] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.121] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.121] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.122] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.122] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0178.123] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0178.124] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0178.124] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.125] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0178.126] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.126] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.127] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.127] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0178.128] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0178.128] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0178.129] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.129] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0178.130] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0178.131] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0178.131] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0178.132] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0178.132] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0178.132] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0178.133] CloseHandle (hObject=0x384) returned 1 [0178.133] Sleep (dwMilliseconds=0x1f4) [0178.731] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0178.739] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.740] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.740] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.741] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.741] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.742] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.742] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.743] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.743] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.744] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.745] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.746] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.746] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.747] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.747] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.748] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.749] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.749] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.749] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.750] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.751] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.751] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.752] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.752] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.753] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.753] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.754] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.755] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0178.755] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0178.756] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0178.756] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.757] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0178.757] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.758] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.758] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.759] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0178.759] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0178.760] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0178.760] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.761] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0178.761] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0178.762] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0178.763] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0178.763] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0178.763] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0178.764] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0178.765] CloseHandle (hObject=0x37c) returned 1 [0178.765] Sleep (dwMilliseconds=0x1f4) [0179.292] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0179.500] Process32FirstW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.501] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0179.501] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0179.502] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.502] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0179.503] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.503] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0179.504] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0179.504] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0179.505] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.506] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.506] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.507] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.508] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0179.508] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.509] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.509] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.510] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.510] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.511] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.511] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.512] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.512] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.512] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.513] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0179.514] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.514] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0179.515] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0179.515] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0179.516] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0179.516] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0179.517] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0179.518] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.518] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0179.519] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.519] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0179.520] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0179.520] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0179.521] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0179.521] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0179.522] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0179.522] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0179.523] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0179.523] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0179.524] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0179.524] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0179.525] CloseHandle (hObject=0x384) returned 1 [0179.525] Sleep (dwMilliseconds=0x1f4) [0180.414] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0180.431] Process32FirstW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.432] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.432] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.433] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.433] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.434] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.434] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.435] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.435] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.436] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.436] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.437] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.438] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.438] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.438] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.439] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.439] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.440] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.441] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.442] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.442] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.443] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.443] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.444] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.444] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.445] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.445] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.446] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0180.446] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0180.447] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0180.448] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0180.448] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0180.449] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.449] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0180.450] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0180.450] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0180.451] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0180.451] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0180.452] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0180.452] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0180.453] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0180.453] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0180.454] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0180.454] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0180.455] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0180.456] Process32NextW (in: hSnapshot=0x384, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0180.456] CloseHandle (hObject=0x384) returned 1 [0180.456] Sleep (dwMilliseconds=0x1f4) [0181.039] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0181.045] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.045] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.046] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.047] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.047] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.048] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.048] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.049] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.049] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.050] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.050] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.051] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.051] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.052] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.052] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.053] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.053] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.054] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.054] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.055] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.055] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.056] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.056] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.057] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.057] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.058] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.058] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.059] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0181.059] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0181.060] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0181.060] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.061] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0181.061] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.062] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.062] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.063] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0181.063] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0181.064] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0181.065] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0181.065] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0181.066] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0181.066] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0181.066] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0181.067] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0181.067] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0181.068] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0181.068] CloseHandle (hObject=0x37c) returned 1 [0181.068] Sleep (dwMilliseconds=0x1f4) [0181.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0181.646] Process32FirstW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.646] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.647] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.647] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.647] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.648] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.648] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.649] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.649] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.650] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.650] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.651] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.651] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.652] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.652] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.653] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.655] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.655] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.656] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.656] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.657] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.657] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.658] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.659] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.660] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.660] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.661] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.661] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0181.662] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0181.662] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0181.663] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.663] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0181.664] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.664] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.665] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.665] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0181.666] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0181.666] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0181.667] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0181.667] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0181.668] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0181.668] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0181.669] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0181.669] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0181.670] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0181.670] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0181.671] CloseHandle (hObject=0x370) returned 1 [0181.671] Sleep (dwMilliseconds=0x1f4) [0182.307] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0182.314] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.315] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.315] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.316] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.316] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.317] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.317] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.318] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.318] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.319] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.319] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.320] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.320] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.321] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.321] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.322] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.322] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.323] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.323] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.324] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.324] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.324] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.325] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.325] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.326] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.326] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.327] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.327] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.328] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.328] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.329] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.329] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.330] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.330] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.331] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.331] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.332] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.332] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.333] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.333] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0182.334] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0182.334] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0182.335] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.335] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.335] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.336] Process32NextW (in: hSnapshot=0x37c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0182.336] CloseHandle (hObject=0x37c) returned 1 [0182.336] Sleep (dwMilliseconds=0x1f4) [0182.961] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0182.974] Process32FirstW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.975] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.975] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.976] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.976] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.977] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.977] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.977] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.978] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.978] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.979] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.979] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.979] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.980] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.980] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.981] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.981] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.982] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.982] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.982] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.983] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.983] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.984] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.984] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.985] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.985] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.985] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.986] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.986] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.987] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.987] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.988] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.989] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.989] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.989] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.990] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.990] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.991] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.991] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.992] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0182.992] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0182.992] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0182.993] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.993] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.994] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.994] Process32NextW (in: hSnapshot=0x360, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0182.995] CloseHandle (hObject=0x360) returned 1 [0182.995] Sleep (dwMilliseconds=0x1f4) [0183.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0183.576] Process32FirstW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.576] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.576] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.577] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.577] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.578] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.578] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.579] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.579] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.580] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.580] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.581] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.581] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.582] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.582] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.583] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.583] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.584] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.584] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.584] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.585] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.585] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.586] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.586] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.586] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.587] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.587] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.588] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0183.588] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0183.589] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0183.589] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.590] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0183.590] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.590] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.591] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.591] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0183.592] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0183.592] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0183.593] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.593] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0183.593] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0183.594] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0183.594] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0183.595] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0183.595] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0183.596] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0183.596] CloseHandle (hObject=0x39c) returned 1 [0183.596] Sleep (dwMilliseconds=0x1f4) [0184.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0184.331] Process32FirstW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.331] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.332] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.332] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.333] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.333] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.334] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.334] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.335] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.335] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.336] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.336] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.336] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.337] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.337] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.338] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.338] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.339] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.339] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.340] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.340] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.340] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.341] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.341] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.342] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.342] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.343] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.343] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0184.344] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0184.344] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0184.344] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0184.345] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0184.345] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.346] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0184.346] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.347] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0184.347] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0184.348] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0184.348] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0184.348] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0184.349] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0184.349] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0184.350] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0184.350] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0184.351] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0184.351] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0184.351] CloseHandle (hObject=0x25c) returned 1 [0184.352] Sleep (dwMilliseconds=0x1f4) [0185.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0185.093] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.093] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.094] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.094] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.095] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.095] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.096] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.096] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.096] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.097] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.097] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.098] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.098] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.099] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.099] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.100] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.100] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.100] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.101] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.101] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.102] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.102] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.102] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.103] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.121] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.121] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.122] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.122] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0185.122] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0185.123] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0185.123] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.124] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0185.124] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.125] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.125] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.126] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0185.126] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0185.126] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0185.127] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0185.127] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0185.128] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0185.128] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0185.129] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.129] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.130] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.130] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0185.130] CloseHandle (hObject=0x398) returned 1 [0185.130] Sleep (dwMilliseconds=0x1f4) [0185.720] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0185.761] Process32FirstW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.762] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.762] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.762] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.763] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.764] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.764] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.764] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.765] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.765] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.766] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.766] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.767] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.767] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.768] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.768] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.769] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.769] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.769] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.770] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.770] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.771] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.771] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.772] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.772] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.772] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.773] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.773] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0185.774] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0185.774] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0185.774] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.775] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0185.776] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.776] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.776] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.777] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0185.777] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0185.778] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0185.778] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0185.779] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0185.779] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0185.780] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0185.780] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.780] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.781] Process32NextW (in: hSnapshot=0x39c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0185.781] CloseHandle (hObject=0x39c) returned 1 [0185.781] Sleep (dwMilliseconds=0x1f4) [0186.572] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0186.605] Process32FirstW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.605] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.606] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.606] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.607] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.607] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.608] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.608] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.608] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.609] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.609] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.610] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.610] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.611] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.611] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.611] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.612] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.612] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.613] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.613] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.614] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.614] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.615] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.615] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.616] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.616] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.617] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.617] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0186.618] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0186.618] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0186.619] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0186.619] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0186.620] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.620] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0186.620] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.621] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0186.621] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0186.622] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0186.622] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0186.623] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0186.623] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0186.623] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0186.624] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.624] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0186.625] Process32NextW (in: hSnapshot=0x368, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0186.625] CloseHandle (hObject=0x368) returned 1 [0186.625] Sleep (dwMilliseconds=0x1f4) [0187.313] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0187.321] Process32FirstW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.322] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.322] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.323] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.323] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.324] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.324] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.325] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.325] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.326] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.326] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.327] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.327] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.327] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.328] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.328] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.329] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.329] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.330] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.330] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.332] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.333] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.333] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.334] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.334] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.335] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.335] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.336] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0187.336] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0187.337] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0187.337] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.337] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0187.338] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.338] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.339] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.339] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0187.340] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0187.340] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0187.341] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0187.341] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0187.341] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0187.342] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0187.342] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0187.343] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0187.343] Process32NextW (in: hSnapshot=0x370, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0187.344] CloseHandle (hObject=0x370) returned 1 [0187.344] Sleep (dwMilliseconds=0x1f4) [0188.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0188.031] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.031] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.032] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.032] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.032] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.033] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.033] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.037] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.038] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.038] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.039] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.039] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.039] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.040] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.040] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.041] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.041] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.042] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.042] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.043] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.043] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.044] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.047] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.047] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.048] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.048] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.049] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.049] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0188.050] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0188.050] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0188.051] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.051] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0188.052] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.052] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.053] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.053] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0188.053] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0188.054] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0188.054] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0188.055] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0188.055] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0188.056] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0188.056] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.057] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.057] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0188.057] CloseHandle (hObject=0x398) returned 1 [0188.058] Sleep (dwMilliseconds=0x1f4) [0188.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0188.685] Process32FirstW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.686] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.686] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.687] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.687] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.688] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.688] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.688] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.689] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.690] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.690] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.691] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.692] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.692] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.693] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.693] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.693] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.694] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.694] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.695] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.695] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.696] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.696] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.697] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.697] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.697] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.698] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.698] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0188.699] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0188.699] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0188.700] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.700] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0188.701] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.701] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.702] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.702] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0188.703] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0188.703] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0188.704] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0188.704] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0188.705] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0188.705] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0188.705] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.706] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.706] Process32NextW (in: hSnapshot=0x390, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0188.707] CloseHandle (hObject=0x390) returned 1 [0188.707] Sleep (dwMilliseconds=0x1f4) [0189.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0189.228] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.228] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.229] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.230] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.230] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.231] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.233] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.234] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.234] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.235] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.235] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.236] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.236] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.237] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.237] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.238] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.238] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.239] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.239] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.240] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.240] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.241] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.241] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.242] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.242] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.243] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.243] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.244] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0189.244] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0189.245] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0189.246] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.246] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0189.246] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.247] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.247] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.248] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0189.248] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0189.249] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0189.249] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0189.250] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0189.250] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0189.251] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0189.251] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.252] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.252] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.253] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0189.253] CloseHandle (hObject=0x398) returned 1 [0189.253] Sleep (dwMilliseconds=0x1f4) [0189.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0189.808] Process32FirstW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.808] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.809] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.809] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.809] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.810] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.810] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.810] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.811] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.811] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.812] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.812] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.813] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.813] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.813] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.814] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.815] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.815] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.815] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.816] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.816] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.817] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.817] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.817] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.818] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.818] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.819] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.819] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0189.819] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0189.820] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0189.844] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.845] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0189.845] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.851] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.851] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.852] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0189.852] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0189.853] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0189.853] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0189.853] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0189.854] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0189.854] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0189.855] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.855] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.855] Process32NextW (in: hSnapshot=0x25c, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0189.856] CloseHandle (hObject=0x25c) returned 1 [0189.856] Sleep (dwMilliseconds=0x1f4) [0190.403] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0190.407] Process32FirstW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.407] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.408] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.408] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.409] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.409] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.410] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.410] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.410] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.411] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.411] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.412] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.412] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.413] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.413] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.414] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.414] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.415] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.415] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.415] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.416] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.416] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.417] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.417] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.418] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.418] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.419] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.419] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0190.419] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0190.420] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0190.420] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.421] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0190.421] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.422] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.422] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.423] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0190.423] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0190.423] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0190.424] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0190.424] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0190.425] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0190.425] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0190.426] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.426] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.427] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0190.427] Process32NextW (in: hSnapshot=0x344, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0 [0190.427] CloseHandle (hObject=0x344) returned 1 [0190.428] Sleep (dwMilliseconds=0x1f4) [0191.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0191.162] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.163] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.163] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.163] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.164] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.164] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.165] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.165] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.166] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.166] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.167] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.167] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.168] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.168] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.169] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.169] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.170] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.170] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.170] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.171] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.171] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.172] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.172] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.173] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.173] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.174] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.174] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.175] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0191.175] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0191.175] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0191.176] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x194, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.176] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0191.177] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.177] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.178] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.178] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0191.179] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0191.179] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0191.180] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.180] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.181] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.181] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.181] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.182] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.182] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.183] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.183] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0 [0191.184] CloseHandle (hObject=0x3a0) returned 1 [0191.184] Sleep (dwMilliseconds=0x1f4) [0192.017] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0192.021] Process32FirstW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.021] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.022] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.022] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.022] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.023] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.023] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.024] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.024] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.024] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.026] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.027] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.027] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.028] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.028] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.029] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.029] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.029] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.030] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.030] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.031] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.031] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.031] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.032] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.032] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.033] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.033] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.034] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.034] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.035] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.035] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.036] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.036] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.037] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.037] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.037] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.038] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.038] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.039] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.039] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.040] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.040] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.040] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.041] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.041] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.042] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.042] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.043] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.043] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.043] Process32NextW (in: hSnapshot=0x398, lppe=0x2bef624 | out: lppe=0x2bef624*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0192.044] CloseHandle (hObject=0x398) returned 1 [0192.044] Sleep (dwMilliseconds=0x1f4) [0193.013] GetProcessHeap () returned 0xfd0000 [0193.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff73d8 | out: hHeap=0xfd0000) returned 1 [0193.013] GetProcessHeap () returned 0xfd0000 [0193.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff4f00 | out: hHeap=0xfd0000) returned 1 [0193.013] GetProcessHeap () returned 0xfd0000 [0193.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe86a0 | out: hHeap=0xfd0000) returned 1 Thread: id = 82 os_tid = 0xde4 [0142.729] GetVersion () returned 0x23f00206 [0142.729] GetCurrentProcess () returned 0xffffffff [0142.729] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2d5fafc | out: TokenHandle=0x2d5fafc*=0x240) returned 1 [0142.729] GetTokenInformation (in: TokenHandle=0x240, TokenInformationClass=0x14, TokenInformation=0x2d5faf4, TokenInformationLength=0x4, ReturnLength=0x2d5faf8 | out: TokenInformation=0x2d5faf4, ReturnLength=0x2d5faf8) returned 1 [0142.729] CloseHandle (hObject=0x240) returned 1 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef458 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef660 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef520 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe1b38 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1b38 | out: hHeap=0xfd0000) returned 1 [0142.729] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef660, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef520 | out: hHeap=0xfd0000) returned 1 [0142.729] GetProcessHeap () returned 0xfd0000 [0142.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef458 | out: hHeap=0xfd0000) returned 1 [0142.729] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.730] GetProcessHeap () returned 0xfd0000 [0142.730] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef660 | out: hHeap=0xfd0000) returned 1 [0142.730] GetProcessHeap () returned 0xfd0000 [0142.730] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0xfe27a0 [0142.730] GetProcessHeap () returned 0xfd0000 [0142.730] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0xfe2950 [0142.730] GetProcessHeap () returned 0xfd0000 [0142.730] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2950, Size=0x72) returned 0xfe2590 [0142.730] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0142.730] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x240 [0142.730] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x0 [0142.730] GetProcessHeap () returned 0xfd0000 [0142.730] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe27a0 | out: hHeap=0xfd0000) returned 1 [0142.730] GetProcessHeap () returned 0xfd0000 [0142.730] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2590 | out: hHeap=0xfd0000) returned 1 [0142.730] ReleaseMutex (hMutex=0x240) returned 1 [0142.730] CloseHandle (hObject=0x240) returned 1 [0142.730] Sleep (dwMilliseconds=0x3e8) [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef3e0 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef070 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0143.901] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0143.901] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0143.901] GetProcessHeap () returned 0xfd0000 [0143.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010e40 [0143.902] GetProcessHeap () returned 0xfd0000 [0143.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010a98 [0143.902] GetProcessHeap () returned 0xfd0000 [0143.902] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010a98, Size=0x72) returned 0x1012798 [0143.902] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0143.902] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x35c [0143.902] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x0 [0143.902] GetProcessHeap () returned 0xfd0000 [0143.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010e40 | out: hHeap=0xfd0000) returned 1 [0143.902] GetProcessHeap () returned 0xfd0000 [0143.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012798 | out: hHeap=0xfd0000) returned 1 [0143.902] ReleaseMutex (hMutex=0x35c) returned 1 [0143.902] CloseHandle (hObject=0x35c) returned 1 [0143.902] Sleep (dwMilliseconds=0x3e8) [0145.166] GetProcessHeap () returned 0xfd0000 [0145.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef160 [0145.166] GetProcessHeap () returned 0xfd0000 [0145.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef368 [0145.166] GetProcessHeap () returned 0xfd0000 [0145.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef020 [0145.166] GetProcessHeap () returned 0xfd0000 [0145.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0145.166] GetProcessHeap () returned 0xfd0000 [0145.166] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0145.167] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef368, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0145.167] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef368 | out: hHeap=0xfd0000) returned 1 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010c90 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10111e8 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10111e8, Size=0x72) returned 0x1011c98 [0145.167] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0145.167] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x358 [0145.167] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x0 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010c90 | out: hHeap=0xfd0000) returned 1 [0145.167] GetProcessHeap () returned 0xfd0000 [0145.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011c98 | out: hHeap=0xfd0000) returned 1 [0145.167] ReleaseMutex (hMutex=0x358) returned 1 [0145.167] CloseHandle (hObject=0x358) returned 1 [0145.168] Sleep (dwMilliseconds=0x3e8) [0146.524] GetProcessHeap () returned 0xfd0000 [0146.524] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef160 [0146.524] GetProcessHeap () returned 0xfd0000 [0146.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef1b0 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef1d8 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xff6100 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff6100 | out: hHeap=0xfd0000) returned 1 [0146.525] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef1b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0146.525] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1b0 | out: hHeap=0xfd0000) returned 1 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010d20 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010e88 [0146.525] GetProcessHeap () returned 0xfd0000 [0146.526] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010e88, Size=0x72) returned 0x1012518 [0146.526] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0146.526] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x35c [0146.526] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x0 [0146.526] GetProcessHeap () returned 0xfd0000 [0146.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010d20 | out: hHeap=0xfd0000) returned 1 [0146.526] GetProcessHeap () returned 0xfd0000 [0146.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012518 | out: hHeap=0xfd0000) returned 1 [0146.526] ReleaseMutex (hMutex=0x35c) returned 1 [0146.526] CloseHandle (hObject=0x35c) returned 1 [0146.526] Sleep (dwMilliseconds=0x3e8) [0147.713] GetProcessHeap () returned 0xfd0000 [0147.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef020 [0147.713] GetProcessHeap () returned 0xfd0000 [0147.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef048 [0147.713] GetProcessHeap () returned 0xfd0000 [0147.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef070 [0147.713] GetProcessHeap () returned 0xfd0000 [0147.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0147.713] GetProcessHeap () returned 0xfd0000 [0147.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0147.713] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef048, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0147.713] GetProcessHeap () returned 0xfd0000 [0147.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0147.714] GetProcessHeap () returned 0xfd0000 [0147.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0147.714] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.715] GetProcessHeap () returned 0xfd0000 [0147.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0147.715] GetProcessHeap () returned 0xfd0000 [0147.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010a98 [0147.715] GetProcessHeap () returned 0xfd0000 [0147.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010f60 [0147.715] GetProcessHeap () returned 0xfd0000 [0147.715] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010f60, Size=0x72) returned 0x1012898 [0147.715] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0147.715] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x360 [0147.715] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x0 [0147.715] GetProcessHeap () returned 0xfd0000 [0147.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010a98 | out: hHeap=0xfd0000) returned 1 [0147.715] GetProcessHeap () returned 0xfd0000 [0147.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012898 | out: hHeap=0xfd0000) returned 1 [0147.715] ReleaseMutex (hMutex=0x360) returned 1 [0147.715] CloseHandle (hObject=0x360) returned 1 [0147.716] Sleep (dwMilliseconds=0x3e8) [0148.963] GetProcessHeap () returned 0xfd0000 [0148.963] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef0c0 [0148.963] GetProcessHeap () returned 0xfd0000 [0148.963] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef430 [0148.963] GetProcessHeap () returned 0xfd0000 [0148.963] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef2c8 [0148.963] GetProcessHeap () returned 0xfd0000 [0148.963] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xff6100 [0148.963] GetProcessHeap () returned 0xfd0000 [0148.963] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff6100 | out: hHeap=0xfd0000) returned 1 [0148.963] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef430, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0148.963] GetProcessHeap () returned 0xfd0000 [0148.964] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2c8 | out: hHeap=0xfd0000) returned 1 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0148.964] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef430 | out: hHeap=0xfd0000) returned 1 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010fa8 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10111e8 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10111e8, Size=0x72) returned 0x1011e98 [0148.964] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0148.964] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x370 [0148.964] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x0 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010fa8 | out: hHeap=0xfd0000) returned 1 [0148.964] GetProcessHeap () returned 0xfd0000 [0148.964] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011e98 | out: hHeap=0xfd0000) returned 1 [0148.964] ReleaseMutex (hMutex=0x370) returned 1 [0148.965] CloseHandle (hObject=0x370) returned 1 [0148.965] Sleep (dwMilliseconds=0x3e8) [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef020 [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef048 [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef070 [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0150.227] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef048, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0150.227] GetProcessHeap () returned 0xfd0000 [0150.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0150.227] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0150.228] GetProcessHeap () returned 0xfd0000 [0150.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0150.228] GetProcessHeap () returned 0xfd0000 [0150.228] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010d20 [0150.228] GetProcessHeap () returned 0xfd0000 [0150.228] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010b28 [0150.228] GetProcessHeap () returned 0xfd0000 [0150.228] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010b28, Size=0x72) returned 0x1012898 [0150.228] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0150.228] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x368 [0150.228] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x0 [0150.228] GetProcessHeap () returned 0xfd0000 [0150.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010d20 | out: hHeap=0xfd0000) returned 1 [0150.228] GetProcessHeap () returned 0xfd0000 [0150.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012898 | out: hHeap=0xfd0000) returned 1 [0150.228] ReleaseMutex (hMutex=0x368) returned 1 [0150.229] CloseHandle (hObject=0x368) returned 1 [0150.229] Sleep (dwMilliseconds=0x3e8) [0151.435] GetProcessHeap () returned 0xfd0000 [0151.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef020 [0151.445] GetProcessHeap () returned 0xfd0000 [0151.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef160 [0151.445] GetProcessHeap () returned 0xfd0000 [0151.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef340 [0151.445] GetProcessHeap () returned 0xfd0000 [0151.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe0280 [0151.445] GetProcessHeap () returned 0xfd0000 [0151.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0280 | out: hHeap=0xfd0000) returned 1 [0151.445] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef160, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0151.445] GetProcessHeap () returned 0xfd0000 [0151.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0151.445] GetProcessHeap () returned 0xfd0000 [0151.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0151.445] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.470] GetProcessHeap () returned 0xfd0000 [0151.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0151.470] GetProcessHeap () returned 0xfd0000 [0151.470] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010e88 [0151.470] GetProcessHeap () returned 0xfd0000 [0151.470] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10112c0 [0151.470] GetProcessHeap () returned 0xfd0000 [0151.470] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10112c0, Size=0x72) returned 0x1011a98 [0151.470] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0151.470] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x368 [0151.470] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x0 [0151.470] GetProcessHeap () returned 0xfd0000 [0151.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010e88 | out: hHeap=0xfd0000) returned 1 [0151.470] GetProcessHeap () returned 0xfd0000 [0151.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011a98 | out: hHeap=0xfd0000) returned 1 [0151.470] ReleaseMutex (hMutex=0x368) returned 1 [0151.470] CloseHandle (hObject=0x368) returned 1 [0151.470] Sleep (dwMilliseconds=0x3e8) [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef408 [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef2f0 [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef3e0 [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0152.746] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef2f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0152.746] GetProcessHeap () returned 0xfd0000 [0152.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef408 | out: hHeap=0xfd0000) returned 1 [0152.746] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.747] GetProcessHeap () returned 0xfd0000 [0152.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2f0 | out: hHeap=0xfd0000) returned 1 [0152.747] GetProcessHeap () returned 0xfd0000 [0152.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011278 [0152.747] GetProcessHeap () returned 0xfd0000 [0152.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010cd8 [0152.747] GetProcessHeap () returned 0xfd0000 [0152.747] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010cd8, Size=0x72) returned 0x1012498 [0152.747] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0152.747] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x36c [0152.747] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x0 [0152.747] GetProcessHeap () returned 0xfd0000 [0152.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011278 | out: hHeap=0xfd0000) returned 1 [0152.747] GetProcessHeap () returned 0xfd0000 [0152.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012498 | out: hHeap=0xfd0000) returned 1 [0152.747] ReleaseMutex (hMutex=0x36c) returned 1 [0152.747] CloseHandle (hObject=0x36c) returned 1 [0152.747] Sleep (dwMilliseconds=0x3e8) [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef278 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef0c0 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef200 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0154.552] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef200 | out: hHeap=0xfd0000) returned 1 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef278 | out: hHeap=0xfd0000) returned 1 [0154.552] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010c00 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010a98 [0154.552] GetProcessHeap () returned 0xfd0000 [0154.553] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010a98, Size=0x72) returned 0x1011c18 [0154.553] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0154.553] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x370 [0154.553] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x0 [0154.553] GetProcessHeap () returned 0xfd0000 [0154.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010c00 | out: hHeap=0xfd0000) returned 1 [0154.553] GetProcessHeap () returned 0xfd0000 [0154.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011c18 | out: hHeap=0xfd0000) returned 1 [0154.553] ReleaseMutex (hMutex=0x370) returned 1 [0154.553] CloseHandle (hObject=0x370) returned 1 [0154.553] Sleep (dwMilliseconds=0x3e8) [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef020 [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef430 [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef3e0 [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0156.098] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef430, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0156.098] GetProcessHeap () returned 0xfd0000 [0156.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0156.099] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.101] GetProcessHeap () returned 0xfd0000 [0156.101] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef430 | out: hHeap=0xfd0000) returned 1 [0156.102] GetProcessHeap () returned 0xfd0000 [0156.102] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010ae0 [0156.102] GetProcessHeap () returned 0xfd0000 [0156.102] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010d68 [0156.102] GetProcessHeap () returned 0xfd0000 [0156.102] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010d68, Size=0x72) returned 0x1012198 [0156.102] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0156.102] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x370 [0156.102] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x0 [0156.102] GetProcessHeap () returned 0xfd0000 [0156.102] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010ae0 | out: hHeap=0xfd0000) returned 1 [0156.102] GetProcessHeap () returned 0xfd0000 [0156.102] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012198 | out: hHeap=0xfd0000) returned 1 [0156.102] ReleaseMutex (hMutex=0x370) returned 1 [0156.102] CloseHandle (hObject=0x370) returned 1 [0156.102] Sleep (dwMilliseconds=0x3e8) [0157.332] GetProcessHeap () returned 0xfd0000 [0157.332] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0157.333] GetProcessHeap () returned 0xfd0000 [0157.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef2a0 [0157.333] GetProcessHeap () returned 0xfd0000 [0157.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef020 [0157.333] GetProcessHeap () returned 0xfd0000 [0157.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0157.333] GetProcessHeap () returned 0xfd0000 [0157.333] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0157.341] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef2a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.341] GetProcessHeap () returned 0xfd0000 [0157.341] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0157.341] GetProcessHeap () returned 0xfd0000 [0157.341] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0157.341] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.341] GetProcessHeap () returned 0xfd0000 [0157.341] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2a0 | out: hHeap=0xfd0000) returned 1 [0157.341] GetProcessHeap () returned 0xfd0000 [0157.341] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011278 [0157.341] GetProcessHeap () returned 0xfd0000 [0157.341] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010cd8 [0157.341] GetProcessHeap () returned 0xfd0000 [0157.341] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010cd8, Size=0x72) returned 0x1011d18 [0157.341] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0157.342] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x370 [0157.342] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x0 [0157.342] GetProcessHeap () returned 0xfd0000 [0157.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011278 | out: hHeap=0xfd0000) returned 1 [0157.342] GetProcessHeap () returned 0xfd0000 [0157.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011d18 | out: hHeap=0xfd0000) returned 1 [0157.342] ReleaseMutex (hMutex=0x370) returned 1 [0157.342] CloseHandle (hObject=0x370) returned 1 [0157.342] Sleep (dwMilliseconds=0x3e8) [0159.771] GetProcessHeap () returned 0xfd0000 [0159.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef070 [0159.771] GetProcessHeap () returned 0xfd0000 [0159.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef020 [0159.771] GetProcessHeap () returned 0xfd0000 [0159.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0159.771] GetProcessHeap () returned 0xfd0000 [0159.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0159.771] GetProcessHeap () returned 0xfd0000 [0159.771] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0159.771] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef020, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0159.771] GetProcessHeap () returned 0xfd0000 [0159.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0159.772] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010d68 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010db0 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010db0, Size=0x72) returned 0x1012918 [0159.772] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0159.772] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x368 [0159.772] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x0 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010d68 | out: hHeap=0xfd0000) returned 1 [0159.772] GetProcessHeap () returned 0xfd0000 [0159.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012918 | out: hHeap=0xfd0000) returned 1 [0159.772] ReleaseMutex (hMutex=0x368) returned 1 [0159.773] CloseHandle (hObject=0x368) returned 1 [0159.773] Sleep (dwMilliseconds=0x3e8) [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef340 [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef2a0 [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef160 [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x100f1f8 [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100f1f8 | out: hHeap=0xfd0000) returned 1 [0161.030] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef2a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0161.030] GetProcessHeap () returned 0xfd0000 [0161.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0161.031] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0161.031] GetProcessHeap () returned 0xfd0000 [0161.031] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2a0 | out: hHeap=0xfd0000) returned 1 [0161.031] GetProcessHeap () returned 0xfd0000 [0161.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010df8 [0161.031] GetProcessHeap () returned 0xfd0000 [0161.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010e40 [0161.031] GetProcessHeap () returned 0xfd0000 [0161.031] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010e40, Size=0x72) returned 0x1012698 [0161.031] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0161.031] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x38c [0161.031] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x0 [0161.031] GetProcessHeap () returned 0xfd0000 [0161.031] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010df8 | out: hHeap=0xfd0000) returned 1 [0161.031] GetProcessHeap () returned 0xfd0000 [0161.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012698 | out: hHeap=0xfd0000) returned 1 [0161.032] ReleaseMutex (hMutex=0x38c) returned 1 [0161.032] CloseHandle (hObject=0x38c) returned 1 [0161.032] Sleep (dwMilliseconds=0x3e8) [0162.358] GetProcessHeap () returned 0xfd0000 [0162.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef020 [0162.358] GetProcessHeap () returned 0xfd0000 [0162.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef1b0 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef070 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe2428 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2428 | out: hHeap=0xfd0000) returned 1 [0162.359] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef1b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef020 | out: hHeap=0xfd0000) returned 1 [0162.359] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1b0 | out: hHeap=0xfd0000) returned 1 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010e88 [0162.359] GetProcessHeap () returned 0xfd0000 [0162.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010ff0 [0162.360] GetProcessHeap () returned 0xfd0000 [0162.360] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010ff0, Size=0x72) returned 0x1012298 [0162.360] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0162.360] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x38c [0162.360] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x0 [0162.360] GetProcessHeap () returned 0xfd0000 [0162.360] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010e88 | out: hHeap=0xfd0000) returned 1 [0162.360] GetProcessHeap () returned 0xfd0000 [0162.360] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012298 | out: hHeap=0xfd0000) returned 1 [0162.360] ReleaseMutex (hMutex=0x38c) returned 1 [0162.360] CloseHandle (hObject=0x38c) returned 1 [0162.360] Sleep (dwMilliseconds=0x3e8) [0163.736] GetProcessHeap () returned 0xfd0000 [0163.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef340 [0163.736] GetProcessHeap () returned 0xfd0000 [0163.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef2c8 [0163.736] GetProcessHeap () returned 0xfd0000 [0163.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef2f0 [0163.736] GetProcessHeap () returned 0xfd0000 [0163.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x10bfe48 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10bfe48 | out: hHeap=0xfd0000) returned 1 [0163.737] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2f0 | out: hHeap=0xfd0000) returned 1 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0163.737] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2c8 | out: hHeap=0xfd0000) returned 1 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010ff0 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010b70 [0163.737] GetProcessHeap () returned 0xfd0000 [0163.737] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010b70, Size=0x72) returned 0x1012618 [0163.737] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0163.737] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x398 [0163.737] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0163.738] GetProcessHeap () returned 0xfd0000 [0163.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010ff0 | out: hHeap=0xfd0000) returned 1 [0163.738] GetProcessHeap () returned 0xfd0000 [0163.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012618 | out: hHeap=0xfd0000) returned 1 [0163.738] ReleaseMutex (hMutex=0x398) returned 1 [0163.738] CloseHandle (hObject=0x398) returned 1 [0163.738] Sleep (dwMilliseconds=0x3e8) [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef3e0 [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef340 [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef160 [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x10974c8 [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10974c8 | out: hHeap=0xfd0000) returned 1 [0164.861] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef340, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0164.861] GetProcessHeap () returned 0xfd0000 [0164.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0164.861] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.862] GetProcessHeap () returned 0xfd0000 [0164.862] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0164.862] GetProcessHeap () returned 0xfd0000 [0164.862] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x10110c8 [0164.862] GetProcessHeap () returned 0xfd0000 [0164.862] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010b70 [0164.862] GetProcessHeap () returned 0xfd0000 [0164.862] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010b70, Size=0x72) returned 0x1012518 [0164.862] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0164.862] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x384 [0164.862] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0164.862] GetProcessHeap () returned 0xfd0000 [0164.862] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10110c8 | out: hHeap=0xfd0000) returned 1 [0164.862] GetProcessHeap () returned 0xfd0000 [0164.863] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012518 | out: hHeap=0xfd0000) returned 1 [0164.863] ReleaseMutex (hMutex=0x384) returned 1 [0164.863] CloseHandle (hObject=0x384) returned 1 [0164.863] Sleep (dwMilliseconds=0x3e8) [0166.074] GetProcessHeap () returned 0xfd0000 [0166.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0166.074] GetProcessHeap () returned 0xfd0000 [0166.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef278 [0166.074] GetProcessHeap () returned 0xfd0000 [0166.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef0c0 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x1097138 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097138 | out: hHeap=0xfd0000) returned 1 [0166.075] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0166.075] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef278 | out: hHeap=0xfd0000) returned 1 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x10112c0 [0166.075] GetProcessHeap () returned 0xfd0000 [0166.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011308 [0166.076] GetProcessHeap () returned 0xfd0000 [0166.076] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011308, Size=0x72) returned 0x1012298 [0166.076] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0166.076] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x398 [0166.076] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0166.076] GetProcessHeap () returned 0xfd0000 [0166.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10112c0 | out: hHeap=0xfd0000) returned 1 [0166.076] GetProcessHeap () returned 0xfd0000 [0166.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012298 | out: hHeap=0xfd0000) returned 1 [0166.076] ReleaseMutex (hMutex=0x398) returned 1 [0166.076] CloseHandle (hObject=0x398) returned 1 [0166.076] Sleep (dwMilliseconds=0x3e8) [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef160 [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef408 [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x1097300 [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097300 | out: hHeap=0xfd0000) returned 1 [0167.361] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef160, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef408 | out: hHeap=0xfd0000) returned 1 [0167.361] GetProcessHeap () returned 0xfd0000 [0167.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0167.361] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.362] GetProcessHeap () returned 0xfd0000 [0167.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0167.362] GetProcessHeap () returned 0xfd0000 [0167.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011350 [0167.362] GetProcessHeap () returned 0xfd0000 [0167.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010c90 [0167.362] GetProcessHeap () returned 0xfd0000 [0167.362] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010c90, Size=0x72) returned 0x1011e18 [0167.362] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0167.362] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x3a0 [0167.362] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0x0) returned 0x0 [0167.362] GetProcessHeap () returned 0xfd0000 [0167.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011350 | out: hHeap=0xfd0000) returned 1 [0167.362] GetProcessHeap () returned 0xfd0000 [0167.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011e18 | out: hHeap=0xfd0000) returned 1 [0167.362] ReleaseMutex (hMutex=0x3a0) returned 1 [0167.362] CloseHandle (hObject=0x3a0) returned 1 [0167.362] Sleep (dwMilliseconds=0x3e8) [0168.455] GetProcessHeap () returned 0xfd0000 [0168.455] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef430 [0168.455] GetProcessHeap () returned 0xfd0000 [0168.455] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef2a0 [0168.455] GetProcessHeap () returned 0xfd0000 [0168.455] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef278 [0168.469] GetProcessHeap () returned 0xfd0000 [0168.469] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89cf0 [0168.469] GetProcessHeap () returned 0xfd0000 [0168.469] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89cf0 | out: hHeap=0xfd0000) returned 1 [0168.469] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef2a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0168.469] GetProcessHeap () returned 0xfd0000 [0168.469] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef278 | out: hHeap=0xfd0000) returned 1 [0168.475] GetProcessHeap () returned 0xfd0000 [0168.475] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef430 | out: hHeap=0xfd0000) returned 1 [0168.475] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0168.475] GetProcessHeap () returned 0xfd0000 [0168.475] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2a0 | out: hHeap=0xfd0000) returned 1 [0168.475] GetProcessHeap () returned 0xfd0000 [0168.476] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011350 [0168.476] GetProcessHeap () returned 0xfd0000 [0168.476] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010c00 [0168.476] GetProcessHeap () returned 0xfd0000 [0168.476] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010c00, Size=0x72) returned 0x1012598 [0168.476] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0168.476] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x380 [0168.476] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x0 [0168.476] GetProcessHeap () returned 0xfd0000 [0168.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011350 | out: hHeap=0xfd0000) returned 1 [0168.476] GetProcessHeap () returned 0xfd0000 [0168.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012598 | out: hHeap=0xfd0000) returned 1 [0168.476] ReleaseMutex (hMutex=0x380) returned 1 [0168.476] CloseHandle (hObject=0x380) returned 1 [0168.476] Sleep (dwMilliseconds=0x3e8) [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef110 [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef0c0 [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef0e8 [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a895d0 [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a895d0 | out: hHeap=0xfd0000) returned 1 [0169.662] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0e8 | out: hHeap=0xfd0000) returned 1 [0169.662] GetProcessHeap () returned 0xfd0000 [0169.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef110 | out: hHeap=0xfd0000) returned 1 [0169.662] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.663] GetProcessHeap () returned 0xfd0000 [0169.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0169.663] GetProcessHeap () returned 0xfd0000 [0169.663] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010cd8 [0169.663] GetProcessHeap () returned 0xfd0000 [0169.663] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010f60 [0169.663] GetProcessHeap () returned 0xfd0000 [0169.663] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010f60, Size=0x72) returned 0x1011f18 [0169.663] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0169.663] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x358 [0169.663] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x0 [0169.663] GetProcessHeap () returned 0xfd0000 [0169.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010cd8 | out: hHeap=0xfd0000) returned 1 [0169.663] GetProcessHeap () returned 0xfd0000 [0169.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011f18 | out: hHeap=0xfd0000) returned 1 [0169.663] ReleaseMutex (hMutex=0x358) returned 1 [0169.663] CloseHandle (hObject=0x358) returned 1 [0169.663] Sleep (dwMilliseconds=0x3e8) [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef2a0 [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef160 [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef228 [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89538 [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89538 | out: hHeap=0xfd0000) returned 1 [0170.871] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef160, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef228 | out: hHeap=0xfd0000) returned 1 [0170.871] GetProcessHeap () returned 0xfd0000 [0170.871] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2a0 | out: hHeap=0xfd0000) returned 1 [0170.871] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.872] GetProcessHeap () returned 0xfd0000 [0170.872] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0170.872] GetProcessHeap () returned 0xfd0000 [0170.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010b70 [0170.872] GetProcessHeap () returned 0xfd0000 [0170.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010df8 [0170.872] GetProcessHeap () returned 0xfd0000 [0170.872] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010df8, Size=0x72) returned 0x1012498 [0170.872] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0170.872] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x358 [0170.872] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x0 [0170.872] GetProcessHeap () returned 0xfd0000 [0170.872] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010b70 | out: hHeap=0xfd0000) returned 1 [0170.872] GetProcessHeap () returned 0xfd0000 [0170.872] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012498 | out: hHeap=0xfd0000) returned 1 [0170.872] ReleaseMutex (hMutex=0x358) returned 1 [0170.872] CloseHandle (hObject=0x358) returned 1 [0170.872] Sleep (dwMilliseconds=0x3e8) [0172.044] GetProcessHeap () returned 0xfd0000 [0172.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef408 [0172.044] GetProcessHeap () returned 0xfd0000 [0172.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef1d8 [0172.044] GetProcessHeap () returned 0xfd0000 [0172.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef3e0 [0172.044] GetProcessHeap () returned 0xfd0000 [0172.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89538 [0172.044] GetProcessHeap () returned 0xfd0000 [0172.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89538 | out: hHeap=0xfd0000) returned 1 [0172.094] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0172.114] GetProcessHeap () returned 0xfd0000 [0172.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0172.114] GetProcessHeap () returned 0xfd0000 [0172.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef408 | out: hHeap=0xfd0000) returned 1 [0172.114] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.114] GetProcessHeap () returned 0xfd0000 [0172.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0172.114] GetProcessHeap () returned 0xfd0000 [0172.114] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011110 [0172.114] GetProcessHeap () returned 0xfd0000 [0172.114] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010ff0 [0172.114] GetProcessHeap () returned 0xfd0000 [0172.115] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010ff0, Size=0x72) returned 0x1012118 [0172.115] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0172.115] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x36c [0172.115] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x0 [0172.115] GetProcessHeap () returned 0xfd0000 [0172.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011110 | out: hHeap=0xfd0000) returned 1 [0172.115] GetProcessHeap () returned 0xfd0000 [0172.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012118 | out: hHeap=0xfd0000) returned 1 [0172.115] ReleaseMutex (hMutex=0x36c) returned 1 [0172.115] CloseHandle (hObject=0x36c) returned 1 [0172.115] Sleep (dwMilliseconds=0x3e8) [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef6b0 [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef1d8 [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef340 [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89e20 [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89e20 | out: hHeap=0xfd0000) returned 1 [0173.248] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0173.248] GetProcessHeap () returned 0xfd0000 [0173.248] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0173.248] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.249] GetProcessHeap () returned 0xfd0000 [0173.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0173.249] GetProcessHeap () returned 0xfd0000 [0173.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010b28 [0173.249] GetProcessHeap () returned 0xfd0000 [0173.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010a98 [0173.249] GetProcessHeap () returned 0xfd0000 [0173.249] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010a98, Size=0x72) returned 0x1011f98 [0173.249] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0173.249] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x394 [0173.249] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x0 [0173.249] GetProcessHeap () returned 0xfd0000 [0173.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010b28 | out: hHeap=0xfd0000) returned 1 [0173.249] GetProcessHeap () returned 0xfd0000 [0173.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011f98 | out: hHeap=0xfd0000) returned 1 [0173.249] ReleaseMutex (hMutex=0x394) returned 1 [0173.249] CloseHandle (hObject=0x394) returned 1 [0173.250] Sleep (dwMilliseconds=0x3e8) [0174.411] GetProcessHeap () returned 0xfd0000 [0174.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef098 [0174.411] GetProcessHeap () returned 0xfd0000 [0174.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef3e0 [0174.411] GetProcessHeap () returned 0xfd0000 [0174.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef160 [0174.411] GetProcessHeap () returned 0xfd0000 [0174.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89c58 [0174.411] GetProcessHeap () returned 0xfd0000 [0174.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89c58 | out: hHeap=0xfd0000) returned 1 [0174.412] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef3e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0174.412] GetProcessHeap () returned 0xfd0000 [0174.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0174.412] GetProcessHeap () returned 0xfd0000 [0174.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef098 | out: hHeap=0xfd0000) returned 1 [0174.412] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.412] GetProcessHeap () returned 0xfd0000 [0174.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0174.412] GetProcessHeap () returned 0xfd0000 [0174.412] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011038 [0174.412] GetProcessHeap () returned 0xfd0000 [0174.412] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10112c0 [0174.412] GetProcessHeap () returned 0xfd0000 [0174.412] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10112c0, Size=0x72) returned 0x1012498 [0174.412] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0174.412] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x394 [0174.413] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x0 [0174.413] GetProcessHeap () returned 0xfd0000 [0174.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011038 | out: hHeap=0xfd0000) returned 1 [0174.413] GetProcessHeap () returned 0xfd0000 [0174.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012498 | out: hHeap=0xfd0000) returned 1 [0174.413] ReleaseMutex (hMutex=0x394) returned 1 [0174.413] CloseHandle (hObject=0x394) returned 1 [0174.413] Sleep (dwMilliseconds=0x3e8) [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef1d8 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef2c8 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef2f0 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89960 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89960 | out: hHeap=0xfd0000) returned 1 [0175.523] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2f0 | out: hHeap=0xfd0000) returned 1 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0175.523] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.924] GetProcessHeap () returned 0xfd0000 [0175.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2c8 | out: hHeap=0xfd0000) returned 1 [0175.924] GetProcessHeap () returned 0xfd0000 [0175.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010d20 [0175.924] GetProcessHeap () returned 0xfd0000 [0175.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010ff0 [0175.924] GetProcessHeap () returned 0xfd0000 [0175.924] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010ff0, Size=0x72) returned 0x1012218 [0175.924] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0175.924] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x394 [0175.924] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x0 [0175.924] GetProcessHeap () returned 0xfd0000 [0175.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010d20 | out: hHeap=0xfd0000) returned 1 [0175.924] GetProcessHeap () returned 0xfd0000 [0175.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012218 | out: hHeap=0xfd0000) returned 1 [0175.924] ReleaseMutex (hMutex=0x394) returned 1 [0175.924] CloseHandle (hObject=0x394) returned 1 [0175.924] Sleep (dwMilliseconds=0x3e8) [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef070 [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef098 [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a894a0 [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a894a0 | out: hHeap=0xfd0000) returned 1 [0177.116] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef098 | out: hHeap=0xfd0000) returned 1 [0177.116] GetProcessHeap () returned 0xfd0000 [0177.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0177.117] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0177.117] GetProcessHeap () returned 0xfd0000 [0177.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0177.117] GetProcessHeap () returned 0xfd0000 [0177.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x10112c0 [0177.117] GetProcessHeap () returned 0xfd0000 [0177.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10111e8 [0177.117] GetProcessHeap () returned 0xfd0000 [0177.117] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10111e8, Size=0x72) returned 0x1011b18 [0177.117] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0177.117] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x37c [0177.117] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x0 [0177.117] GetProcessHeap () returned 0xfd0000 [0177.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10112c0 | out: hHeap=0xfd0000) returned 1 [0177.117] GetProcessHeap () returned 0xfd0000 [0177.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011b18 | out: hHeap=0xfd0000) returned 1 [0177.117] ReleaseMutex (hMutex=0x37c) returned 1 [0177.117] CloseHandle (hObject=0x37c) returned 1 [0177.117] Sleep (dwMilliseconds=0x3e8) [0178.265] GetProcessHeap () returned 0xfd0000 [0178.265] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef390 [0178.273] GetProcessHeap () returned 0xfd0000 [0178.273] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef110 [0178.273] GetProcessHeap () returned 0xfd0000 [0178.273] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0178.273] GetProcessHeap () returned 0xfd0000 [0178.273] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89a90 [0178.273] GetProcessHeap () returned 0xfd0000 [0178.280] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89a90 | out: hHeap=0xfd0000) returned 1 [0178.280] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef110, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0178.280] GetProcessHeap () returned 0xfd0000 [0178.280] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0178.280] GetProcessHeap () returned 0xfd0000 [0178.292] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef390 | out: hHeap=0xfd0000) returned 1 [0178.292] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.297] GetProcessHeap () returned 0xfd0000 [0178.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef110 | out: hHeap=0xfd0000) returned 1 [0178.297] GetProcessHeap () returned 0xfd0000 [0178.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010e40 [0178.297] GetProcessHeap () returned 0xfd0000 [0178.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011038 [0178.297] GetProcessHeap () returned 0xfd0000 [0178.297] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011038, Size=0x72) returned 0x1012798 [0178.297] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0178.297] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x384 [0178.298] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0178.298] GetProcessHeap () returned 0xfd0000 [0178.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010e40 | out: hHeap=0xfd0000) returned 1 [0178.298] GetProcessHeap () returned 0xfd0000 [0178.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012798 | out: hHeap=0xfd0000) returned 1 [0178.298] ReleaseMutex (hMutex=0x384) returned 1 [0178.298] CloseHandle (hObject=0x384) returned 1 [0178.298] Sleep (dwMilliseconds=0x3e8) [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef228 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef2a0 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89bc0 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89bc0 | out: hHeap=0xfd0000) returned 1 [0179.593] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef228, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2a0 | out: hHeap=0xfd0000) returned 1 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0179.593] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef228 | out: hHeap=0xfd0000) returned 1 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010ae0 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010d20 [0179.593] GetProcessHeap () returned 0xfd0000 [0179.593] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010d20, Size=0x72) returned 0x1011a98 [0179.594] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0179.594] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x384 [0179.594] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0179.594] GetProcessHeap () returned 0xfd0000 [0179.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010ae0 | out: hHeap=0xfd0000) returned 1 [0179.594] GetProcessHeap () returned 0xfd0000 [0179.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011a98 | out: hHeap=0xfd0000) returned 1 [0179.594] ReleaseMutex (hMutex=0x384) returned 1 [0179.594] CloseHandle (hObject=0x384) returned 1 [0179.594] Sleep (dwMilliseconds=0x3e8) [0180.708] GetProcessHeap () returned 0xfd0000 [0180.708] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef2a0 [0180.708] GetProcessHeap () returned 0xfd0000 [0180.708] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef048 [0180.710] GetProcessHeap () returned 0xfd0000 [0180.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef070 [0180.710] GetProcessHeap () returned 0xfd0000 [0180.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89240 [0180.710] GetProcessHeap () returned 0xfd0000 [0180.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89240 | out: hHeap=0xfd0000) returned 1 [0180.710] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef048, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0180.710] GetProcessHeap () returned 0xfd0000 [0180.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0180.710] GetProcessHeap () returned 0xfd0000 [0180.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2a0 | out: hHeap=0xfd0000) returned 1 [0180.710] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.711] GetProcessHeap () returned 0xfd0000 [0180.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0180.711] GetProcessHeap () returned 0xfd0000 [0180.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010ed0 [0180.711] GetProcessHeap () returned 0xfd0000 [0180.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011080 [0180.711] GetProcessHeap () returned 0xfd0000 [0180.711] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011080, Size=0x72) returned 0x1012698 [0180.711] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0180.711] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x398 [0180.711] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0180.711] GetProcessHeap () returned 0xfd0000 [0180.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010ed0 | out: hHeap=0xfd0000) returned 1 [0180.711] GetProcessHeap () returned 0xfd0000 [0180.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012698 | out: hHeap=0xfd0000) returned 1 [0180.711] ReleaseMutex (hMutex=0x398) returned 1 [0180.711] CloseHandle (hObject=0x398) returned 1 [0180.711] Sleep (dwMilliseconds=0x3e8) [0181.804] GetProcessHeap () returned 0xfd0000 [0181.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef160 [0181.811] GetProcessHeap () returned 0xfd0000 [0181.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef390 [0181.811] GetProcessHeap () returned 0xfd0000 [0181.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0181.818] GetProcessHeap () returned 0xfd0000 [0181.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89668 [0181.818] GetProcessHeap () returned 0xfd0000 [0181.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89668 | out: hHeap=0xfd0000) returned 1 [0181.824] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef390, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0181.824] GetProcessHeap () returned 0xfd0000 [0181.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0181.841] GetProcessHeap () returned 0xfd0000 [0181.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0181.841] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0181.842] GetProcessHeap () returned 0xfd0000 [0181.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef390 | out: hHeap=0xfd0000) returned 1 [0181.842] GetProcessHeap () returned 0xfd0000 [0181.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010c00 [0181.842] GetProcessHeap () returned 0xfd0000 [0181.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010e88 [0181.842] GetProcessHeap () returned 0xfd0000 [0181.842] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010e88, Size=0x72) returned 0x1011a98 [0181.842] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0181.842] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x398 [0181.842] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0181.842] GetProcessHeap () returned 0xfd0000 [0181.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010c00 | out: hHeap=0xfd0000) returned 1 [0181.842] GetProcessHeap () returned 0xfd0000 [0181.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011a98 | out: hHeap=0xfd0000) returned 1 [0181.842] ReleaseMutex (hMutex=0x398) returned 1 [0181.842] CloseHandle (hObject=0x398) returned 1 [0181.842] Sleep (dwMilliseconds=0x3e8) [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef070 [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef340 [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a894a0 [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a894a0 | out: hHeap=0xfd0000) returned 1 [0182.959] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0182.959] GetProcessHeap () returned 0xfd0000 [0182.959] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0182.959] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0182.960] GetProcessHeap () returned 0xfd0000 [0182.960] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0182.960] GetProcessHeap () returned 0xfd0000 [0182.960] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010fa8 [0182.960] GetProcessHeap () returned 0xfd0000 [0182.960] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011308 [0182.960] GetProcessHeap () returned 0xfd0000 [0182.960] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011308, Size=0x72) returned 0x1012518 [0182.960] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0182.960] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x360 [0182.960] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x0 [0182.960] GetProcessHeap () returned 0xfd0000 [0182.960] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010fa8 | out: hHeap=0xfd0000) returned 1 [0182.960] GetProcessHeap () returned 0xfd0000 [0182.960] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012518 | out: hHeap=0xfd0000) returned 1 [0182.960] ReleaseMutex (hMutex=0x360) returned 1 [0182.960] CloseHandle (hObject=0x360) returned 1 [0182.961] Sleep (dwMilliseconds=0x3e8) [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef3e0 [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef1d8 [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef1b0 [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89c58 [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89c58 | out: hHeap=0xfd0000) returned 1 [0184.055] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1b0 | out: hHeap=0xfd0000) returned 1 [0184.055] GetProcessHeap () returned 0xfd0000 [0184.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef3e0 | out: hHeap=0xfd0000) returned 1 [0184.055] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0184.056] GetProcessHeap () returned 0xfd0000 [0184.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0184.056] GetProcessHeap () returned 0xfd0000 [0184.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010c90 [0184.056] GetProcessHeap () returned 0xfd0000 [0184.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010fa8 [0184.056] GetProcessHeap () returned 0xfd0000 [0184.056] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010fa8, Size=0x72) returned 0x1012698 [0184.056] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0184.056] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x388 [0184.056] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x0 [0184.056] GetProcessHeap () returned 0xfd0000 [0184.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010c90 | out: hHeap=0xfd0000) returned 1 [0184.056] GetProcessHeap () returned 0xfd0000 [0184.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012698 | out: hHeap=0xfd0000) returned 1 [0184.056] ReleaseMutex (hMutex=0x388) returned 1 [0184.056] CloseHandle (hObject=0x388) returned 1 [0184.057] Sleep (dwMilliseconds=0x3e8) [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef160 [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef390 [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef1b0 [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89a90 [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89a90 | out: hHeap=0xfd0000) returned 1 [0185.149] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef390, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1b0 | out: hHeap=0xfd0000) returned 1 [0185.149] GetProcessHeap () returned 0xfd0000 [0185.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0185.149] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0185.150] GetProcessHeap () returned 0xfd0000 [0185.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef390 | out: hHeap=0xfd0000) returned 1 [0185.150] GetProcessHeap () returned 0xfd0000 [0185.150] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010b28 [0185.150] GetProcessHeap () returned 0xfd0000 [0185.150] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010db0 [0185.150] GetProcessHeap () returned 0xfd0000 [0185.150] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010db0, Size=0x72) returned 0x1012118 [0185.150] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0185.150] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x39c [0185.150] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x0 [0185.150] GetProcessHeap () returned 0xfd0000 [0185.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010b28 | out: hHeap=0xfd0000) returned 1 [0185.150] GetProcessHeap () returned 0xfd0000 [0185.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012118 | out: hHeap=0xfd0000) returned 1 [0185.151] ReleaseMutex (hMutex=0x39c) returned 1 [0185.151] CloseHandle (hObject=0x39c) returned 1 [0185.151] Sleep (dwMilliseconds=0x3e8) [0186.478] GetProcessHeap () returned 0xfd0000 [0186.478] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0186.478] GetProcessHeap () returned 0xfd0000 [0186.478] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef070 [0186.480] GetProcessHeap () returned 0xfd0000 [0186.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef0c0 [0186.480] GetProcessHeap () returned 0xfd0000 [0186.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89700 [0186.480] GetProcessHeap () returned 0xfd0000 [0186.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89700 | out: hHeap=0xfd0000) returned 1 [0186.480] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0186.480] GetProcessHeap () returned 0xfd0000 [0186.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0186.480] GetProcessHeap () returned 0xfd0000 [0186.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0186.480] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0186.481] GetProcessHeap () returned 0xfd0000 [0186.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef070 | out: hHeap=0xfd0000) returned 1 [0186.481] GetProcessHeap () returned 0xfd0000 [0186.481] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010ed0 [0186.481] GetProcessHeap () returned 0xfd0000 [0186.481] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010b28 [0186.481] GetProcessHeap () returned 0xfd0000 [0186.481] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010b28, Size=0x72) returned 0x1011e18 [0186.481] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0186.481] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x39c [0186.482] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x0 [0186.482] GetProcessHeap () returned 0xfd0000 [0186.482] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010ed0 | out: hHeap=0xfd0000) returned 1 [0186.482] GetProcessHeap () returned 0xfd0000 [0186.482] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011e18 | out: hHeap=0xfd0000) returned 1 [0186.482] ReleaseMutex (hMutex=0x39c) returned 1 [0186.482] CloseHandle (hObject=0x39c) returned 1 [0186.482] Sleep (dwMilliseconds=0x3e8) [0187.737] GetProcessHeap () returned 0xfd0000 [0187.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef6b0 [0187.737] GetProcessHeap () returned 0xfd0000 [0187.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef570 [0187.737] GetProcessHeap () returned 0xfd0000 [0187.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef0c0 [0187.737] GetProcessHeap () returned 0xfd0000 [0187.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89240 [0187.737] GetProcessHeap () returned 0xfd0000 [0187.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89240 | out: hHeap=0xfd0000) returned 1 [0187.737] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef570, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0187.737] GetProcessHeap () returned 0xfd0000 [0187.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0187.738] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011038 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010d68 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010d68, Size=0x72) returned 0x1012398 [0187.738] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0187.738] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x25c [0187.738] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x0 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011038 | out: hHeap=0xfd0000) returned 1 [0187.738] GetProcessHeap () returned 0xfd0000 [0187.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012398 | out: hHeap=0xfd0000) returned 1 [0187.738] ReleaseMutex (hMutex=0x25c) returned 1 [0187.738] CloseHandle (hObject=0x25c) returned 1 [0187.738] Sleep (dwMilliseconds=0x3e8) [0188.775] GetProcessHeap () returned 0xfd0000 [0188.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef570 [0188.775] GetProcessHeap () returned 0xfd0000 [0188.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef6b0 [0188.776] GetProcessHeap () returned 0xfd0000 [0188.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0188.776] GetProcessHeap () returned 0xfd0000 [0188.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89408 [0188.776] GetProcessHeap () returned 0xfd0000 [0188.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89408 | out: hHeap=0xfd0000) returned 1 [0188.776] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef6b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0188.776] GetProcessHeap () returned 0xfd0000 [0188.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0188.776] GetProcessHeap () returned 0xfd0000 [0188.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0188.776] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0188.776] GetProcessHeap () returned 0xfd0000 [0188.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0188.777] GetProcessHeap () returned 0xfd0000 [0188.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011278 [0188.777] GetProcessHeap () returned 0xfd0000 [0188.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010c00 [0188.777] GetProcessHeap () returned 0xfd0000 [0188.777] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010c00, Size=0x72) returned 0x1012918 [0188.777] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0188.777] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x344 [0188.777] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x0 [0188.777] GetProcessHeap () returned 0xfd0000 [0188.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011278 | out: hHeap=0xfd0000) returned 1 [0188.777] GetProcessHeap () returned 0xfd0000 [0188.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012918 | out: hHeap=0xfd0000) returned 1 [0188.777] ReleaseMutex (hMutex=0x344) returned 1 [0188.777] CloseHandle (hObject=0x344) returned 1 [0188.777] Sleep (dwMilliseconds=0x3e8) [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef570 [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef6b0 [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89f50 [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89f50 | out: hHeap=0xfd0000) returned 1 [0189.856] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef6b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0189.856] GetProcessHeap () returned 0xfd0000 [0189.856] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0189.856] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.857] GetProcessHeap () returned 0xfd0000 [0189.857] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0189.857] GetProcessHeap () returned 0xfd0000 [0189.857] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011080 [0189.857] GetProcessHeap () returned 0xfd0000 [0189.857] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011038 [0189.857] GetProcessHeap () returned 0xfd0000 [0189.857] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011038, Size=0x72) returned 0x1011e98 [0189.857] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0189.857] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x25c [0189.857] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x0 [0189.857] GetProcessHeap () returned 0xfd0000 [0189.857] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011080 | out: hHeap=0xfd0000) returned 1 [0189.857] GetProcessHeap () returned 0xfd0000 [0189.857] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011e98 | out: hHeap=0xfd0000) returned 1 [0189.857] ReleaseMutex (hMutex=0x25c) returned 1 [0189.857] CloseHandle (hObject=0x25c) returned 1 [0189.857] Sleep (dwMilliseconds=0x3e8) [0191.025] GetProcessHeap () returned 0xfd0000 [0191.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef570 [0191.025] GetProcessHeap () returned 0xfd0000 [0191.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef6b0 [0191.025] GetProcessHeap () returned 0xfd0000 [0191.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0191.025] GetProcessHeap () returned 0xfd0000 [0191.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89370 [0191.025] GetProcessHeap () returned 0xfd0000 [0191.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89370 | out: hHeap=0xfd0000) returned 1 [0191.026] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef6b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0191.026] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010d68 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011080 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011080, Size=0x72) returned 0x1011f18 [0191.026] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0191.026] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x3a0 [0191.026] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0x0) returned 0x0 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010d68 | out: hHeap=0xfd0000) returned 1 [0191.026] GetProcessHeap () returned 0xfd0000 [0191.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011f18 | out: hHeap=0xfd0000) returned 1 [0191.026] ReleaseMutex (hMutex=0x3a0) returned 1 [0191.026] CloseHandle (hObject=0x3a0) returned 1 [0191.027] Sleep (dwMilliseconds=0x3e8) [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef6b0 [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef570 [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef0e8 [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89e20 [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89e20 | out: hHeap=0xfd0000) returned 1 [0192.380] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef570, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0e8 | out: hHeap=0xfd0000) returned 1 [0192.380] GetProcessHeap () returned 0xfd0000 [0192.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0192.380] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0192.381] GetProcessHeap () returned 0xfd0000 [0192.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0192.381] GetProcessHeap () returned 0xfd0000 [0192.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010df8 [0192.381] GetProcessHeap () returned 0xfd0000 [0192.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010b70 [0192.381] GetProcessHeap () returned 0xfd0000 [0192.381] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010b70, Size=0x72) returned 0x1011e98 [0192.381] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x388 [0192.381] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0192.381] CloseHandle (hObject=0x388) returned 1 [0192.381] GetProcessHeap () returned 0xfd0000 [0192.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010df8 | out: hHeap=0xfd0000) returned 1 [0192.381] GetProcessHeap () returned 0xfd0000 [0192.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011e98 | out: hHeap=0xfd0000) returned 1 [0192.381] Sleep (dwMilliseconds=0x3e8) [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef570 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef6b0 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef160 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89370 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89370 | out: hHeap=0xfd0000) returned 1 [0193.631] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef6b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0193.631] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010b28 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010f18 [0193.631] GetProcessHeap () returned 0xfd0000 [0193.631] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010f18, Size=0x72) returned 0x1011b98 [0193.632] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2b0 [0193.632] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0193.632] CloseHandle (hObject=0x2b0) returned 1 [0193.632] GetProcessHeap () returned 0xfd0000 [0193.632] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010b28 | out: hHeap=0xfd0000) returned 1 [0193.632] GetProcessHeap () returned 0xfd0000 [0193.632] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011b98 | out: hHeap=0xfd0000) returned 1 [0193.632] Sleep (dwMilliseconds=0x3e8) [0195.226] GetProcessHeap () returned 0xfd0000 [0195.226] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef6b0 [0195.226] GetProcessHeap () returned 0xfd0000 [0195.226] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef570 [0195.226] GetProcessHeap () returned 0xfd0000 [0195.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef0e8 [0195.227] GetProcessHeap () returned 0xfd0000 [0195.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89668 [0195.227] GetProcessHeap () returned 0xfd0000 [0195.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89668 | out: hHeap=0xfd0000) returned 1 [0195.227] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef570, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0195.227] GetProcessHeap () returned 0xfd0000 [0195.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0e8 | out: hHeap=0xfd0000) returned 1 [0195.227] GetProcessHeap () returned 0xfd0000 [0195.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0195.227] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0195.227] GetProcessHeap () returned 0xfd0000 [0195.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0195.228] GetProcessHeap () returned 0xfd0000 [0195.228] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010db0 [0195.228] GetProcessHeap () returned 0xfd0000 [0195.228] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10110c8 [0195.228] GetProcessHeap () returned 0xfd0000 [0195.228] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10110c8, Size=0x72) returned 0x1012218 [0195.228] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2b0 [0195.228] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0195.228] CloseHandle (hObject=0x2b0) returned 1 [0195.228] GetProcessHeap () returned 0xfd0000 [0195.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010db0 | out: hHeap=0xfd0000) returned 1 [0195.228] GetProcessHeap () returned 0xfd0000 [0195.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012218 | out: hHeap=0xfd0000) returned 1 [0195.228] Sleep (dwMilliseconds=0x3e8) [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef6b0 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef570 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89830 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89830 | out: hHeap=0xfd0000) returned 1 [0196.425] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef570, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0196.425] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010cd8 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010e88 [0196.425] GetProcessHeap () returned 0xfd0000 [0196.425] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010e88, Size=0x72) returned 0x1012398 [0196.425] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2b0 [0196.426] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0196.426] CloseHandle (hObject=0x2b0) returned 1 [0196.426] GetProcessHeap () returned 0xfd0000 [0196.426] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010cd8 | out: hHeap=0xfd0000) returned 1 [0196.426] GetProcessHeap () returned 0xfd0000 [0196.426] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012398 | out: hHeap=0xfd0000) returned 1 [0196.426] Sleep (dwMilliseconds=0x3e8) [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef570 [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef6b0 [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef1d8 [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89f50 [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89f50 | out: hHeap=0xfd0000) returned 1 [0197.628] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef6b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0197.628] GetProcessHeap () returned 0xfd0000 [0197.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0197.628] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0197.629] GetProcessHeap () returned 0xfd0000 [0197.629] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6b0 | out: hHeap=0xfd0000) returned 1 [0197.629] GetProcessHeap () returned 0xfd0000 [0197.629] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x10110c8 [0197.629] GetProcessHeap () returned 0xfd0000 [0197.629] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010e88 [0197.629] GetProcessHeap () returned 0xfd0000 [0197.629] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010e88, Size=0x72) returned 0x1011d98 [0197.629] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2b0 [0197.629] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0197.629] CloseHandle (hObject=0x2b0) returned 1 [0197.629] GetProcessHeap () returned 0xfd0000 [0197.629] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10110c8 | out: hHeap=0xfd0000) returned 1 [0197.629] GetProcessHeap () returned 0xfd0000 [0197.629] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011d98 | out: hHeap=0xfd0000) returned 1 [0197.629] Sleep (dwMilliseconds=0x3e8) [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef048 [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef278 [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef2f0 [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89370 [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89370 | out: hHeap=0xfd0000) returned 1 [0198.886] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2f0 | out: hHeap=0xfd0000) returned 1 [0198.886] GetProcessHeap () returned 0xfd0000 [0198.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0198.886] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.887] GetProcessHeap () returned 0xfd0000 [0198.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef278 | out: hHeap=0xfd0000) returned 1 [0198.887] GetProcessHeap () returned 0xfd0000 [0198.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011038 [0198.887] GetProcessHeap () returned 0xfd0000 [0198.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010b70 [0198.887] GetProcessHeap () returned 0xfd0000 [0198.887] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010b70, Size=0x72) returned 0x1011c98 [0198.887] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x284 [0198.887] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0198.887] CloseHandle (hObject=0x284) returned 1 [0198.887] GetProcessHeap () returned 0xfd0000 [0198.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011038 | out: hHeap=0xfd0000) returned 1 [0198.887] GetProcessHeap () returned 0xfd0000 [0198.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011c98 | out: hHeap=0xfd0000) returned 1 [0198.887] Sleep (dwMilliseconds=0x3e8) [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef2f0 [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef368 [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef048 [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89c58 [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89c58 | out: hHeap=0xfd0000) returned 1 [0200.128] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef368, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0200.128] GetProcessHeap () returned 0xfd0000 [0200.128] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef2f0 | out: hHeap=0xfd0000) returned 1 [0200.128] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0200.129] GetProcessHeap () returned 0xfd0000 [0200.129] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef368 | out: hHeap=0xfd0000) returned 1 [0200.129] GetProcessHeap () returned 0xfd0000 [0200.129] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1011278 [0200.129] GetProcessHeap () returned 0xfd0000 [0200.129] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1011080 [0200.129] GetProcessHeap () returned 0xfd0000 [0200.129] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1011080, Size=0x72) returned 0x1011e98 [0200.129] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x284 [0200.129] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0200.129] CloseHandle (hObject=0x284) returned 1 [0200.129] GetProcessHeap () returned 0xfd0000 [0200.129] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011278 | out: hHeap=0xfd0000) returned 1 [0200.129] GetProcessHeap () returned 0xfd0000 [0200.129] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011e98 | out: hHeap=0xfd0000) returned 1 [0200.129] Sleep (dwMilliseconds=0x3e8) [0201.493] GetProcessHeap () returned 0xfd0000 [0201.493] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef408 [0201.493] GetProcessHeap () returned 0xfd0000 [0201.493] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef048 [0201.493] GetProcessHeap () returned 0xfd0000 [0201.493] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef278 [0201.494] GetProcessHeap () returned 0xfd0000 [0201.494] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89408 [0201.494] GetProcessHeap () returned 0xfd0000 [0201.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89408 | out: hHeap=0xfd0000) returned 1 [0201.494] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef048, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0201.494] GetProcessHeap () returned 0xfd0000 [0201.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef278 | out: hHeap=0xfd0000) returned 1 [0201.494] GetProcessHeap () returned 0xfd0000 [0201.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef408 | out: hHeap=0xfd0000) returned 1 [0201.494] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0201.494] GetProcessHeap () returned 0xfd0000 [0201.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0201.494] GetProcessHeap () returned 0xfd0000 [0201.494] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010cd8 [0201.495] GetProcessHeap () returned 0xfd0000 [0201.495] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x10111e8 [0201.495] GetProcessHeap () returned 0xfd0000 [0201.495] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x10111e8, Size=0x72) returned 0x1011a98 [0201.495] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x284 [0201.495] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0201.495] CloseHandle (hObject=0x284) returned 1 [0201.495] GetProcessHeap () returned 0xfd0000 [0201.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010cd8 | out: hHeap=0xfd0000) returned 1 [0201.495] GetProcessHeap () returned 0xfd0000 [0201.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011a98 | out: hHeap=0xfd0000) returned 1 [0201.495] Sleep (dwMilliseconds=0x3e8) [0202.688] GetProcessHeap () returned 0xfd0000 [0202.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef340 [0202.688] GetProcessHeap () returned 0xfd0000 [0202.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef048 [0202.688] GetProcessHeap () returned 0xfd0000 [0202.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef430 [0202.688] GetProcessHeap () returned 0xfd0000 [0202.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a89b28 [0202.688] GetProcessHeap () returned 0xfd0000 [0202.688] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a89b28 | out: hHeap=0xfd0000) returned 1 [0202.688] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef048, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0202.688] GetProcessHeap () returned 0xfd0000 [0202.689] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef430 | out: hHeap=0xfd0000) returned 1 [0202.689] GetProcessHeap () returned 0xfd0000 [0202.689] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef340 | out: hHeap=0xfd0000) returned 1 [0202.689] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0202.689] GetProcessHeap () returned 0xfd0000 [0202.689] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef048 | out: hHeap=0xfd0000) returned 1 [0202.689] GetProcessHeap () returned 0xfd0000 [0202.689] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010b70 [0202.689] GetProcessHeap () returned 0xfd0000 [0202.689] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010ff0 [0202.689] GetProcessHeap () returned 0xfd0000 [0202.689] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010ff0, Size=0x72) returned 0x1012718 [0202.689] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x284 [0202.689] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0202.689] CloseHandle (hObject=0x284) returned 1 [0202.689] GetProcessHeap () returned 0xfd0000 [0202.689] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010b70 | out: hHeap=0xfd0000) returned 1 [0202.690] GetProcessHeap () returned 0xfd0000 [0202.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1012718 | out: hHeap=0xfd0000) returned 1 [0202.690] Sleep (dwMilliseconds=0x3e8) [0203.848] GetProcessHeap () returned 0xfd0000 [0203.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef160 [0203.848] GetProcessHeap () returned 0xfd0000 [0203.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef098 [0203.848] GetProcessHeap () returned 0xfd0000 [0203.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef1d8 [0203.848] GetProcessHeap () returned 0xfd0000 [0203.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a898c8 [0203.848] GetProcessHeap () returned 0xfd0000 [0203.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a898c8 | out: hHeap=0xfd0000) returned 1 [0203.848] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef098, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0203.849] GetProcessHeap () returned 0xfd0000 [0203.849] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef1d8 | out: hHeap=0xfd0000) returned 1 [0203.849] GetProcessHeap () returned 0xfd0000 [0203.849] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef160 | out: hHeap=0xfd0000) returned 1 [0203.849] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0204.036] GetProcessHeap () returned 0xfd0000 [0204.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef098 | out: hHeap=0xfd0000) returned 1 [0204.038] GetProcessHeap () returned 0xfd0000 [0204.038] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010d20 [0204.038] GetProcessHeap () returned 0xfd0000 [0204.041] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010db0 [0204.041] GetProcessHeap () returned 0xfd0000 [0204.041] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010db0, Size=0x72) returned 0x1011b98 [0204.041] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x304 [0204.049] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0204.050] CloseHandle (hObject=0x304) returned 1 [0204.050] GetProcessHeap () returned 0xfd0000 [0204.050] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010d20 | out: hHeap=0xfd0000) returned 1 [0204.050] GetProcessHeap () returned 0xfd0000 [0204.050] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011b98 | out: hHeap=0xfd0000) returned 1 [0204.053] Sleep (dwMilliseconds=0x3e8) [0205.254] GetProcessHeap () returned 0xfd0000 [0205.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef098 [0205.254] GetProcessHeap () returned 0xfd0000 [0205.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef0c0 [0205.255] GetProcessHeap () returned 0xfd0000 [0205.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef200 [0205.255] GetProcessHeap () returned 0xfd0000 [0205.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0x3a895d0 [0205.259] GetProcessHeap () returned 0xfd0000 [0205.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a895d0 | out: hHeap=0xfd0000) returned 1 [0205.259] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0205.259] GetProcessHeap () returned 0xfd0000 [0205.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef200 | out: hHeap=0xfd0000) returned 1 [0205.259] GetProcessHeap () returned 0xfd0000 [0205.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef098 | out: hHeap=0xfd0000) returned 1 [0205.259] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d5fa84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d5fa84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.267] GetProcessHeap () returned 0xfd0000 [0205.267] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef0c0 | out: hHeap=0xfd0000) returned 1 [0205.267] GetProcessHeap () returned 0xfd0000 [0205.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0x1010fa8 [0205.267] GetProcessHeap () returned 0xfd0000 [0205.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x3a) returned 0x1010d20 [0205.267] GetProcessHeap () returned 0xfd0000 [0205.267] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x1010d20, Size=0x72) returned 0x1011b98 [0205.267] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x304 [0205.267] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0205.268] CloseHandle (hObject=0x304) returned 1 [0205.268] GetProcessHeap () returned 0xfd0000 [0205.268] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1010fa8 | out: hHeap=0xfd0000) returned 1 [0205.268] GetProcessHeap () returned 0xfd0000 [0205.268] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1011b98 | out: hHeap=0xfd0000) returned 1 [0205.268] Sleep (dwMilliseconds=0x3e8) Thread: id = 83 os_tid = 0xde8 [0142.731] GetProcessHeap () returned 0xfd0000 [0142.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x21a) returned 0xff5ed8 [0142.731] GetProcessHeap () returned 0xfd0000 [0142.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0xfe7388 [0142.731] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x240 [0142.731] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x278 [0142.731] GetComputerNameW (in: lpBuffer=0xff5ee8, nSize=0x2e9f7ec | out: lpBuffer="NQDPDE", nSize=0x2e9f7ec) returned 1 [0142.731] GetProcessHeap () returned 0xfd0000 [0142.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef570 [0142.731] GetProcessHeap () returned 0xfd0000 [0142.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0xff7ee8 [0142.731] GetProcessHeap () returned 0xfd0000 [0142.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xffbef0 [0142.731] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f7a8 | out: lphEnum=0x2e9f7a8*=0xfe1f18) returned 0x0 [0143.656] WNetEnumResourceW (in: hEnum=0xfe1f18, lpcCount=0x2e9f7a0, lpBuffer=0xff7ee8, lpBufferSize=0x2e9f7ac | out: lpcCount=0x2e9f7a0, lpBuffer=0xff7ee8, lpBufferSize=0x2e9f7ac) returned 0x103 [0143.656] WNetCloseEnum (hEnum=0xfe1f18) returned 0x0 [0143.656] GetProcessHeap () returned 0xfd0000 [0143.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0143.656] GetProcessHeap () returned 0xfd0000 [0143.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xffbef0 | out: hHeap=0xfd0000) returned 1 [0143.656] GetProcessHeap () returned 0xfd0000 [0143.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3a750d8 [0143.656] GetProcessHeap () returned 0xfd0000 [0143.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0143.656] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f790 | out: lphEnum=0x2e9f790*=0xfe8760) returned 0x0 [0143.658] WNetEnumResourceW (in: hEnum=0xfe8760, lpcCount=0x2e9f788, lpBuffer=0x3a750d8, lpBufferSize=0x2e9f794 | out: lpcCount=0x2e9f788, lpBuffer=0x3a750d8, lpBufferSize=0x2e9f794) returned 0x103 [0143.658] WNetCloseEnum (hEnum=0xfe8760) returned 0x0 [0143.658] GetProcessHeap () returned 0xfd0000 [0143.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a750d8 | out: hHeap=0xfd0000) returned 1 [0143.658] GetProcessHeap () returned 0xfd0000 [0143.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0143.658] GetProcessHeap () returned 0xfd0000 [0143.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3a750d8 [0143.658] GetProcessHeap () returned 0xfd0000 [0143.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0143.658] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f778 | out: lphEnum=0x2e9f778*=0xfe1f18) returned 0x0 [0159.779] WNetEnumResourceW (in: hEnum=0xfe1f18, lpcCount=0x2e9f770, lpBuffer=0x3a750d8, lpBufferSize=0x2e9f77c | out: lpcCount=0x2e9f770, lpBuffer=0x3a750d8, lpBufferSize=0x2e9f77c) returned 0x0 [0159.780] GetProcessHeap () returned 0xfd0000 [0159.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x1007ef0 [0159.780] GetProcessHeap () returned 0xfd0000 [0159.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.780] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x3a750d8, lphEnum=0x2e9f738 | out: lphEnum=0x2e9f738*=0xfe0490) returned 0x0 [0173.308] WNetEnumResourceW (in: hEnum=0xfe0490, lpcCount=0x2e9f730, lpBuffer=0x1007ef0, lpBufferSize=0x2e9f73c | out: lpcCount=0x2e9f730, lpBuffer=0x1007ef0, lpBufferSize=0x2e9f73c) returned 0x0 [0173.317] WNetEnumResourceW (in: hEnum=0xfe0490, lpcCount=0x2e9f730, lpBuffer=0x1007ef0, lpBufferSize=0x2e9f73c | out: lpcCount=0x2e9f730, lpBuffer=0x1007ef0, lpBufferSize=0x2e9f73c) returned 0x103 [0173.324] WNetCloseEnum (hEnum=0xfe0490) returned 0x0 [0173.324] GetProcessHeap () returned 0xfd0000 [0173.330] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1007ef0 | out: hHeap=0xfd0000) returned 1 [0173.330] GetProcessHeap () returned 0xfd0000 [0173.330] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0173.331] WNetEnumResourceW (in: hEnum=0xfe1f18, lpcCount=0x2e9f770, lpBuffer=0x3a750d8, lpBufferSize=0x2e9f77c | out: lpcCount=0x2e9f770, lpBuffer=0x3a750d8, lpBufferSize=0x2e9f77c) returned 0x103 [0173.331] WNetCloseEnum (hEnum=0xfe1f18) returned 0x0 [0173.331] GetProcessHeap () returned 0xfd0000 [0173.331] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a750d8 | out: hHeap=0xfd0000) returned 1 [0173.332] GetProcessHeap () returned 0xfd0000 [0173.332] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0173.332] GetProcessHeap () returned 0xfd0000 [0173.332] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3a21090 [0173.333] GetProcessHeap () returned 0xfd0000 [0173.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0173.333] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f7a8 | out: lphEnum=0x2e9f7a8*=0xfe8760) returned 0x0 [0173.335] WNetEnumResourceW (in: hEnum=0xfe8760, lpcCount=0x2e9f7a0, lpBuffer=0x3a21090, lpBufferSize=0x2e9f7ac | out: lpcCount=0x2e9f7a0, lpBuffer=0x3a21090, lpBufferSize=0x2e9f7ac) returned 0x103 [0173.335] WNetCloseEnum (hEnum=0xfe8760) returned 0x0 [0173.335] GetProcessHeap () returned 0xfd0000 [0173.335] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0173.335] GetProcessHeap () returned 0xfd0000 [0173.335] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0173.335] GetProcessHeap () returned 0xfd0000 [0173.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3f42870 [0173.335] GetProcessHeap () returned 0xfd0000 [0173.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0173.335] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f790 | out: lphEnum=0x2e9f790*=0x10b7900) returned 0x0 [0173.335] WNetEnumResourceW (in: hEnum=0x10b7900, lpcCount=0x2e9f788, lpBuffer=0x3f42870, lpBufferSize=0x2e9f794 | out: lpcCount=0x2e9f788, lpBuffer=0x3f42870, lpBufferSize=0x2e9f794) returned 0x0 [0173.335] GetProcessHeap () returned 0xfd0000 [0173.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3f46878 [0173.336] GetProcessHeap () returned 0xfd0000 [0173.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0173.336] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3f428b0, lphEnum=0x2e9f750 | out: lphEnum=0x2e9f750*=0x0) returned 0x4c6 [0173.336] GetProcessHeap () returned 0xfd0000 [0173.336] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f46878 | out: hHeap=0xfd0000) returned 1 [0173.336] GetProcessHeap () returned 0xfd0000 [0173.336] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0173.336] GetProcessHeap () returned 0xfd0000 [0173.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3f46878 [0173.336] GetProcessHeap () returned 0xfd0000 [0173.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0173.337] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3f42890, lphEnum=0x2e9f750 | out: lphEnum=0x2e9f750*=0x0) returned 0x4b8 [0186.525] GetProcessHeap () returned 0xfd0000 [0186.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f46878 | out: hHeap=0xfd0000) returned 1 [0186.525] GetProcessHeap () returned 0xfd0000 [0186.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0186.525] GetProcessHeap () returned 0xfd0000 [0186.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x3f46878 [0186.525] GetProcessHeap () returned 0xfd0000 [0186.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0186.525] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3f42870, lphEnum=0x2e9f750 | out: lphEnum=0x2e9f750*=0xfe8520) returned 0x0 [0186.528] WNetEnumResourceW (in: hEnum=0xfe8520, lpcCount=0x2e9f748, lpBuffer=0x3f46878, lpBufferSize=0x2e9f754 | out: lpcCount=0x2e9f748, lpBuffer=0x3f46878, lpBufferSize=0x2e9f754) returned 0x103 [0186.528] WNetCloseEnum (hEnum=0xfe8520) returned 0x0 [0186.528] GetProcessHeap () returned 0xfd0000 [0186.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f46878 | out: hHeap=0xfd0000) returned 1 [0186.528] GetProcessHeap () returned 0xfd0000 [0186.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0186.528] WNetEnumResourceW (in: hEnum=0x10b7900, lpcCount=0x2e9f788, lpBuffer=0x3f42870, lpBufferSize=0x2e9f794 | out: lpcCount=0x2e9f788, lpBuffer=0x3f42870, lpBufferSize=0x2e9f794) returned 0x103 [0186.528] WNetCloseEnum (hEnum=0x10b7900) returned 0x0 [0186.528] GetProcessHeap () returned 0xfd0000 [0186.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0186.528] GetProcessHeap () returned 0xfd0000 [0186.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.530] GetProcessHeap () returned 0xfd0000 [0186.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x3a98) returned 0x40228d8 [0186.531] GetIpAddrTable (in: pIpAddrTable=0x40228d8, pdwSize=0x2e9f7b4, bOrder=0 | out: pIpAddrTable=0x40228d8, pdwSize=0x2e9f7b4) returned 0x0 [0187.172] htonl (hostlong=0xc500a8c0) returned 0xc0a800c5 [0187.172] htonl (hostlong=0xc500a8c0) returned 0xc0a800c5 [0187.172] htonl (hostlong=0xffffff) returned 0xffffff00 [0187.172] htons (hostshort=0x1bd) returned 0xbd01 [0187.172] GetProcessHeap () returned 0xfd0000 [0187.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x800) returned 0x1009f00 [0187.172] GetProcessHeap () returned 0xfd0000 [0187.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x800) returned 0x100a708 [0187.172] htonl (hostlong=0xc0a80000) returned 0xa8c0 [0187.173] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.175] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80001) returned 0x100a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80002) returned 0x200a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80003) returned 0x300a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80004) returned 0x400a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80005) returned 0x500a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80006) returned 0x600a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80007) returned 0x700a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80008) returned 0x800a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a80009) returned 0x900a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.176] htonl (hostlong=0xc0a8000a) returned 0xa00a8c0 [0187.176] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.176] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a8000b) returned 0xb00a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a8000c) returned 0xc00a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a8000d) returned 0xd00a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a8000e) returned 0xe00a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a8000f) returned 0xf00a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80010) returned 0x1000a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80011) returned 0x1100a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80012) returned 0x1200a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80013) returned 0x1300a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80014) returned 0x1400a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80015) returned 0x1500a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80016) returned 0x1600a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80017) returned 0x1700a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80018) returned 0x1800a8c0 [0187.177] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.177] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.177] htonl (hostlong=0xc0a80019) returned 0x1900a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a8001a) returned 0x1a00a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a8001b) returned 0x1b00a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a8001c) returned 0x1c00a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a8001d) returned 0x1d00a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a8001e) returned 0x1e00a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a8001f) returned 0x1f00a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a80020) returned 0x2000a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a80021) returned 0x2100a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a80022) returned 0x2200a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a80023) returned 0x2300a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a80024) returned 0x2400a8c0 [0187.178] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.178] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.178] htonl (hostlong=0xc0a80025) returned 0x2500a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80026) returned 0x2600a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80027) returned 0x2700a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80028) returned 0x2800a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80029) returned 0x2900a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a8002a) returned 0x2a00a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a8002b) returned 0x2b00a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a8002c) returned 0x2c00a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a8002d) returned 0x2d00a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a8002e) returned 0x2e00a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a8002f) returned 0x2f00a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80030) returned 0x3000a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80031) returned 0x3100a8c0 [0187.179] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.179] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.179] htonl (hostlong=0xc0a80032) returned 0x3200a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80033) returned 0x3300a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80034) returned 0x3400a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80035) returned 0x3500a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80036) returned 0x3600a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80037) returned 0x3700a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80038) returned 0x3800a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a80039) returned 0x3900a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a8003a) returned 0x3a00a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a8003b) returned 0x3b00a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a8003c) returned 0x3c00a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.180] htonl (hostlong=0xc0a8003d) returned 0x3d00a8c0 [0187.180] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.180] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a8003e) returned 0x3e00a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a8003f) returned 0x3f00a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80040) returned 0x4000a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80041) returned 0x4100a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80042) returned 0x4200a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80043) returned 0x4300a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80044) returned 0x4400a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80045) returned 0x4500a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80046) returned 0x4600a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80047) returned 0x4700a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80048) returned 0x4800a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a80049) returned 0x4900a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.181] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.181] htonl (hostlong=0xc0a8004a) returned 0x4a00a8c0 [0187.181] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a8004b) returned 0x4b00a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a8004c) returned 0x4c00a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a8004d) returned 0x4d00a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a8004e) returned 0x4e00a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a8004f) returned 0x4f00a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a80050) returned 0x5000a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a80051) returned 0x5100a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a80052) returned 0x5200a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a80053) returned 0x5300a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a80054) returned 0x5400a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.182] htonl (hostlong=0xc0a80055) returned 0x5500a8c0 [0187.182] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.182] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80056) returned 0x5600a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80057) returned 0x5700a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80058) returned 0x5800a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80059) returned 0x5900a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a8005a) returned 0x5a00a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a8005b) returned 0x5b00a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a8005c) returned 0x5c00a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a8005d) returned 0x5d00a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a8005e) returned 0x5e00a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a8005f) returned 0x5f00a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80060) returned 0x6000a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80061) returned 0x6100a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.183] htonl (hostlong=0xc0a80062) returned 0x6200a8c0 [0187.183] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.183] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80063) returned 0x6300a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80064) returned 0x6400a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80065) returned 0x6500a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80066) returned 0x6600a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80067) returned 0x6700a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80068) returned 0x6800a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a80069) returned 0x6900a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a8006a) returned 0x6a00a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a8006b) returned 0x6b00a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a8006c) returned 0x6c00a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a8006d) returned 0x6d00a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a8006e) returned 0x6e00a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.184] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.184] htonl (hostlong=0xc0a8006f) returned 0x6f00a8c0 [0187.184] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80070) returned 0x7000a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80071) returned 0x7100a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80072) returned 0x7200a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80073) returned 0x7300a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80074) returned 0x7400a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80075) returned 0x7500a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80076) returned 0x7600a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80077) returned 0x7700a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80078) returned 0x7800a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a80079) returned 0x7900a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a8007a) returned 0x7a00a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a8007b) returned 0x7b00a8c0 [0187.185] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.185] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.185] htonl (hostlong=0xc0a8007c) returned 0x7c00a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a8007d) returned 0x7d00a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a8007e) returned 0x7e00a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a8007f) returned 0x7f00a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80080) returned 0x8000a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80081) returned 0x8100a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80082) returned 0x8200a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80083) returned 0x8300a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80084) returned 0x8400a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80085) returned 0x8500a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80086) returned 0x8600a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80087) returned 0x8700a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.186] htonl (hostlong=0xc0a80088) returned 0x8800a8c0 [0187.186] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.186] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80089) returned 0x8900a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a8008a) returned 0x8a00a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a8008b) returned 0x8b00a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a8008c) returned 0x8c00a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a8008d) returned 0x8d00a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a8008e) returned 0x8e00a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a8008f) returned 0x8f00a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80090) returned 0x9000a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80091) returned 0x9100a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80092) returned 0x9200a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80093) returned 0x9300a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80094) returned 0x9400a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.187] htonl (hostlong=0xc0a80095) returned 0x9500a8c0 [0187.187] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.187] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a80096) returned 0x9600a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a80097) returned 0x9700a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a80098) returned 0x9800a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a80099) returned 0x9900a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a8009a) returned 0x9a00a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a8009b) returned 0x9b00a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a8009c) returned 0x9c00a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a8009d) returned 0x9d00a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a8009e) returned 0x9e00a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a8009f) returned 0x9f00a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a800a0) returned 0xa000a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a800a1) returned 0xa100a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.188] htonl (hostlong=0xc0a800a2) returned 0xa200a8c0 [0187.188] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.188] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a3) returned 0xa300a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a4) returned 0xa400a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a5) returned 0xa500a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a6) returned 0xa600a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a7) returned 0xa700a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a8) returned 0xa800a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800a9) returned 0xa900a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800aa) returned 0xaa00a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800ab) returned 0xab00a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800ac) returned 0xac00a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800ad) returned 0xad00a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800ae) returned 0xae00a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.189] htonl (hostlong=0xc0a800af) returned 0xaf00a8c0 [0187.189] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.189] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b0) returned 0xb000a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b1) returned 0xb100a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b2) returned 0xb200a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b3) returned 0xb300a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b4) returned 0xb400a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b5) returned 0xb500a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b6) returned 0xb600a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b7) returned 0xb700a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.190] htonl (hostlong=0xc0a800b8) returned 0xb800a8c0 [0187.190] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.190] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800b9) returned 0xb900a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800ba) returned 0xba00a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800bb) returned 0xbb00a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800bc) returned 0xbc00a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800bd) returned 0xbd00a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800be) returned 0xbe00a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800bf) returned 0xbf00a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800c0) returned 0xc000a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800c1) returned 0xc100a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800c2) returned 0xc200a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.191] htonl (hostlong=0xc0a800c3) returned 0xc300a8c0 [0187.191] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.191] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.192] htonl (hostlong=0xc0a800c4) returned 0xc400a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f770 | out: argp=0x2e9f770) returned -1 [0187.192] GetProcessHeap () returned 0xfd0000 [0187.192] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1009f00 | out: hHeap=0xfd0000) returned 1 [0187.192] GetProcessHeap () returned 0xfd0000 [0187.192] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100a708 | out: hHeap=0xfd0000) returned 1 [0187.192] htons (hostshort=0x1bd) returned 0xbd01 [0187.192] GetProcessHeap () returned 0xfd0000 [0187.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x800) returned 0x1009f00 [0187.192] GetProcessHeap () returned 0xfd0000 [0187.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x800) returned 0x100a708 [0187.192] htonl (hostlong=0xc0a800c6) returned 0xc600a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.192] htonl (hostlong=0xc0a800c7) returned 0xc700a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.192] htonl (hostlong=0xc0a800c8) returned 0xc800a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.192] htonl (hostlong=0xc0a800c9) returned 0xc900a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.192] htonl (hostlong=0xc0a800ca) returned 0xca00a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.192] htonl (hostlong=0xc0a800cb) returned 0xcb00a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.192] htonl (hostlong=0xc0a800cc) returned 0xcc00a8c0 [0187.192] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.192] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800cd) returned 0xcd00a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800ce) returned 0xce00a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800cf) returned 0xcf00a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d0) returned 0xd000a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d1) returned 0xd100a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d2) returned 0xd200a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d3) returned 0xd300a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d4) returned 0xd400a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d5) returned 0xd500a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d6) returned 0xd600a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d7) returned 0xd700a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.193] htonl (hostlong=0xc0a800d8) returned 0xd800a8c0 [0187.193] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.193] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800d9) returned 0xd900a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800da) returned 0xda00a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800db) returned 0xdb00a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800dc) returned 0xdc00a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800dd) returned 0xdd00a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800de) returned 0xde00a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800df) returned 0xdf00a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800e0) returned 0xe000a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800e1) returned 0xe100a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.349] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.349] htonl (hostlong=0xc0a800e2) returned 0xe200a8c0 [0187.349] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.350] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.350] htonl (hostlong=0xc0a800e3) returned 0xe300a8c0 [0187.350] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.350] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.350] htonl (hostlong=0xc0a800e4) returned 0xe400a8c0 [0187.350] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.351] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.352] htonl (hostlong=0xc0a800e5) returned 0xe500a8c0 [0187.365] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.368] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.368] htonl (hostlong=0xc0a800e6) returned 0xe600a8c0 [0187.368] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.368] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.368] htonl (hostlong=0xc0a800e7) returned 0xe700a8c0 [0187.368] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.368] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.370] htonl (hostlong=0xc0a800e8) returned 0xe800a8c0 [0187.373] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.374] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.374] htonl (hostlong=0xc0a800e9) returned 0xe900a8c0 [0187.374] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.374] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.374] htonl (hostlong=0xc0a800ea) returned 0xea00a8c0 [0187.374] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.374] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.375] htonl (hostlong=0xc0a800eb) returned 0xeb00a8c0 [0187.375] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.375] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.375] htonl (hostlong=0xc0a800ec) returned 0xec00a8c0 [0187.375] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.375] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.375] htonl (hostlong=0xc0a800ed) returned 0xed00a8c0 [0187.384] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.384] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.384] htonl (hostlong=0xc0a800ee) returned 0xee00a8c0 [0187.384] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.384] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.384] htonl (hostlong=0xc0a800ef) returned 0xef00a8c0 [0187.384] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.384] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.384] htonl (hostlong=0xc0a800f0) returned 0xf000a8c0 [0187.384] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.384] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.384] htonl (hostlong=0xc0a800f1) returned 0xf100a8c0 [0187.384] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f2) returned 0xf200a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f3) returned 0xf300a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f4) returned 0xf400a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f5) returned 0xf500a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f6) returned 0xf600a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f7) returned 0xf700a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f8) returned 0xf800a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] htonl (hostlong=0xc0a800f9) returned 0xf900a8c0 [0187.385] socket (af=2, type=1, protocol=6) returned 0xffffffff [0187.385] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0x2e9f768 | out: argp=0x2e9f768) returned -1 [0187.385] GetProcessHeap () returned 0xfd0000 [0187.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1009f00 | out: hHeap=0xfd0000) returned 1 [0187.386] GetProcessHeap () returned 0xfd0000 [0187.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100a708 | out: hHeap=0xfd0000) returned 1 [0187.386] htonl (hostlong=0x100007f) returned 0x7f000001 [0187.386] GetProcessHeap () returned 0xfd0000 [0187.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40228d8 | out: hHeap=0xfd0000) returned 1 [0187.386] WaitForSingleObject (hHandle=0x278, dwMilliseconds=0xffffffff) returned 0x0 [0187.386] GetProcessHeap () returned 0xfd0000 [0187.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef570 | out: hHeap=0xfd0000) returned 1 [0187.386] Sleep (dwMilliseconds=0x2710) [0197.562] GetProcessHeap () returned 0xfd0000 [0197.562] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x10ba600 [0197.562] GetProcessHeap () returned 0xfd0000 [0197.562] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0197.563] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f7a8 | out: lphEnum=0x2e9f7a8*=0x4029a60) returned 0x0 [0198.198] WNetEnumResourceW (in: hEnum=0x4029a60, lpcCount=0x2e9f7a0, lpBuffer=0x10ba600, lpBufferSize=0x2e9f7ac | out: lpcCount=0x2e9f7a0, lpBuffer=0x10ba600, lpBufferSize=0x2e9f7ac) returned 0x103 [0198.199] WNetCloseEnum (hEnum=0x4029a60) returned 0x0 [0198.199] GetProcessHeap () returned 0xfd0000 [0198.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10ba600 | out: hHeap=0xfd0000) returned 1 [0198.199] GetProcessHeap () returned 0xfd0000 [0198.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0198.200] GetProcessHeap () returned 0xfd0000 [0198.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x10ba600 [0198.200] GetProcessHeap () returned 0xfd0000 [0198.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0198.200] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f790 | out: lphEnum=0x2e9f790*=0xfe8820) returned 0x0 [0198.202] WNetEnumResourceW (in: hEnum=0xfe8820, lpcCount=0x2e9f788, lpBuffer=0x10ba600, lpBufferSize=0x2e9f794 | out: lpcCount=0x2e9f788, lpBuffer=0x10ba600, lpBufferSize=0x2e9f794) returned 0x103 [0198.202] WNetCloseEnum (hEnum=0xfe8820) returned 0x0 [0198.202] GetProcessHeap () returned 0xfd0000 [0198.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10ba600 | out: hHeap=0xfd0000) returned 1 [0198.202] GetProcessHeap () returned 0xfd0000 [0198.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0198.203] GetProcessHeap () returned 0xfd0000 [0198.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4000) returned 0x10ba600 [0198.203] GetProcessHeap () returned 0xfd0000 [0198.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0198.204] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2e9f778) Thread: id = 84 os_tid = 0xdec [0142.740] GetLogicalDrives () returned 0x4 [0142.740] GetProcessHeap () returned 0xfd0000 [0142.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0xfe27e8 [0142.741] GetProcessHeap () returned 0xfd0000 [0142.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0xfe7418 [0142.741] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x284 [0142.741] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x288 [0142.741] GetProcessHeap () returned 0xfd0000 [0142.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef6d8 [0142.741] GetProcessHeap () returned 0xfd0000 [0142.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef700 [0142.741] GetProcessHeap () returned 0xfd0000 [0142.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfef458 [0142.747] GetProcessHeap () returned 0xfd0000 [0142.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe32e8 [0142.747] GetProcessHeap () returned 0xfd0000 [0142.748] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe32e8 | out: hHeap=0xfd0000) returned 1 [0142.748] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef700, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.748] GetProcessHeap () returned 0xfd0000 [0142.751] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef458 | out: hHeap=0xfd0000) returned 1 [0142.751] GetProcessHeap () returned 0xfd0000 [0142.751] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef6d8 | out: hHeap=0xfd0000) returned 1 [0142.751] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2fdfafc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2fdfafc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.757] GetProcessHeap () returned 0xfd0000 [0142.757] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef700 | out: hHeap=0xfd0000) returned 1 [0142.757] GetProcessHeap () returned 0xfd0000 [0142.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee368 [0142.757] GetProcessHeap () returned 0xfd0000 [0142.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee410 [0142.757] GetProcessHeap () returned 0xfd0000 [0142.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee3f8 [0142.757] GetProcessHeap () returned 0xfd0000 [0142.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xff5558 [0142.757] GetProcessHeap () returned 0xfd0000 [0142.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee3c8 [0142.759] htonl (hostlong=0xb4197730) returned 0x307719b4 [0142.762] QueryPerformanceCounter (in: lpPerformanceCount=0x2fdf9f0 | out: lpPerformanceCount=0x2fdf9f0*=6298275289) returned 1 [0142.762] GetTickCount () returned 0x1139e69 [0142.762] GetCurrentProcessId () returned 0xd48 [0142.763] GetCurrentThreadId () returned 0xdec [0142.763] GetLocalTime (in: lpSystemTime=0x2fdf9d8 | out: lpSystemTime=0x2fdf9d8*(wYear=0x7e4, wMonth=0x7, wDayOfWeek=0x6, wDay=0xb, wHour=0x10, wMinute=0x29, wSecond=0x1e, wMilliseconds=0x75)) [0142.763] SystemTimeToFileTime (in: lpSystemTime=0x2fdf9d8, lpFileTime=0x2fdf9e8 | out: lpFileTime=0x2fdf9e8) returned 1 [0142.763] QueryPerformanceCounter (in: lpPerformanceCount=0x2fdf9f0 | out: lpPerformanceCount=0x2fdf9f0*=6298295206) returned 1 [0142.769] GetProcessHeap () returned 0xfd0000 [0142.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x28) returned 0xfe7448 [0142.769] GetProcessHeap () returned 0xfd0000 [0142.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee428 [0142.769] GetProcessHeap () returned 0xfd0000 [0142.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0xfe8c78 [0142.769] GetProcessHeap () returned 0xfd0000 [0142.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x14) returned 0xfe86e0 [0142.769] GetProcessHeap () returned 0xfd0000 [0142.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee458 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x80) returned 0xfe32e8 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee470 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x82) returned 0xfe1898 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee488 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0xfe8d88 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee4a0 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x80) returned 0xfe1730 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee500 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x2) returned 0xfe8d98 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0x100cd98 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee530 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x80) returned 0xfe17b8 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee518 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0x100cd08 [0142.773] GetProcessHeap () returned 0xfd0000 [0142.774] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe8d98, Size=0x82) returned 0xfe0280 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x100cd08, Size=0x100) returned 0xfe2428 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee548 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x82) returned 0xff6100 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee560 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x82) returned 0xff6190 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe0280, Size=0x104) returned 0xfe0280 [0142.774] GetProcessHeap () returned 0xfd0000 [0142.774] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2428, Size=0x200) returned 0x100d1f0 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100cd98 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100d1f0 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee518 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1730 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee4a0 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe17b8 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee530 | out: hHeap=0xfd0000) returned 1 [0142.775] GetProcessHeap () returned 0xfd0000 [0142.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0280 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee500 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff6100 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee548 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff6190 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee560 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8c78 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee428 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1898 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee470 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe32e8 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee458 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8d88 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee488 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe7448 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe86e0 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xa4) returned 0xfe0a70 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee410 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee3f8 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff5558 | out: hHeap=0xfd0000) returned 1 [0142.776] GetProcessHeap () returned 0xfd0000 [0142.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee3c8 | out: hHeap=0xfd0000) returned 1 [0142.777] GetProcessHeap () returned 0xfd0000 [0142.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee368 | out: hHeap=0xfd0000) returned 1 [0142.777] GetProcessHeap () returned 0xfd0000 [0142.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x18) returned 0xfe8560 [0142.777] GetProcessHeap () returned 0xfd0000 [0142.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0xe) returned 0xfee470 [0142.777] ResetEvent (hEvent=0x288) returned 1 [0142.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9756b3, lpParameter=0xfe8560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0142.777] CloseHandle (hObject=0x28c) returned 1 [0142.777] GetProcessHeap () returned 0xfd0000 [0142.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee560 [0142.777] GetProcessHeap () returned 0xfd0000 [0142.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee368 [0142.777] GetProcessHeap () returned 0xfd0000 [0142.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee500 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xff5558 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee3c8 [0142.778] htonl (hostlong=0xb4197730) returned 0x307719b4 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x28) returned 0xfe7448 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee3f8 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0xfe8c78 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x14) returned 0xfe8600 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee410 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x80) returned 0xfe32e8 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee518 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x82) returned 0xfe1898 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee428 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0xfe8d88 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee458 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x80) returned 0xfe0280 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee530 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x2) returned 0xfe8d98 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0x100cbc8 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee548 [0142.778] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x80) returned 0xfe0308 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee488 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x4) returned 0x100ca68 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe8d98, Size=0x82) returned 0xfe1730 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0x100ca68, Size=0x100) returned 0xfe2428 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee4a0 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x82) returned 0xff6100 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10) returned 0xfee5a8 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x82) returned 0xff6190 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe1730, Size=0x104) returned 0xfe1730 [0142.779] GetProcessHeap () returned 0xfd0000 [0142.779] RtlReAllocateHeap (Heap=0xfd0000, Flags=0x0, Ptr=0xfe2428, Size=0x200) returned 0x100d1f0 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100cbc8 | out: hHeap=0xfd0000) returned 1 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100d1f0 | out: hHeap=0xfd0000) returned 1 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee488 | out: hHeap=0xfd0000) returned 1 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0280 | out: hHeap=0xfd0000) returned 1 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee458 | out: hHeap=0xfd0000) returned 1 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0308 | out: hHeap=0xfd0000) returned 1 [0142.780] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee548 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1730 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee530 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff6100 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee4a0 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff6190 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee5a8 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8c78 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee3f8 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1898 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee518 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe32e8 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee410 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8d88 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee428 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe7448 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8600 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0xa4) returned 0xfe1360 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee368 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee500 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff5558 | out: hHeap=0xfd0000) returned 1 [0142.781] GetProcessHeap () returned 0xfd0000 [0142.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee3c8 | out: hHeap=0xfd0000) returned 1 [0142.782] GetProcessHeap () returned 0xfd0000 [0142.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee560 | out: hHeap=0xfd0000) returned 1 [0142.782] GetProcessHeap () returned 0xfd0000 [0142.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x18) returned 0xfe8600 [0142.782] GetProcessHeap () returned 0xfd0000 [0142.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0xe) returned 0xfee500 [0142.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9756b3, lpParameter=0xfe8600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0142.782] CloseHandle (hObject=0x28c) returned 1 [0142.783] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0xffffffff) returned 0x0 [0193.512] CloseHandle (hObject=0x288) returned 1 [0193.512] CloseHandle (hObject=0x284) returned 1 [0193.512] GetProcessHeap () returned 0xfd0000 [0193.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe7418 | out: hHeap=0xfd0000) returned 1 [0193.512] GetProcessHeap () returned 0xfd0000 [0193.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe27e8 | out: hHeap=0xfd0000) returned 1 [0193.512] GetProcessHeap () returned 0xfd0000 [0193.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe85c0 | out: hHeap=0xfd0000) returned 1 Thread: id = 85 os_tid = 0xdf0 [0142.839] GetLogicalDrives () returned 0x4 [0142.839] GetProcessHeap () returned 0xfd0000 [0142.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x20) returned 0xfef458 [0142.839] GetProcessHeap () returned 0xfd0000 [0142.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x8, Size=0x1e) returned 0xfef318 [0142.839] GetProcessHeap () returned 0xfd0000 [0142.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x1e) returned 0xfeefa8 [0142.839] GetProcessHeap () returned 0xfd0000 [0142.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x90) returned 0xfe1b38 [0142.839] GetProcessHeap () returned 0xfd0000 [0142.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1b38 | out: hHeap=0xfd0000) returned 1 [0142.839] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xfef318, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0142.840] GetProcessHeap () returned 0xfd0000 [0142.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfeefa8 | out: hHeap=0xfd0000) returned 1 [0142.840] GetProcessHeap () returned 0xfd0000 [0142.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef458 | out: hHeap=0xfd0000) returned 1 [0142.840] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x311fe64, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x311fe64*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.840] GetProcessHeap () returned 0xfd0000 [0142.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfef318 | out: hHeap=0xfd0000) returned 1 [0142.840] GetProcessHeap () returned 0xfd0000 [0142.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x40) returned 0xfe2cb0 [0142.840] GetProcessHeap () returned 0xfd0000 [0142.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0x100cad0 [0142.840] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b0 [0142.840] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b4 [0142.840] GetLogicalDrives () returned 0x4 [0142.840] Sleep (dwMilliseconds=0x3e8) [0144.086] GetLogicalDrives () returned 0x4 [0144.086] Sleep (dwMilliseconds=0x3e8) [0145.323] GetLogicalDrives () returned 0x4 [0145.323] Sleep (dwMilliseconds=0x3e8) [0146.537] GetLogicalDrives () returned 0x4 [0146.540] Sleep (dwMilliseconds=0x3e8) [0147.716] GetLogicalDrives () returned 0x4 [0147.716] Sleep (dwMilliseconds=0x3e8) [0148.942] GetLogicalDrives () returned 0x4 [0148.942] Sleep (dwMilliseconds=0x3e8) [0150.167] GetLogicalDrives () returned 0x4 [0150.167] Sleep (dwMilliseconds=0x3e8) [0151.435] GetLogicalDrives () returned 0x4 [0151.435] Sleep (dwMilliseconds=0x3e8) [0152.705] GetLogicalDrives () returned 0x4 [0152.705] Sleep (dwMilliseconds=0x3e8) [0154.551] GetLogicalDrives () returned 0x4 [0154.551] Sleep (dwMilliseconds=0x3e8) [0156.102] GetLogicalDrives () returned 0x4 [0156.102] Sleep (dwMilliseconds=0x3e8) [0157.324] GetLogicalDrives () returned 0x4 [0157.324] Sleep (dwMilliseconds=0x3e8) [0159.771] GetLogicalDrives () returned 0x4 [0159.771] Sleep (dwMilliseconds=0x3e8) [0161.032] GetLogicalDrives () returned 0x4 [0161.032] Sleep (dwMilliseconds=0x3e8) [0162.358] GetLogicalDrives () returned 0x4 [0162.358] Sleep (dwMilliseconds=0x3e8) [0163.738] GetLogicalDrives () returned 0x4 [0163.738] Sleep (dwMilliseconds=0x3e8) [0164.861] GetLogicalDrives () returned 0x4 [0164.861] Sleep (dwMilliseconds=0x3e8) [0166.076] GetLogicalDrives () returned 0x4 [0166.076] Sleep (dwMilliseconds=0x3e8) [0167.360] GetLogicalDrives () returned 0x4 [0167.361] Sleep (dwMilliseconds=0x3e8) [0168.476] GetLogicalDrives () returned 0x4 [0168.476] Sleep (dwMilliseconds=0x3e8) [0169.662] GetLogicalDrives () returned 0x4 [0169.662] Sleep (dwMilliseconds=0x3e8) [0170.872] GetLogicalDrives () returned 0x4 [0170.872] Sleep (dwMilliseconds=0x3e8) [0172.159] GetLogicalDrives () returned 0x4 [0172.159] Sleep (dwMilliseconds=0x3e8) [0173.289] GetLogicalDrives () returned 0x4 [0173.289] Sleep (dwMilliseconds=0x3e8) [0174.448] GetLogicalDrives () returned 0x4 [0174.448] Sleep (dwMilliseconds=0x3e8) [0175.558] GetLogicalDrives () returned 0x4 [0175.558] Sleep (dwMilliseconds=0x3e8) [0176.784] GetLogicalDrives () returned 0x4 [0176.784] Sleep (dwMilliseconds=0x3e8) [0177.917] GetLogicalDrives () returned 0x4 [0177.917] Sleep (dwMilliseconds=0x3e8) [0178.981] GetLogicalDrives () returned 0x4 [0178.981] Sleep (dwMilliseconds=0x3e8) [0180.411] GetLogicalDrives () returned 0x4 [0180.411] Sleep (dwMilliseconds=0x3e8) [0181.506] GetLogicalDrives () returned 0x4 [0181.506] Sleep (dwMilliseconds=0x3e8) [0182.589] GetLogicalDrives () returned 0x4 [0182.589] Sleep (dwMilliseconds=0x3e8) [0183.652] GetLogicalDrives () returned 0x4 [0183.652] Sleep (dwMilliseconds=0x3e8) [0184.722] GetLogicalDrives () returned 0x4 [0184.722] Sleep (dwMilliseconds=0x3e8) [0186.270] GetLogicalDrives () returned 0x4 [0186.270] Sleep (dwMilliseconds=0x3e8) [0187.387] GetLogicalDrives () returned 0x4 [0187.387] Sleep (dwMilliseconds=0x3e8) [0188.538] GetLogicalDrives () returned 0x4 [0188.538] Sleep (dwMilliseconds=0x3e8) [0189.681] GetLogicalDrives () returned 0x4 [0189.682] Sleep (dwMilliseconds=0x3e8) [0190.855] GetLogicalDrives () returned 0x4 [0190.855] Sleep (dwMilliseconds=0x3e8) [0192.362] GetLogicalDrives () returned 0x4 [0192.362] Sleep (dwMilliseconds=0x3e8) [0193.630] CloseHandle (hObject=0x2b4) returned 1 [0193.630] CloseHandle (hObject=0x2b0) returned 1 [0193.630] GetProcessHeap () returned 0xfd0000 [0193.630] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100cad0 | out: hHeap=0xfd0000) returned 1 [0193.630] GetProcessHeap () returned 0xfd0000 [0193.630] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe2cb0 | out: hHeap=0xfd0000) returned 1 [0193.630] GetProcessHeap () returned 0xfd0000 [0193.630] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe86c0 | out: hHeap=0xfd0000) returned 1 Thread: id = 86 os_tid = 0xdf4 [0142.875] GetProcessHeap () returned 0xfd0000 [0142.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x38) returned 0xfe9840 [0142.875] GetProcessHeap () returned 0xfd0000 [0142.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x18) returned 0xfe86e0 [0142.875] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2fc [0142.875] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x300 [0142.875] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x304 [0142.875] GetProcessHeap () returned 0xfd0000 [0142.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10566d8 [0142.876] GetProcessHeap () returned 0xfd0000 [0142.876] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10666e0 [0142.876] GetProcessHeap () returned 0xfd0000 [0142.876] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfe0490 [0142.876] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0142.876] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0142.876] Wow64DisableWow64FsRedirection (in: OldValue=0x335f7f4 | out: OldValue=0x335f7f4*=0x0) returned 1 [0142.876] GetProcessHeap () returned 0xfd0000 [0142.876] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0142.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x335f7fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0142.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x335f7fc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0142.878] GetProcessHeap () returned 0xfd0000 [0142.878] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10766e8 [0142.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x335f570 | out: lpFindFileData=0x335f570*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xfe9900 [0142.881] GetProcessHeap () returned 0xfd0000 [0142.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0142.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xfe9d00 [0142.883] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0142.883] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0142.883] GetProcessHeap () returned 0xfd0000 [0142.883] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a8710 [0142.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.884] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.884] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc605d0ea, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc605d0ea, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DOWNLE~1.EJE")) returned 1 [0142.884] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="OOBE_2~1.EJE")) returned 1 [0142.884] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0142.884] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 0 [0142.884] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.885] GetProcessHeap () returned 0xfd0000 [0142.885] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a8710 | out: hHeap=0xfd0000) returned 1 [0142.885] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0142.886] GetProcessHeap () returned 0xfd0000 [0142.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a8710 [0142.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.890] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.890] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc637e0b7, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc637e0b7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc63b639d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~2.EJE")) returned 1 [0142.890] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60cf5ed, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60cf5ed, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~1.EJE")) returned 1 [0142.890] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60f58df, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60f58df, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60f58df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6331bef, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6331bef, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6331bef, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PREOOB~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 0 [0142.891] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.892] GetProcessHeap () returned 0xfd0000 [0142.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a8710 | out: hHeap=0xfd0000) returned 1 [0142.892] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0142.892] FindClose (in: hFindFile=0xfe9d00 | out: hFindFile=0xfe9d00) returned 1 [0142.892] GetProcessHeap () returned 0xfd0000 [0142.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0142.893] FindNextFileW (in: hFindFile=0xfe9900, lpFindFileData=0x335f570 | out: lpFindFileData=0x335f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0142.893] GetProcessHeap () returned 0xfd0000 [0142.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0142.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName=".", cAlternateFileName="")) returned 0xfe9d00 [0142.896] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="..", cAlternateFileName="")) returned 1 [0142.896] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0142.896] GetProcessHeap () returned 0xfd0000 [0142.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0xfd7c0a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x16, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x714, cFileName="￿ܖ", cAlternateFileName="咊\x97þ曠Ć\x7f")) returned 0xffffffff [0142.897] GetProcessHeap () returned 0xfd0000 [0142.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0142.897] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0142.897] GetProcessHeap () returned 0xfd0000 [0142.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.898] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x714, cFileName="..", cAlternateFileName="")) returned 1 [0142.898] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x533c449f, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c805e, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x714, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.898] SetEvent (hEvent=0x300) returned 1 [0142.898] ResetEvent (hEvent=0x304) returned 1 [0142.898] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x714, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 1 [0142.898] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x714, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 0 [0142.898] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.898] GetProcessHeap () returned 0xfd0000 [0142.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0142.898] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0142.899] FindClose (in: hFindFile=0xfe9d00 | out: hFindFile=0xfe9d00) returned 1 [0142.899] GetProcessHeap () returned 0xfd0000 [0142.899] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0142.900] FindNextFileW (in: hFindFile=0xfe9900, lpFindFileData=0x335f570 | out: lpFindFileData=0x335f570*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0142.900] FindNextFileW (in: hFindFile=0xfe9900, lpFindFileData=0x335f570 | out: lpFindFileData=0x335f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0142.900] GetProcessHeap () returned 0xfd0000 [0142.900] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0142.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName=".", cAlternateFileName="")) returned 0xfe9c40 [0142.913] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="..", cAlternateFileName="")) returned 1 [0142.914] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1025", cAlternateFileName="")) returned 1 [0142.914] GetProcessHeap () returned 0xfd0000 [0142.914] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.918] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0142.918] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.918] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.918] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.918] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.918] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.919] GetProcessHeap () returned 0xfd0000 [0142.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0142.920] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1028", cAlternateFileName="")) returned 1 [0142.920] GetProcessHeap () returned 0xfd0000 [0142.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0142.926] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0142.926] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.926] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66154e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66154e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc663b846, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.926] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.926] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.926] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0142.927] GetProcessHeap () returned 0xfd0000 [0142.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0142.928] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1029", cAlternateFileName="")) returned 1 [0142.928] GetProcessHeap () returned 0xfd0000 [0142.928] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.933] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0142.933] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6661a20, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6661a20, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6687c2f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.933] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.933] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.933] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.933] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.934] GetProcessHeap () returned 0xfd0000 [0142.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0142.935] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1030", cAlternateFileName="")) returned 1 [0142.935] GetProcessHeap () returned 0xfd0000 [0142.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.942] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0142.942] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66adc60, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66adc60, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.942] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66d3f72, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66d3f72, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.942] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.942] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.942] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.943] GetProcessHeap () returned 0xfd0000 [0142.943] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0142.943] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1031", cAlternateFileName="")) returned 1 [0142.944] GetProcessHeap () returned 0xfd0000 [0142.944] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.081] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.081] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67203e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc67203e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc67203e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.081] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6746675, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6746675, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.081] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.081] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.081] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.081] GetProcessHeap () returned 0xfd0000 [0143.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.081] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1032", cAlternateFileName="")) returned 1 [0143.082] GetProcessHeap () returned 0xfd0000 [0143.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.084] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.084] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.084] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc695c8d9, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc695c8d9, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.084] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.084] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.084] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.085] GetProcessHeap () returned 0xfd0000 [0143.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.085] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1033", cAlternateFileName="")) returned 1 [0143.085] GetProcessHeap () returned 0xfd0000 [0143.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.090] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.090] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.090] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.090] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.090] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.090] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.091] GetProcessHeap () returned 0xfd0000 [0143.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.091] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1035", cAlternateFileName="")) returned 1 [0143.091] GetProcessHeap () returned 0xfd0000 [0143.091] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.093] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.093] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.093] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.093] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.093] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.093] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.094] GetProcessHeap () returned 0xfd0000 [0143.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.094] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1036", cAlternateFileName="")) returned 1 [0143.094] GetProcessHeap () returned 0xfd0000 [0143.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.096] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.096] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.096] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.097] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.097] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.097] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.097] GetProcessHeap () returned 0xfd0000 [0143.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.097] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1037", cAlternateFileName="")) returned 1 [0143.098] GetProcessHeap () returned 0xfd0000 [0143.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.100] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.101] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f06165, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6f06165, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.101] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc718eb45, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc718eb45, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.101] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.101] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.101] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.102] GetProcessHeap () returned 0xfd0000 [0143.102] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.102] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1038", cAlternateFileName="")) returned 1 [0143.102] GetProcessHeap () returned 0xfd0000 [0143.102] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.103] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.104] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.104] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71daed0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71daed0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.104] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.104] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.104] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.105] GetProcessHeap () returned 0xfd0000 [0143.105] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.105] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1040", cAlternateFileName="")) returned 1 [0143.105] GetProcessHeap () returned 0xfd0000 [0143.105] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.107] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.107] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc720100d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.107] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.107] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.107] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.107] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.108] GetProcessHeap () returned 0xfd0000 [0143.108] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.108] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1041", cAlternateFileName="")) returned 1 [0143.108] GetProcessHeap () returned 0xfd0000 [0143.108] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.110] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.110] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc724d629, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.110] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc724d629, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc724d629, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.110] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.110] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.110] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.111] GetProcessHeap () returned 0xfd0000 [0143.111] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.111] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1042", cAlternateFileName="")) returned 1 [0143.111] GetProcessHeap () returned 0xfd0000 [0143.111] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.113] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.113] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79282ab, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.113] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.113] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.113] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.113] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.114] GetProcessHeap () returned 0xfd0000 [0143.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.114] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1043", cAlternateFileName="")) returned 1 [0143.114] GetProcessHeap () returned 0xfd0000 [0143.114] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.115] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.115] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.116] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc794e521, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc794e521, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.116] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.116] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.116] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.116] GetProcessHeap () returned 0xfd0000 [0143.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.117] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1044", cAlternateFileName="")) returned 1 [0143.117] GetProcessHeap () returned 0xfd0000 [0143.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.263] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.265] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.267] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799a6b5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc799a6b5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.280] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.288] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.288] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.288] GetProcessHeap () returned 0xfd0000 [0143.289] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.289] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1045", cAlternateFileName="")) returned 1 [0143.289] GetProcessHeap () returned 0xfd0000 [0143.289] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.289] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.289] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.290] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.290] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.290] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.290] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.290] GetProcessHeap () returned 0xfd0000 [0143.291] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.291] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1046", cAlternateFileName="")) returned 1 [0143.291] GetProcessHeap () returned 0xfd0000 [0143.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.292] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.292] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bfcda4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.292] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.292] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.292] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.292] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.293] GetProcessHeap () returned 0xfd0000 [0143.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.293] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1049", cAlternateFileName="")) returned 1 [0143.293] GetProcessHeap () returned 0xfd0000 [0143.293] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.293] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.294] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.294] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e5f486, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.294] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.294] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.294] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.294] GetProcessHeap () returned 0xfd0000 [0143.295] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.295] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1053", cAlternateFileName="")) returned 1 [0143.295] GetProcessHeap () returned 0xfd0000 [0143.295] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.295] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.295] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c6f4ac, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.296] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.296] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.296] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.296] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.296] GetProcessHeap () returned 0xfd0000 [0143.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.296] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="1055", cAlternateFileName="")) returned 1 [0143.297] GetProcessHeap () returned 0xfd0000 [0143.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.297] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.297] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7eab926, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.297] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e5f486, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e5f486, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.298] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.298] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.298] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.298] GetProcessHeap () returned 0xfd0000 [0143.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.298] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="2052", cAlternateFileName="")) returned 1 [0143.299] GetProcessHeap () returned 0xfd0000 [0143.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.299] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.299] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7eab926, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7eab926, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ed1c8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.299] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ef7e2e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.300] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.300] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.300] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.300] GetProcessHeap () returned 0xfd0000 [0143.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.300] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="2070", cAlternateFileName="")) returned 1 [0143.301] GetProcessHeap () returned 0xfd0000 [0143.301] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.301] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.301] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ef7e2e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ef7e2e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.301] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f1ddc0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f1ddc0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.301] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.302] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.302] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.302] GetProcessHeap () returned 0xfd0000 [0143.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.302] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="3076", cAlternateFileName="")) returned 1 [0143.302] GetProcessHeap () returned 0xfd0000 [0143.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.303] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.303] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.303] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87ae93f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.303] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.304] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.304] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.304] GetProcessHeap () returned 0xfd0000 [0143.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.304] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="3082", cAlternateFileName="")) returned 1 [0143.304] GetProcessHeap () returned 0xfd0000 [0143.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.305] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.305] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc847b51f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x513, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.305] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84a2f93, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x513, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.305] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.305] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x513, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.305] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.306] GetProcessHeap () returned 0xfd0000 [0143.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.306] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Client", cAlternateFileName="")) returned 1 [0143.306] GetProcessHeap () returned 0xfd0000 [0143.306] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.307] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.307] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8575d26, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8575d26, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc88217ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x513, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0143.307] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x513, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0143.307] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x513, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0143.307] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.308] GetProcessHeap () returned 0xfd0000 [0143.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.308] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="DHtmlHeader.html.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DHTMLH~1.EJE")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a3738e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="DisplayIcon.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DISPLA~1.EJE")) returned 1 [0143.308] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Extended", cAlternateFileName="")) returned 1 [0143.308] GetProcessHeap () returned 0xfd0000 [0143.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.309] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.309] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8847300, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x513, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0143.309] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x513, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0143.309] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x513, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0143.309] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.310] GetProcessHeap () returned 0xfd0000 [0143.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.310] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Graphics", cAlternateFileName="")) returned 1 [0143.310] GetProcessHeap () returned 0xfd0000 [0143.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.437] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x513, cFileName="Print.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PRINTI~1.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate1.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~1.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate2.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~2.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate3.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~3.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate4.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~4.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate5.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO751A~1.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate6.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO214E~1.EJE")) returned 1 [0143.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate7.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO6CC5~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x513, cFileName="Rotate8.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO17CC~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x513, cFileName="Save.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SAVEIC~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8b42434, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x513, cFileName="Setup.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPI~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b42434, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8b42434, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dca8be, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x513, cFileName="stop.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STOPIC~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x513, cFileName="SysReqMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x513, cFileName="SysReqNotMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~2.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x513, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x513, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 0 [0143.439] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0143.439] GetProcessHeap () returned 0xfd0000 [0143.439] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.439] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dacfb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8dacfb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dacfb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="header.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="HEADER~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xca3d85f7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="netfx_Core.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~1.EJE")) returned 1 [0143.439] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc9914a4e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="netfx_Core_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~2.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9914a4e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc9914a4e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca14fedb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="netfx_Core_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~3.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xcc6da399, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="netfx_Extended.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~4.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3fe8ae, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca3fe8ae, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca6ad293, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="netfx_Extended_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C7C~1.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7de3d3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca7de3d3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca8047df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="netfx_Extended_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C70~1.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1a71f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa1a71f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa40aa3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="ParameterInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa40aa3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa40aa3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa66d1a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="RGB9RAST_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~1.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa66d1a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa66d1a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad635ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="RGB9Rast_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~2.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad635ce, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad635ce, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad87e3d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Setup.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~1.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad87e3d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad87e3d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb3ca2ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="SetupEngine.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~2.EJE")) returned 1 [0143.441] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb69ef02, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb69ef02, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb744045, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="SetupUi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb940715, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="SetupUi.xsd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~2.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9d9033, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="SetupUtility.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~3.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9d9033, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9d9033, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9ff116, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="SplashScreen.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SPLASH~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ff116, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9ff116, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb3067d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SQMAPI~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb5679a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb5679a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Strings.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STRING~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbba2da9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="watermark.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WATERM~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xccdbcae4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~1.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xcce2f139, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~2.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xce142189, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~3.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 1 [0143.442] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 0 [0143.442] FindClose (in: hFindFile=0xfe9c40 | out: hFindFile=0xfe9c40) returned 1 [0143.442] GetProcessHeap () returned 0xfd0000 [0143.442] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0143.443] FindNextFileW (in: hFindFile=0xfe9900, lpFindFileData=0x335f570 | out: lpFindFileData=0x335f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0143.443] GetProcessHeap () returned 0xfd0000 [0143.443] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0143.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.445] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="..", cAlternateFileName="")) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="BCD", cAlternateFileName="")) returned 1 [0143.445] SetEvent (hEvent=0x300) returned 1 [0143.445] ResetEvent (hEvent=0x304) returned 1 [0143.446] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0143.446] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0143.446] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0143.446] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0143.446] GetProcessHeap () returned 0xfd0000 [0143.446] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.447] FindNextFileW (in: hFindFile=0x10b7740, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x10b7740, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x10b7740, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0143.447] FindClose (in: hFindFile=0x10b7740 | out: hFindFile=0x10b7740) returned 1 [0143.447] GetProcessHeap () returned 0xfd0000 [0143.447] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xce273134, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xce273134, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xce2994c2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="BOOTSTAT.DAT.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="BOOTST~1.EJE")) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0143.447] GetProcessHeap () returned 0xfd0000 [0143.447] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0143.452] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.454] GetProcessHeap () returned 0xfd0000 [0143.454] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.454] GetProcessHeap () returned 0xfd0000 [0143.454] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.456] GetProcessHeap () returned 0xfd0000 [0143.456] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.456] GetProcessHeap () returned 0xfd0000 [0143.456] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0143.459] GetProcessHeap () returned 0xfd0000 [0143.459] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.459] GetProcessHeap () returned 0xfd0000 [0143.459] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.461] GetProcessHeap () returned 0xfd0000 [0143.461] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.461] GetProcessHeap () returned 0xfd0000 [0143.461] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.466] GetProcessHeap () returned 0xfd0000 [0143.466] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.466] GetProcessHeap () returned 0xfd0000 [0143.466] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0143.466] GetProcessHeap () returned 0xfd0000 [0143.466] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.466] GetProcessHeap () returned 0xfd0000 [0143.466] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.468] GetProcessHeap () returned 0xfd0000 [0143.468] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.468] GetProcessHeap () returned 0xfd0000 [0143.468] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0143.473] GetProcessHeap () returned 0xfd0000 [0143.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.473] GetProcessHeap () returned 0xfd0000 [0143.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.473] GetProcessHeap () returned 0xfd0000 [0143.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.474] GetProcessHeap () returned 0xfd0000 [0143.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.475] GetProcessHeap () returned 0xfd0000 [0143.475] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.476] GetProcessHeap () returned 0xfd0000 [0143.476] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.485] GetProcessHeap () returned 0xfd0000 [0143.485] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.486] GetProcessHeap () returned 0xfd0000 [0143.486] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.489] GetProcessHeap () returned 0xfd0000 [0143.489] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.489] GetProcessHeap () returned 0xfd0000 [0143.489] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0143.489] GetProcessHeap () returned 0xfd0000 [0143.489] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.489] GetProcessHeap () returned 0xfd0000 [0143.489] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0143.490] GetProcessHeap () returned 0xfd0000 [0143.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.490] GetProcessHeap () returned 0xfd0000 [0143.490] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.490] GetProcessHeap () returned 0xfd0000 [0143.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.490] GetProcessHeap () returned 0xfd0000 [0143.490] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.492] GetProcessHeap () returned 0xfd0000 [0143.492] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.492] GetProcessHeap () returned 0xfd0000 [0143.492] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0143.496] GetProcessHeap () returned 0xfd0000 [0143.496] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.496] GetProcessHeap () returned 0xfd0000 [0143.497] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.497] GetProcessHeap () returned 0xfd0000 [0143.497] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.497] GetProcessHeap () returned 0xfd0000 [0143.497] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0143.498] GetProcessHeap () returned 0xfd0000 [0143.498] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.498] GetProcessHeap () returned 0xfd0000 [0143.498] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.499] GetProcessHeap () returned 0xfd0000 [0143.499] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.499] GetProcessHeap () returned 0xfd0000 [0143.499] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.503] GetProcessHeap () returned 0xfd0000 [0143.503] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.503] GetProcessHeap () returned 0xfd0000 [0143.503] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0143.507] GetProcessHeap () returned 0xfd0000 [0143.507] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.507] GetProcessHeap () returned 0xfd0000 [0143.507] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.508] GetProcessHeap () returned 0xfd0000 [0143.508] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.508] GetProcessHeap () returned 0xfd0000 [0143.508] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.509] GetProcessHeap () returned 0xfd0000 [0143.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.509] GetProcessHeap () returned 0xfd0000 [0143.509] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.514] GetProcessHeap () returned 0xfd0000 [0143.514] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.514] GetProcessHeap () returned 0xfd0000 [0143.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.514] GetProcessHeap () returned 0xfd0000 [0143.514] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.514] GetProcessHeap () returned 0xfd0000 [0143.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0143.515] GetProcessHeap () returned 0xfd0000 [0143.515] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a20088 [0143.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.516] GetProcessHeap () returned 0xfd0000 [0143.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a20088 | out: hHeap=0xfd0000) returned 1 [0143.516] GetProcessHeap () returned 0xfd0000 [0143.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.517] GetProcessHeap () returned 0xfd0000 [0143.517] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0143.519] GetProcessHeap () returned 0xfd0000 [0143.519] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.519] GetProcessHeap () returned 0xfd0000 [0143.519] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.522] GetProcessHeap () returned 0xfd0000 [0143.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.522] GetProcessHeap () returned 0xfd0000 [0143.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.523] GetProcessHeap () returned 0xfd0000 [0143.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.523] GetProcessHeap () returned 0xfd0000 [0143.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.558] GetProcessHeap () returned 0xfd0000 [0143.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.558] GetProcessHeap () returned 0xfd0000 [0143.558] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.558] GetProcessHeap () returned 0xfd0000 [0143.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.558] GetProcessHeap () returned 0xfd0000 [0143.558] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.559] GetProcessHeap () returned 0xfd0000 [0143.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.559] GetProcessHeap () returned 0xfd0000 [0143.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.560] GetProcessHeap () returned 0xfd0000 [0143.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.560] GetProcessHeap () returned 0xfd0000 [0143.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.560] GetProcessHeap () returned 0xfd0000 [0143.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.560] GetProcessHeap () returned 0xfd0000 [0143.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.561] GetProcessHeap () returned 0xfd0000 [0143.561] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.561] GetProcessHeap () returned 0xfd0000 [0143.561] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.561] GetProcessHeap () returned 0xfd0000 [0143.561] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.561] GetProcessHeap () returned 0xfd0000 [0143.561] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.562] GetProcessHeap () returned 0xfd0000 [0143.562] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.562] GetProcessHeap () returned 0xfd0000 [0143.562] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.562] GetProcessHeap () returned 0xfd0000 [0143.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0143.563] GetProcessHeap () returned 0xfd0000 [0143.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0143.564] GetProcessHeap () returned 0xfd0000 [0143.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0143.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.567] GetProcessHeap () returned 0xfd0000 [0143.567] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0143.567] GetProcessHeap () returned 0xfd0000 [0143.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0143.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xd0e9af28, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xd0e9af28, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.580] GetProcessHeap () returned 0xfd0000 [0143.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0143.580] GetProcessHeap () returned 0xfd0000 [0143.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0143.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Windows PowerShell.evtx", cAlternateFileName="咊\x97þ曠Ć\x80")) returned 0xffffffff [0143.581] GetProcessHeap () returned 0xfd0000 [0143.581] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0143.581] GetProcessHeap () returned 0xfd0000 [0143.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1097700 [0143.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName=".", cAlternateFileName="")) returned 0x10b7b00 [0143.581] GetProcessHeap () returned 0xfd0000 [0143.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0143.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0143.582] GetProcessHeap () returned 0xfd0000 [0143.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a22098 [0143.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0143.584] GetProcessHeap () returned 0xfd0000 [0143.584] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a22098 | out: hHeap=0xfd0000) returned 1 [0143.584] GetProcessHeap () returned 0xfd0000 [0143.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a22098 [0143.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0143.584] GetProcessHeap () returned 0xfd0000 [0143.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0143.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.588] GetProcessHeap () returned 0xfd0000 [0143.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0143.588] GetProcessHeap () returned 0xfd0000 [0143.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0143.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0143.590] GetProcessHeap () returned 0xfd0000 [0143.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.592] GetProcessHeap () returned 0xfd0000 [0143.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.592] GetProcessHeap () returned 0xfd0000 [0143.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.592] GetProcessHeap () returned 0xfd0000 [0143.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.592] GetProcessHeap () returned 0xfd0000 [0143.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.592] GetProcessHeap () returned 0xfd0000 [0143.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.592] GetProcessHeap () returned 0xfd0000 [0143.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.593] GetProcessHeap () returned 0xfd0000 [0143.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.593] GetProcessHeap () returned 0xfd0000 [0143.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0143.594] GetProcessHeap () returned 0xfd0000 [0143.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.594] GetProcessHeap () returned 0xfd0000 [0143.594] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.594] GetProcessHeap () returned 0xfd0000 [0143.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.594] GetProcessHeap () returned 0xfd0000 [0143.594] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0143.594] GetProcessHeap () returned 0xfd0000 [0143.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.595] GetProcessHeap () returned 0xfd0000 [0143.595] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0143.597] GetProcessHeap () returned 0xfd0000 [0143.597] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.597] GetProcessHeap () returned 0xfd0000 [0143.597] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0143.598] GetProcessHeap () returned 0xfd0000 [0143.598] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.598] GetProcessHeap () returned 0xfd0000 [0143.598] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.598] GetProcessHeap () returned 0xfd0000 [0143.598] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.599] GetProcessHeap () returned 0xfd0000 [0143.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0143.599] GetProcessHeap () returned 0xfd0000 [0143.599] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.599] GetProcessHeap () returned 0xfd0000 [0143.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.599] GetProcessHeap () returned 0xfd0000 [0143.599] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.599] GetProcessHeap () returned 0xfd0000 [0143.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.771] GetProcessHeap () returned 0xfd0000 [0143.771] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.771] GetProcessHeap () returned 0xfd0000 [0143.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.772] GetProcessHeap () returned 0xfd0000 [0143.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.772] GetProcessHeap () returned 0xfd0000 [0143.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.781] GetProcessHeap () returned 0xfd0000 [0143.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.782] GetProcessHeap () returned 0xfd0000 [0143.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.782] GetProcessHeap () returned 0xfd0000 [0143.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.785] GetProcessHeap () returned 0xfd0000 [0143.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.785] GetProcessHeap () returned 0xfd0000 [0143.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.785] GetProcessHeap () returned 0xfd0000 [0143.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.785] GetProcessHeap () returned 0xfd0000 [0143.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.786] GetProcessHeap () returned 0xfd0000 [0143.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.786] GetProcessHeap () returned 0xfd0000 [0143.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.787] GetProcessHeap () returned 0xfd0000 [0143.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.787] GetProcessHeap () returned 0xfd0000 [0143.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.789] GetProcessHeap () returned 0xfd0000 [0143.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.789] GetProcessHeap () returned 0xfd0000 [0143.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.790] GetProcessHeap () returned 0xfd0000 [0143.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.790] GetProcessHeap () returned 0xfd0000 [0143.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.790] GetProcessHeap () returned 0xfd0000 [0143.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.790] GetProcessHeap () returned 0xfd0000 [0143.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0143.790] GetProcessHeap () returned 0xfd0000 [0143.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.791] GetProcessHeap () returned 0xfd0000 [0143.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f31058 [0143.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1f0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.793] GetProcessHeap () returned 0xfd0000 [0143.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f31058 | out: hHeap=0xfd0000) returned 1 [0143.793] GetProcessHeap () returned 0xfd0000 [0143.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.794] GetProcessHeap () returned 0xfd0000 [0143.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.794] GetProcessHeap () returned 0xfd0000 [0143.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.794] GetProcessHeap () returned 0xfd0000 [0143.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.795] GetProcessHeap () returned 0xfd0000 [0143.795] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.795] GetProcessHeap () returned 0xfd0000 [0143.795] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.797] GetProcessHeap () returned 0xfd0000 [0143.797] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.797] GetProcessHeap () returned 0xfd0000 [0143.797] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.797] GetProcessHeap () returned 0xfd0000 [0143.797] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.801] GetProcessHeap () returned 0xfd0000 [0143.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.805] GetProcessHeap () returned 0xfd0000 [0143.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.805] GetProcessHeap () returned 0xfd0000 [0143.805] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0143.806] GetProcessHeap () returned 0xfd0000 [0143.806] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.806] GetProcessHeap () returned 0xfd0000 [0143.806] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.806] GetProcessHeap () returned 0xfd0000 [0143.806] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.806] GetProcessHeap () returned 0xfd0000 [0143.806] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.808] GetProcessHeap () returned 0xfd0000 [0143.808] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.810] GetProcessHeap () returned 0xfd0000 [0143.810] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.810] GetProcessHeap () returned 0xfd0000 [0143.810] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.810] GetProcessHeap () returned 0xfd0000 [0143.810] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0143.811] GetProcessHeap () returned 0xfd0000 [0143.811] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.811] GetProcessHeap () returned 0xfd0000 [0143.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.811] GetProcessHeap () returned 0xfd0000 [0143.811] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.811] GetProcessHeap () returned 0xfd0000 [0143.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.813] GetProcessHeap () returned 0xfd0000 [0143.813] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.813] GetProcessHeap () returned 0xfd0000 [0143.813] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.813] GetProcessHeap () returned 0xfd0000 [0143.813] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.813] GetProcessHeap () returned 0xfd0000 [0143.813] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.814] GetProcessHeap () returned 0xfd0000 [0143.814] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.814] GetProcessHeap () returned 0xfd0000 [0143.814] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.814] GetProcessHeap () returned 0xfd0000 [0143.814] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.814] GetProcessHeap () returned 0xfd0000 [0143.814] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.816] GetProcessHeap () returned 0xfd0000 [0143.816] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.817] GetProcessHeap () returned 0xfd0000 [0143.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.817] GetProcessHeap () returned 0xfd0000 [0143.817] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.817] GetProcessHeap () returned 0xfd0000 [0143.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.817] GetProcessHeap () returned 0xfd0000 [0143.817] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.817] GetProcessHeap () returned 0xfd0000 [0143.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.818] GetProcessHeap () returned 0xfd0000 [0143.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.818] GetProcessHeap () returned 0xfd0000 [0143.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0143.820] GetProcessHeap () returned 0xfd0000 [0143.820] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.820] GetProcessHeap () returned 0xfd0000 [0143.820] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.820] GetProcessHeap () returned 0xfd0000 [0143.820] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.820] GetProcessHeap () returned 0xfd0000 [0143.820] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.821] GetProcessHeap () returned 0xfd0000 [0143.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.821] GetProcessHeap () returned 0xfd0000 [0143.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.821] GetProcessHeap () returned 0xfd0000 [0143.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.821] GetProcessHeap () returned 0xfd0000 [0143.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.823] GetProcessHeap () returned 0xfd0000 [0143.823] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.823] GetProcessHeap () returned 0xfd0000 [0143.823] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.824] GetProcessHeap () returned 0xfd0000 [0143.824] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.824] GetProcessHeap () returned 0xfd0000 [0143.824] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.824] GetProcessHeap () returned 0xfd0000 [0143.824] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.824] GetProcessHeap () returned 0xfd0000 [0143.824] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0143.825] GetProcessHeap () returned 0xfd0000 [0143.825] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0143.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.826] GetProcessHeap () returned 0xfd0000 [0143.826] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a430b0 [0143.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.829] GetProcessHeap () returned 0xfd0000 [0143.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a430b0 | out: hHeap=0xfd0000) returned 1 [0143.829] GetProcessHeap () returned 0xfd0000 [0143.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0143.830] GetProcessHeap () returned 0xfd0000 [0143.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.831] GetProcessHeap () returned 0xfd0000 [0143.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0143.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0143.838] GetProcessHeap () returned 0xfd0000 [0143.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0143.838] GetProcessHeap () returned 0xfd0000 [0143.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.840] GetProcessHeap () returned 0xfd0000 [0143.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.840] GetProcessHeap () returned 0xfd0000 [0143.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.840] GetProcessHeap () returned 0xfd0000 [0143.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.841] GetProcessHeap () returned 0xfd0000 [0143.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.841] GetProcessHeap () returned 0xfd0000 [0143.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0144.066] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0144.068] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0144.069] GetProcessHeap () returned 0xfd0000 [0144.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0144.070] GetProcessHeap () returned 0xfd0000 [0144.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.070] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.070] GetProcessHeap () returned 0xfd0000 [0144.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.070] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.070] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 0 [0144.070] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.071] GetProcessHeap () returned 0xfd0000 [0144.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.071] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0144.071] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.071] GetProcessHeap () returned 0xfd0000 [0144.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.072] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0144.072] GetProcessHeap () returned 0xfd0000 [0144.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0144.072] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.072] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.073] GetProcessHeap () returned 0xfd0000 [0144.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.073] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 0 [0144.073] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.073] GetProcessHeap () returned 0xfd0000 [0144.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0144.073] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0144.074] GetProcessHeap () returned 0xfd0000 [0144.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.074] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0144.074] GetProcessHeap () returned 0xfd0000 [0144.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.075] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.075] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0144.075] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0144.075] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0144.075] FindClose (in: hFindFile=0x10b7780 | out: hFindFile=0x10b7780) returned 1 [0144.076] GetProcessHeap () returned 0xfd0000 [0144.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.076] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0144.076] GetProcessHeap () returned 0xfd0000 [0144.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.076] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.076] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0144.076] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0144.076] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.076] GetProcessHeap () returned 0xfd0000 [0144.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.076] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0144.076] GetProcessHeap () returned 0xfd0000 [0144.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0144.076] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.076] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0144.077] GetProcessHeap () returned 0xfd0000 [0144.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.077] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.077] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="1033", cAlternateFileName="")) returned 1 [0144.077] GetProcessHeap () returned 0xfd0000 [0144.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0144.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0144.078] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="..", cAlternateFileName="")) returned 1 [0144.078] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0144.078] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0144.079] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0144.079] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0144.079] GetProcessHeap () returned 0xfd0000 [0144.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0144.079] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0144.079] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0144.079] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0144.079] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0144.079] FindClose (in: hFindFile=0x10b7780 | out: hFindFile=0x10b7780) returned 1 [0144.079] GetProcessHeap () returned 0xfd0000 [0144.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.080] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0144.080] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0144.081] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0144.081] GetProcessHeap () returned 0xfd0000 [0144.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 0 [0144.081] FindClose (in: hFindFile=0x10b79c0 | out: hFindFile=0x10b79c0) returned 1 [0144.082] GetProcessHeap () returned 0xfd0000 [0144.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a22098 | out: hHeap=0xfd0000) returned 1 [0144.083] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0144.083] GetProcessHeap () returned 0xfd0000 [0144.083] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0144.084] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.084] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0144.084] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0144.084] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0144.084] GetProcessHeap () returned 0xfd0000 [0144.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.084] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0144.084] GetProcessHeap () returned 0xfd0000 [0144.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.245] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.245] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0144.245] GetProcessHeap () returned 0xfd0000 [0144.245] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0144.247] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.247] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0144.247] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0144.247] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.247] GetProcessHeap () returned 0xfd0000 [0144.247] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a22098 [0144.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0144.249] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.249] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0144.249] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0144.249] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0144.249] GetProcessHeap () returned 0xfd0000 [0144.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a22098 | out: hHeap=0xfd0000) returned 1 [0144.249] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0144.249] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0144.249] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0144.249] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0144.250] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0144.251] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0144.251] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0144.251] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0144.251] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0144.251] GetProcessHeap () returned 0xfd0000 [0144.251] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.252] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0144.252] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.252] GetProcessHeap () returned 0xfd0000 [0144.252] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0144.253] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.253] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0144.253] FindNextFileW (in: hFindFile=0x10b79c0, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0144.253] FindClose (in: hFindFile=0x10b79c0 | out: hFindFile=0x10b79c0) returned 1 [0144.253] GetProcessHeap () returned 0xfd0000 [0144.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.254] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0144.254] GetProcessHeap () returned 0xfd0000 [0144.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0144.256] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.256] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0144.256] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0144.256] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.256] GetProcessHeap () returned 0xfd0000 [0144.256] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a22098 [0144.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.260] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0144.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0144.261] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0144.264] GetProcessHeap () returned 0xfd0000 [0144.264] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a22098 | out: hHeap=0xfd0000) returned 1 [0144.264] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0144.264] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0144.264] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0144.264] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0144.264] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0144.264] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0144.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0144.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0144.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0144.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0144.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0144.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0144.265] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0144.265] GetProcessHeap () returned 0xfd0000 [0144.265] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.267] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0144.267] GetProcessHeap () returned 0xfd0000 [0144.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0144.269] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.269] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.269] GetProcessHeap () returned 0xfd0000 [0144.269] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a22098 [0144.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0144.270] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.270] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0144.270] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0144.270] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0144.271] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0144.271] GetProcessHeap () returned 0xfd0000 [0144.271] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a22098 | out: hHeap=0xfd0000) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0144.271] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0144.272] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0144.272] GetProcessHeap () returned 0xfd0000 [0144.273] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.274] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0144.274] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0144.274] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0144.274] FindClose (in: hFindFile=0x10b7780 | out: hFindFile=0x10b7780) returned 1 [0144.274] GetProcessHeap () returned 0xfd0000 [0144.274] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.274] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0144.274] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0144.275] GetProcessHeap () returned 0xfd0000 [0144.275] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0144.277] FindNextFileW (in: hFindFile=0x10b7b00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.277] FindNextFileW (in: hFindFile=0x10b7b00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0144.277] GetProcessHeap () returned 0xfd0000 [0144.277] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0144.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.279] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.279] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50817450, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0xfa861600, ftLastAccessTime.dwHighDateTime=0x1d5d020, ftLastWriteTime.dwLowDateTime=0xfa861600, ftLastWriteTime.dwHighDateTime=0x1d5d020, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="appointment_impressed.exe", cAlternateFileName="APPOIN~1.EXE")) returned 1 [0144.280] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.280] GetProcessHeap () returned 0xfd0000 [0144.280] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0144.280] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.280] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0144.280] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0144.281] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0144.281] GetProcessHeap () returned 0xfd0000 [0144.281] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212334b0, ftCreationTime.dwHighDateTime=0x1d589bc, ftLastAccessTime.dwLowDateTime=0xf7007d40, ftLastAccessTime.dwHighDateTime=0x1d59f42, ftLastWriteTime.dwLowDateTime=0xf7007d40, ftLastWriteTime.dwHighDateTime=0x1d59f42, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0144.281] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0144.282] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0144.282] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0144.282] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0144.282] GetProcessHeap () returned 0xfd0000 [0144.282] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.282] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.282] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0144.282] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0144.282] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.282] GetProcessHeap () returned 0xfd0000 [0144.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.283] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0144.283] GetProcessHeap () returned 0xfd0000 [0144.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0144.283] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.283] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="install.ins", cAlternateFileName="")) returned 1 [0144.283] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="install.ins", cAlternateFileName="")) returned 0 [0144.283] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0144.283] GetProcessHeap () returned 0xfd0000 [0144.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.283] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0144.283] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0144.283] FindClose (in: hFindFile=0x10b7780 | out: hFindFile=0x10b7780) returned 1 [0144.283] GetProcessHeap () returned 0xfd0000 [0144.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0144.284] FindNextFileW (in: hFindFile=0x10b7b00, lpFindFileData=0x335f2e8 | out: lpFindFileData=0x335f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffc513, dwReserved1=0x915, cFileName="Java", cAlternateFileName="")) returned 1 [0144.284] GetProcessHeap () returned 0xfd0000 [0144.284] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0144.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0144.506] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.507] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a59d780, ftCreationTime.dwHighDateTime=0x1d5b2ea, ftLastAccessTime.dwLowDateTime=0xa2bc2510, ftLastAccessTime.dwHighDateTime=0x1d5bd45, ftLastWriteTime.dwLowDateTime=0xa2bc2510, ftLastWriteTime.dwHighDateTime=0x1d5bd45, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="brook_den.exe", cAlternateFileName="BROOK_~1.EXE")) returned 1 [0144.507] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0144.522] GetProcessHeap () returned 0xfd0000 [0144.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe3ec, dwReserved1=0x9dd, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0144.523] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe3ec, dwReserved1=0x9dd, cFileName="..", cAlternateFileName="")) returned 1 [0144.523] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe3ec, dwReserved1=0x9dd, cFileName="bin", cAlternateFileName="")) returned 1 [0144.530] GetProcessHeap () returned 0xfd0000 [0144.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0144.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.536] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.539] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0144.540] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0144.540] GetProcessHeap () returned 0xfd0000 [0144.540] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0144.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="..", cAlternateFileName="")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0144.541] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0144.541] GetProcessHeap () returned 0xfd0000 [0144.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0144.541] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="java.dll", cAlternateFileName="")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="java.exe", cAlternateFileName="")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0144.543] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0144.544] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0144.545] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0144.546] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0144.547] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0144.547] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="net.dll", cAlternateFileName="")) returned 1 [0144.547] GetProcessHeap () returned 0xfd0000 [0144.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0144.547] GetProcessHeap () returned 0xfd0000 [0144.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0144.547] GetProcessHeap () returned 0xfd0000 [0144.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0144.547] GetProcessHeap () returned 0xfd0000 [0144.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0144.547] GetProcessHeap () returned 0xfd0000 [0144.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0144.548] GetProcessHeap () returned 0xfd0000 [0144.548] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0144.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.549] GetProcessHeap () returned 0xfd0000 [0144.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.550] GetProcessHeap () returned 0xfd0000 [0144.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0144.550] GetProcessHeap () returned 0xfd0000 [0144.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0144.550] GetProcessHeap () returned 0xfd0000 [0144.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0144.550] GetProcessHeap () returned 0xfd0000 [0144.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0144.550] GetProcessHeap () returned 0xfd0000 [0144.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0144.550] GetProcessHeap () returned 0xfd0000 [0144.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a510a8 [0144.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0145.579] GetProcessHeap () returned 0xfd0000 [0145.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a510a8 | out: hHeap=0xfd0000) returned 1 [0145.580] GetProcessHeap () returned 0xfd0000 [0145.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0145.589] GetProcessHeap () returned 0xfd0000 [0145.589] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.593] GetProcessHeap () returned 0xfd0000 [0145.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0145.604] GetProcessHeap () returned 0xfd0000 [0145.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.604] GetProcessHeap () returned 0xfd0000 [0145.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0145.604] GetProcessHeap () returned 0xfd0000 [0145.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a410a0 [0145.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x335e640 | out: lpFindFileData=0x335e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0145.617] GetProcessHeap () returned 0xfd0000 [0145.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a410a0 | out: hHeap=0xfd0000) returned 1 [0145.618] GetProcessHeap () returned 0xfd0000 [0145.618] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.619] GetProcessHeap () returned 0xfd0000 [0145.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0145.619] GetProcessHeap () returned 0xfd0000 [0145.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.619] GetProcessHeap () returned 0xfd0000 [0145.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0145.812] GetProcessHeap () returned 0xfd0000 [0145.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.819] GetProcessHeap () returned 0xfd0000 [0145.820] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0145.831] GetProcessHeap () returned 0xfd0000 [0145.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.831] GetProcessHeap () returned 0xfd0000 [0145.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0145.835] GetProcessHeap () returned 0xfd0000 [0145.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0145.839] GetProcessHeap () returned 0xfd0000 [0145.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0145.840] GetProcessHeap () returned 0xfd0000 [0145.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0145.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x335f060 | out: lpFindFileData=0x335f060*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0145.841] GetProcessHeap () returned 0xfd0000 [0145.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0145.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0145.843] GetProcessHeap () returned 0xfd0000 [0145.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0145.844] GetProcessHeap () returned 0xfd0000 [0145.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0145.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0146.222] GetProcessHeap () returned 0xfd0000 [0146.222] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0146.223] GetProcessHeap () returned 0xfd0000 [0146.223] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0146.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x335edd8 | out: lpFindFileData=0x335edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0146.224] GetProcessHeap () returned 0xfd0000 [0146.224] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0146.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0146.272] GetProcessHeap () returned 0xfd0000 [0146.272] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0146.272] GetProcessHeap () returned 0xfd0000 [0146.272] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0146.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x335eb50 | out: lpFindFileData=0x335eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0146.272] GetProcessHeap () returned 0xfd0000 [0146.272] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a410a0 [0146.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x335e8c8 | out: lpFindFileData=0x335e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0192.776] GetProcessHeap () returned 0xfd0000 [0192.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a410a0 | out: hHeap=0xfd0000) returned 1 [0192.776] GetProcessHeap () returned 0xfd0000 [0192.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0192.776] GetProcessHeap () returned 0xfd0000 [0192.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0192.778] GetProcessHeap () returned 0xfd0000 [0192.778] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0192.778] GetProcessHeap () returned 0xfd0000 [0192.778] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1097700 | out: hHeap=0xfd0000) returned 1 [0192.779] GetProcessHeap () returned 0xfd0000 [0192.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10766e8 | out: hHeap=0xfd0000) returned 1 [0192.779] SetEvent (hEvent=0x300) returned 1 [0192.780] SetEvent (hEvent=0x2fc) returned 1 [0192.780] SetEvent (hEvent=0x304) returned 1 [0192.780] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0xffffffff) returned 0x0 [0192.780] SetEvent (hEvent=0x300) returned 1 [0192.780] SetEvent (hEvent=0x2fc) returned 1 [0192.780] SetEvent (hEvent=0x304) returned 1 [0192.780] WaitForMultipleObjects (nCount=0x2, lpHandles=0x335f804*=0x308, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0193.508] CloseHandle (hObject=0x30c) returned 1 [0193.508] CloseHandle (hObject=0x308) returned 1 [0193.508] GetProcessHeap () returned 0xfd0000 [0193.508] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0x4029748 [0193.508] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0193.509] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0193.509] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0193.509] GetProcessHeap () returned 0xfd0000 [0193.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x4029748 | out: hHeap=0xfd0000) returned 1 [0193.509] GetProcessHeap () returned 0xfd0000 [0193.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10666e0 | out: hHeap=0xfd0000) returned 1 [0193.510] CloseHandle (hObject=0x2fc) returned 1 [0193.510] CloseHandle (hObject=0x300) returned 1 [0193.511] CloseHandle (hObject=0x304) returned 1 [0193.511] GetProcessHeap () returned 0xfd0000 [0193.511] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10566d8 | out: hHeap=0xfd0000) returned 1 [0193.512] GetProcessHeap () returned 0xfd0000 [0193.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe86e0 | out: hHeap=0xfd0000) returned 1 [0193.512] GetProcessHeap () returned 0xfd0000 [0193.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe9840 | out: hHeap=0xfd0000) returned 1 [0193.512] SetEvent (hEvent=0x288) returned 1 [0193.513] GetProcessHeap () returned 0xfd0000 [0193.513] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0a70 | out: hHeap=0xfd0000) returned 1 [0193.513] GetProcessHeap () returned 0xfd0000 [0193.513] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee470 | out: hHeap=0xfd0000) returned 1 [0193.513] GetProcessHeap () returned 0xfd0000 [0193.513] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8560 | out: hHeap=0xfd0000) returned 1 Thread: id = 87 os_tid = 0xdf8 [0142.870] GetProcessHeap () returned 0xfd0000 [0142.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x38) returned 0xfe9780 [0142.870] GetProcessHeap () returned 0xfd0000 [0142.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x18) returned 0xfe87c0 [0142.870] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e4 [0142.870] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e8 [0142.870] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec [0142.870] GetProcessHeap () returned 0xfd0000 [0142.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1015dd8 [0142.870] GetProcessHeap () returned 0xfd0000 [0142.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1025de0 [0142.871] GetProcessHeap () returned 0xfd0000 [0142.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfe0490 [0142.871] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0142.871] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0142.871] Wow64DisableWow64FsRedirection (in: OldValue=0x349fa74 | out: OldValue=0x349fa74*=0x0) returned 1 [0142.871] GetProcessHeap () returned 0xfd0000 [0142.871] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0142.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x349fa7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0142.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x349fa7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0142.872] GetProcessHeap () returned 0xfd0000 [0142.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1035de8 [0142.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xfe9800 [0142.873] GetProcessHeap () returned 0xfd0000 [0142.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0142.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0142.879] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0142.879] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0142.879] GetProcessHeap () returned 0xfd0000 [0142.879] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10876f8 [0142.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9c40 [0142.884] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.884] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc605d0ea, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc605d0ea, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DOWNLE~1.EJE")) returned 1 [0142.885] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="OOBE_2~1.EJE")) returned 1 [0142.885] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0142.885] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 0 [0142.885] FindClose (in: hFindFile=0xfe9c40 | out: hFindFile=0xfe9c40) returned 1 [0142.887] GetProcessHeap () returned 0xfd0000 [0142.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10876f8 | out: hHeap=0xfd0000) returned 1 [0142.888] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0142.888] GetProcessHeap () returned 0xfd0000 [0142.888] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10876f8 [0142.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9c40 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc637e0b7, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc637e0b7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc63b639d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~2.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60cf5ed, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60cf5ed, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60f58df, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60f58df, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60f58df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6331bef, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6331bef, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6331bef, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PREOOB~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 1 [0142.891] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 0 [0142.902] FindClose (in: hFindFile=0xfe9c40 | out: hFindFile=0xfe9c40) returned 1 [0142.902] GetProcessHeap () returned 0xfd0000 [0142.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10876f8 | out: hHeap=0xfd0000) returned 1 [0142.903] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0142.903] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0142.905] GetProcessHeap () returned 0xfd0000 [0142.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0142.906] FindNextFileW (in: hFindFile=0xfe9800, lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0142.906] GetProcessHeap () returned 0xfd0000 [0142.906] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0142.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0142.907] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="..", cAlternateFileName="")) returned 1 [0142.907] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0142.907] GetProcessHeap () returned 0xfd0000 [0142.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0xfd7c0a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x16, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="?￿ԕ", cAlternateFileName="咊\x97þ巠Ă\x7f")) returned 0xffffffff [0142.907] GetProcessHeap () returned 0xfd0000 [0142.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0142.908] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0142.908] GetProcessHeap () returned 0xfd0000 [0142.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10866f0 [0142.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName=".", cAlternateFileName="")) returned 0xfe9c40 [0142.908] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x513, cFileName="..", cAlternateFileName="")) returned 1 [0142.909] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x533c449f, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c805e, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x513, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.909] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x513, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 1 [0142.909] FindNextFileW (in: hFindFile=0xfe9c40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x513, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 0 [0142.909] FindClose (in: hFindFile=0xfe9c40 | out: hFindFile=0xfe9c40) returned 1 [0142.909] GetProcessHeap () returned 0xfd0000 [0142.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10866f0 | out: hHeap=0xfd0000) returned 1 [0142.909] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0142.909] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0142.909] GetProcessHeap () returned 0xfd0000 [0142.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0142.910] FindNextFileW (in: hFindFile=0xfe9800, lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0142.910] FindNextFileW (in: hFindFile=0xfe9800, lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0142.910] GetProcessHeap () returned 0xfd0000 [0142.910] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0142.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0xfe9d00 [0142.915] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="..", cAlternateFileName="")) returned 1 [0142.915] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1025", cAlternateFileName="")) returned 1 [0142.915] GetProcessHeap () returned 0xfd0000 [0142.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0142.919] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.919] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.919] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.919] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.919] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.921] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0142.921] GetProcessHeap () returned 0xfd0000 [0142.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0142.922] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1028", cAlternateFileName="")) returned 1 [0142.922] GetProcessHeap () returned 0xfd0000 [0142.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.927] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.927] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.927] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66154e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66154e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc663b846, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.927] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.927] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.929] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.929] GetProcessHeap () returned 0xfd0000 [0142.929] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0142.930] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1029", cAlternateFileName="")) returned 1 [0142.930] GetProcessHeap () returned 0xfd0000 [0142.930] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0142.934] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.934] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6661a20, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6661a20, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6687c2f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.934] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.934] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.934] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.935] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0142.936] GetProcessHeap () returned 0xfd0000 [0142.936] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0142.937] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1030", cAlternateFileName="")) returned 1 [0142.937] GetProcessHeap () returned 0xfd0000 [0142.937] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0142.939] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.939] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66adc60, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66adc60, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0142.939] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66d3f72, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66d3f72, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0142.939] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0142.939] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0142.939] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0142.939] GetProcessHeap () returned 0xfd0000 [0142.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0142.940] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1031", cAlternateFileName="")) returned 1 [0142.940] GetProcessHeap () returned 0xfd0000 [0142.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0142.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.103] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.108] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67203e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc67203e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc67203e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.110] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6746675, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6746675, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.115] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.118] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.118] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.119] GetProcessHeap () returned 0xfd0000 [0143.119] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.119] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1032", cAlternateFileName="")) returned 1 [0143.119] GetProcessHeap () returned 0xfd0000 [0143.119] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.120] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.120] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.120] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc695c8d9, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc695c8d9, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.120] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.120] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.121] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.121] GetProcessHeap () returned 0xfd0000 [0143.121] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.121] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1033", cAlternateFileName="")) returned 1 [0143.121] GetProcessHeap () returned 0xfd0000 [0143.121] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.122] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.123] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.123] GetProcessHeap () returned 0xfd0000 [0143.123] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1035", cAlternateFileName="")) returned 1 [0143.123] GetProcessHeap () returned 0xfd0000 [0143.123] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.124] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.124] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.124] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.124] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.124] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.124] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.125] GetProcessHeap () returned 0xfd0000 [0143.125] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.125] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1036", cAlternateFileName="")) returned 1 [0143.125] GetProcessHeap () returned 0xfd0000 [0143.125] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.126] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.126] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.126] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.126] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.126] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.126] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.127] GetProcessHeap () returned 0xfd0000 [0143.127] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.127] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1037", cAlternateFileName="")) returned 1 [0143.127] GetProcessHeap () returned 0xfd0000 [0143.127] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.128] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.128] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f06165, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6f06165, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.128] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc718eb45, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc718eb45, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.128] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.128] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.128] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.129] GetProcessHeap () returned 0xfd0000 [0143.129] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.129] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1038", cAlternateFileName="")) returned 1 [0143.129] GetProcessHeap () returned 0xfd0000 [0143.129] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.130] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.130] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.130] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71daed0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71daed0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.130] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.130] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.130] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.131] GetProcessHeap () returned 0xfd0000 [0143.131] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.131] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1040", cAlternateFileName="")) returned 1 [0143.131] GetProcessHeap () returned 0xfd0000 [0143.131] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.132] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.132] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc720100d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.132] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.132] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.132] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.132] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.133] GetProcessHeap () returned 0xfd0000 [0143.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.133] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1041", cAlternateFileName="")) returned 1 [0143.133] GetProcessHeap () returned 0xfd0000 [0143.133] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.134] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.134] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc724d629, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.134] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc724d629, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc724d629, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.134] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.134] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.134] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.135] GetProcessHeap () returned 0xfd0000 [0143.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.135] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1042", cAlternateFileName="")) returned 1 [0143.135] GetProcessHeap () returned 0xfd0000 [0143.135] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.136] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.136] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79282ab, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.136] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.136] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.136] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.136] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.137] GetProcessHeap () returned 0xfd0000 [0143.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.137] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1043", cAlternateFileName="")) returned 1 [0143.137] GetProcessHeap () returned 0xfd0000 [0143.137] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.138] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.138] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.138] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc794e521, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc794e521, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.138] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.138] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.138] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.139] GetProcessHeap () returned 0xfd0000 [0143.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.139] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1044", cAlternateFileName="")) returned 1 [0143.139] GetProcessHeap () returned 0xfd0000 [0143.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.249] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.249] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.249] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799a6b5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc799a6b5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.249] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.249] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.249] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.250] GetProcessHeap () returned 0xfd0000 [0143.250] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.250] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1045", cAlternateFileName="")) returned 1 [0143.250] GetProcessHeap () returned 0xfd0000 [0143.250] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe9d80 [0143.253] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.253] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.253] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.253] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.253] FindNextFileW (in: hFindFile=0xfe9d80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.253] FindClose (in: hFindFile=0xfe9d80 | out: hFindFile=0xfe9d80) returned 1 [0143.254] GetProcessHeap () returned 0xfd0000 [0143.254] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.254] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1046", cAlternateFileName="")) returned 1 [0143.254] GetProcessHeap () returned 0xfd0000 [0143.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.256] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.256] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bfcda4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.256] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.256] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.256] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.256] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.257] GetProcessHeap () returned 0xfd0000 [0143.257] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.257] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1049", cAlternateFileName="")) returned 1 [0143.257] GetProcessHeap () returned 0xfd0000 [0143.257] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.258] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.259] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.259] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e5f486, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.259] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.259] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.259] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.260] GetProcessHeap () returned 0xfd0000 [0143.260] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.260] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1053", cAlternateFileName="")) returned 1 [0143.260] GetProcessHeap () returned 0xfd0000 [0143.260] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.262] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.262] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c6f4ac, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.262] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.262] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.262] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.262] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.263] GetProcessHeap () returned 0xfd0000 [0143.263] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.263] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="1055", cAlternateFileName="")) returned 1 [0143.263] GetProcessHeap () returned 0xfd0000 [0143.263] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.265] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.265] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7eab926, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.265] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e5f486, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e5f486, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.265] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.265] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.265] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.266] GetProcessHeap () returned 0xfd0000 [0143.266] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.266] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="2052", cAlternateFileName="")) returned 1 [0143.266] GetProcessHeap () returned 0xfd0000 [0143.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.268] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.268] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7eab926, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7eab926, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ed1c8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.268] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ef7e2e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.268] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.268] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.268] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.269] GetProcessHeap () returned 0xfd0000 [0143.269] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.269] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="2070", cAlternateFileName="")) returned 1 [0143.269] GetProcessHeap () returned 0xfd0000 [0143.269] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.271] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.271] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ef7e2e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ef7e2e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.271] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f1ddc0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f1ddc0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.271] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.271] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.271] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.272] GetProcessHeap () returned 0xfd0000 [0143.272] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.272] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="3076", cAlternateFileName="")) returned 1 [0143.272] GetProcessHeap () returned 0xfd0000 [0143.272] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.274] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.274] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.274] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87ae93f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.274] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.274] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.274] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.275] GetProcessHeap () returned 0xfd0000 [0143.275] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.275] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="3082", cAlternateFileName="")) returned 1 [0143.275] GetProcessHeap () returned 0xfd0000 [0143.275] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.277] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.277] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc847b51f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0143.277] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84a2f93, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0143.277] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0143.277] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0143.277] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.278] GetProcessHeap () returned 0xfd0000 [0143.278] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.278] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Client", cAlternateFileName="")) returned 1 [0143.278] GetProcessHeap () returned 0xfd0000 [0143.278] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.283] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8575d26, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8575d26, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc88217ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0143.283] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0143.284] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.284] GetProcessHeap () returned 0xfd0000 [0143.284] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.284] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x430054, dwReserved1=0x714, cFileName="DHtmlHeader.html.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DHTMLH~1.EJE")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a3738e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x430054, dwReserved1=0x714, cFileName="DisplayIcon.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DISPLA~1.EJE")) returned 1 [0143.284] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Extended", cAlternateFileName="")) returned 1 [0143.285] GetProcessHeap () returned 0xfd0000 [0143.285] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xfe97c0 [0143.286] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.286] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8847300, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0143.286] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0143.286] FindNextFileW (in: hFindFile=0xfe97c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0143.286] FindClose (in: hFindFile=0xfe97c0 | out: hFindFile=0xfe97c0) returned 1 [0143.287] GetProcessHeap () returned 0xfd0000 [0143.287] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.287] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Graphics", cAlternateFileName="")) returned 1 [0143.287] GetProcessHeap () returned 0xfd0000 [0143.287] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.520] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.566] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PRINTI~1.EJE")) returned 1 [0143.568] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~1.EJE")) returned 1 [0143.568] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~2.EJE")) returned 1 [0143.569] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~3.EJE")) returned 1 [0143.570] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~4.EJE")) returned 1 [0143.570] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO751A~1.EJE")) returned 1 [0143.591] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO214E~1.EJE")) returned 1 [0143.596] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO6CC5~1.EJE")) returned 1 [0143.596] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO17CC~1.EJE")) returned 1 [0143.597] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SAVEIC~1.EJE")) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8b42434, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPI~1.EJE")) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b42434, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8b42434, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dca8be, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STOPIC~1.EJE")) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~1.EJE")) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~2.EJE")) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 0 [0143.600] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0143.601] GetProcessHeap () returned 0xfd0000 [0143.601] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.601] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dacfb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8dacfb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dacfb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x430054, dwReserved1=0x714, cFileName="header.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="HEADER~1.EJE")) returned 1 [0143.601] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xca3d85f7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x430054, dwReserved1=0x714, cFileName="netfx_Core.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~1.EJE")) returned 1 [0143.601] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc9914a4e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x430054, dwReserved1=0x714, cFileName="netfx_Core_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~2.EJE")) returned 1 [0143.601] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9914a4e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc9914a4e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca14fedb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x430054, dwReserved1=0x714, cFileName="netfx_Core_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~3.EJE")) returned 1 [0143.601] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xcc6da399, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0x430054, dwReserved1=0x714, cFileName="netfx_Extended.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~4.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3fe8ae, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca3fe8ae, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca6ad293, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x430054, dwReserved1=0x714, cFileName="netfx_Extended_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C7C~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7de3d3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca7de3d3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca8047df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x430054, dwReserved1=0x714, cFileName="netfx_Extended_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C70~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1a71f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa1a71f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa40aa3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x430054, dwReserved1=0x714, cFileName="ParameterInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa40aa3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa40aa3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa66d1a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x430054, dwReserved1=0x714, cFileName="RGB9RAST_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa66d1a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa66d1a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad635ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x430054, dwReserved1=0x714, cFileName="RGB9Rast_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~2.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad635ce, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad635ce, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad87e3d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Setup.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad87e3d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad87e3d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb3ca2ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x430054, dwReserved1=0x714, cFileName="SetupEngine.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~2.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb69ef02, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb69ef02, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb744045, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x430054, dwReserved1=0x714, cFileName="SetupUi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb940715, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x430054, dwReserved1=0x714, cFileName="SetupUi.xsd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~2.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9d9033, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x430054, dwReserved1=0x714, cFileName="SetupUtility.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~3.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9d9033, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9d9033, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9ff116, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x430054, dwReserved1=0x714, cFileName="SplashScreen.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SPLASH~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ff116, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9ff116, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb3067d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x430054, dwReserved1=0x714, cFileName="sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SQMAPI~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb5679a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb5679a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Strings.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STRING~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x430054, dwReserved1=0x714, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0143.602] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbba2da9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x430054, dwReserved1=0x714, cFileName="watermark.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WATERM~1.EJE")) returned 1 [0143.603] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xccdbcae4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~1.EJE")) returned 1 [0143.603] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xcce2f139, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~2.EJE")) returned 1 [0143.603] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xce142189, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~3.EJE")) returned 1 [0143.603] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 1 [0143.603] FindNextFileW (in: hFindFile=0xfe9d00, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 0 [0143.603] FindClose (in: hFindFile=0xfe9d00 | out: hFindFile=0xfe9d00) returned 1 [0143.603] GetProcessHeap () returned 0xfd0000 [0143.603] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0143.604] FindNextFileW (in: hFindFile=0xfe9800, lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x97572a, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0143.604] GetProcessHeap () returned 0xfd0000 [0143.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0143.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.604] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="..", cAlternateFileName="")) returned 1 [0143.605] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x714, cFileName="BCD", cAlternateFileName="")) returned 1 [0143.605] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x714, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0143.605] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0143.605] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0143.605] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0143.605] GetProcessHeap () returned 0xfd0000 [0143.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0143.605] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0143.606] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0143.606] GetProcessHeap () returned 0xfd0000 [0143.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xce273134, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xce273134, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xce2994c2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x430054, dwReserved1=0x714, cFileName="BOOTSTAT.DAT.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="BOOTST~1.EJE")) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0143.606] GetProcessHeap () returned 0xfd0000 [0143.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.606] FindNextFileW (in: hFindFile=0x10b7740, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x10b7740, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.606] GetProcessHeap () returned 0xfd0000 [0143.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.606] GetProcessHeap () returned 0xfd0000 [0143.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.607] GetProcessHeap () returned 0xfd0000 [0143.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.608] GetProcessHeap () returned 0xfd0000 [0143.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.609] GetProcessHeap () returned 0xfd0000 [0143.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.610] GetProcessHeap () returned 0xfd0000 [0143.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.611] GetProcessHeap () returned 0xfd0000 [0143.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.612] GetProcessHeap () returned 0xfd0000 [0143.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.613] GetProcessHeap () returned 0xfd0000 [0143.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.613] GetProcessHeap () returned 0xfd0000 [0143.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540c0 [0143.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.614] GetProcessHeap () returned 0xfd0000 [0143.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540c0 | out: hHeap=0xfd0000) returned 1 [0143.614] GetProcessHeap () returned 0xfd0000 [0143.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.614] GetProcessHeap () returned 0xfd0000 [0143.615] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.615] GetProcessHeap () returned 0xfd0000 [0143.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.615] GetProcessHeap () returned 0xfd0000 [0143.615] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.615] GetProcessHeap () returned 0xfd0000 [0143.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.615] GetProcessHeap () returned 0xfd0000 [0143.615] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.616] GetProcessHeap () returned 0xfd0000 [0143.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.617] GetProcessHeap () returned 0xfd0000 [0143.618] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.618] GetProcessHeap () returned 0xfd0000 [0143.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.618] GetProcessHeap () returned 0xfd0000 [0143.618] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0143.618] GetProcessHeap () returned 0xfd0000 [0143.618] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0143.619] GetProcessHeap () returned 0xfd0000 [0143.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0143.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.619] GetProcessHeap () returned 0xfd0000 [0143.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0143.619] GetProcessHeap () returned 0xfd0000 [0143.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0143.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xd0e9af28, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xd0e9af28, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.624] GetProcessHeap () returned 0xfd0000 [0143.624] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0143.624] GetProcessHeap () returned 0xfd0000 [0143.624] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0143.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows PowerShell.evtx", cAlternateFileName="咊\x97þ巠Ă\x80")) returned 0xffffffff [0143.624] GetProcessHeap () returned 0xfd0000 [0143.624] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0143.624] GetProcessHeap () returned 0xfd0000 [0143.624] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0143.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0143.624] GetProcessHeap () returned 0xfd0000 [0143.624] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0143.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0143.625] GetProcessHeap () returned 0xfd0000 [0143.625] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540c0 [0143.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.626] GetProcessHeap () returned 0xfd0000 [0143.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540c0 | out: hHeap=0xfd0000) returned 1 [0143.626] GetProcessHeap () returned 0xfd0000 [0143.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540c0 [0143.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0143.626] GetProcessHeap () returned 0xfd0000 [0143.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.627] GetProcessHeap () returned 0xfd0000 [0143.627] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0143.627] GetProcessHeap () returned 0xfd0000 [0143.627] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0143.772] GetProcessHeap () returned 0xfd0000 [0143.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.773] GetProcessHeap () returned 0xfd0000 [0143.774] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.774] GetProcessHeap () returned 0xfd0000 [0143.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0143.776] GetProcessHeap () returned 0xfd0000 [0143.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.776] GetProcessHeap () returned 0xfd0000 [0143.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.776] GetProcessHeap () returned 0xfd0000 [0143.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.776] GetProcessHeap () returned 0xfd0000 [0143.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0143.776] GetProcessHeap () returned 0xfd0000 [0143.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.776] GetProcessHeap () returned 0xfd0000 [0143.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.777] GetProcessHeap () returned 0xfd0000 [0143.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.779] GetProcessHeap () returned 0xfd0000 [0143.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.781] GetProcessHeap () returned 0xfd0000 [0143.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.781] GetProcessHeap () returned 0xfd0000 [0143.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.783] GetProcessHeap () returned 0xfd0000 [0143.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.783] GetProcessHeap () returned 0xfd0000 [0143.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.783] GetProcessHeap () returned 0xfd0000 [0143.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.783] GetProcessHeap () returned 0xfd0000 [0143.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0143.788] GetProcessHeap () returned 0xfd0000 [0143.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.788] GetProcessHeap () returned 0xfd0000 [0143.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0143.788] GetProcessHeap () returned 0xfd0000 [0143.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.788] GetProcessHeap () returned 0xfd0000 [0143.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.791] GetProcessHeap () returned 0xfd0000 [0143.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.791] GetProcessHeap () returned 0xfd0000 [0143.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.791] GetProcessHeap () returned 0xfd0000 [0143.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.792] GetProcessHeap () returned 0xfd0000 [0143.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.792] GetProcessHeap () returned 0xfd0000 [0143.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.792] GetProcessHeap () returned 0xfd0000 [0143.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.792] GetProcessHeap () returned 0xfd0000 [0143.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.792] GetProcessHeap () returned 0xfd0000 [0143.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0143.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0143.798] GetProcessHeap () returned 0xfd0000 [0143.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0143.799] GetProcessHeap () returned 0xfd0000 [0143.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.799] GetProcessHeap () returned 0xfd0000 [0143.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.800] GetProcessHeap () returned 0xfd0000 [0143.800] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.800] GetProcessHeap () returned 0xfd0000 [0143.800] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.800] GetProcessHeap () returned 0xfd0000 [0143.800] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.800] GetProcessHeap () returned 0xfd0000 [0143.800] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.800] GetProcessHeap () returned 0xfd0000 [0143.800] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.800] GetProcessHeap () returned 0xfd0000 [0143.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a440b8 [0143.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0143.801] GetProcessHeap () returned 0xfd0000 [0143.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a440b8 | out: hHeap=0xfd0000) returned 1 [0143.802] GetProcessHeap () returned 0xfd0000 [0143.802] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.807] GetProcessHeap () returned 0xfd0000 [0143.807] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.807] GetProcessHeap () returned 0xfd0000 [0143.807] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.807] GetProcessHeap () returned 0xfd0000 [0143.807] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.807] GetProcessHeap () returned 0xfd0000 [0143.807] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0143.808] GetProcessHeap () returned 0xfd0000 [0143.808] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.808] GetProcessHeap () returned 0xfd0000 [0143.808] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0143.811] GetProcessHeap () returned 0xfd0000 [0143.811] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.811] GetProcessHeap () returned 0xfd0000 [0143.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0143.812] GetProcessHeap () returned 0xfd0000 [0143.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.812] GetProcessHeap () returned 0xfd0000 [0143.812] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.812] GetProcessHeap () returned 0xfd0000 [0143.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.812] GetProcessHeap () returned 0xfd0000 [0143.812] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0143.812] GetProcessHeap () returned 0xfd0000 [0143.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.812] GetProcessHeap () returned 0xfd0000 [0143.812] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0143.815] GetProcessHeap () returned 0xfd0000 [0143.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.815] GetProcessHeap () returned 0xfd0000 [0143.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0143.815] GetProcessHeap () returned 0xfd0000 [0143.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.815] GetProcessHeap () returned 0xfd0000 [0143.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0143.815] GetProcessHeap () returned 0xfd0000 [0143.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.815] GetProcessHeap () returned 0xfd0000 [0143.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0143.816] GetProcessHeap () returned 0xfd0000 [0143.816] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.816] GetProcessHeap () returned 0xfd0000 [0143.816] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7740 [0143.818] GetProcessHeap () returned 0xfd0000 [0143.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.818] GetProcessHeap () returned 0xfd0000 [0143.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.818] GetProcessHeap () returned 0xfd0000 [0143.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.819] GetProcessHeap () returned 0xfd0000 [0143.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.819] GetProcessHeap () returned 0xfd0000 [0143.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.819] GetProcessHeap () returned 0xfd0000 [0143.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.819] GetProcessHeap () returned 0xfd0000 [0143.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.819] GetProcessHeap () returned 0xfd0000 [0143.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.822] GetProcessHeap () returned 0xfd0000 [0143.823] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.823] GetProcessHeap () returned 0xfd0000 [0143.823] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0143.826] GetProcessHeap () returned 0xfd0000 [0143.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.827] GetProcessHeap () returned 0xfd0000 [0143.827] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0143.827] GetProcessHeap () returned 0xfd0000 [0143.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.827] GetProcessHeap () returned 0xfd0000 [0143.827] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0143.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5fe, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.827] GetProcessHeap () returned 0xfd0000 [0143.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0143.827] GetProcessHeap () returned 0xfd0000 [0143.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0143.828] GetProcessHeap () returned 0xfd0000 [0143.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.829] GetProcessHeap () returned 0xfd0000 [0143.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a430b0 [0143.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0143.829] GetProcessHeap () returned 0xfd0000 [0143.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a430b0 | out: hHeap=0xfd0000) returned 1 [0143.831] GetProcessHeap () returned 0xfd0000 [0143.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0143.831] GetProcessHeap () returned 0xfd0000 [0143.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.833] GetProcessHeap () returned 0xfd0000 [0143.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a430b0 [0143.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3fd, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0143.836] GetProcessHeap () returned 0xfd0000 [0143.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a430b0 | out: hHeap=0xfd0000) returned 1 [0143.836] GetProcessHeap () returned 0xfd0000 [0143.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0143.836] GetProcessHeap () returned 0xfd0000 [0143.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0143.842] GetProcessHeap () returned 0xfd0000 [0143.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0143.843] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0143.843] GetProcessHeap () returned 0xfd0000 [0143.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0143.843] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.843] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0143.843] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0143.843] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0143.843] GetProcessHeap () returned 0xfd0000 [0143.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0143.843] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0143.843] GetProcessHeap () returned 0xfd0000 [0143.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0143.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.014] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0144.015] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0144.016] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0144.016] GetProcessHeap () returned 0xfd0000 [0144.016] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0144.016] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="TextConv", cAlternateFileName="")) returned 1 [0144.016] GetProcessHeap () returned 0xfd0000 [0144.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0144.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0144.017] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.017] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.017] GetProcessHeap () returned 0xfd0000 [0144.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0144.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.018] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.018] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 0 [0144.018] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.018] GetProcessHeap () returned 0xfd0000 [0144.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0144.018] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0144.018] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0144.018] GetProcessHeap () returned 0xfd0000 [0144.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0144.019] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="Triedit", cAlternateFileName="")) returned 1 [0144.019] GetProcessHeap () returned 0xfd0000 [0144.019] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0144.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.020] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.021] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.021] GetProcessHeap () returned 0xfd0000 [0144.021] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0144.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0144.021] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.022] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 0 [0144.022] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0144.022] GetProcessHeap () returned 0xfd0000 [0144.022] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0144.022] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0144.022] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.022] GetProcessHeap () returned 0xfd0000 [0144.022] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0144.023] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="VC", cAlternateFileName="")) returned 1 [0144.023] GetProcessHeap () returned 0xfd0000 [0144.023] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0144.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.024] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0144.025] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.025] GetProcessHeap () returned 0xfd0000 [0144.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="VGX", cAlternateFileName="")) returned 1 [0144.025] GetProcessHeap () returned 0xfd0000 [0144.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0144.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0144.025] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0144.025] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0144.025] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0144.043] GetProcessHeap () returned 0xfd0000 [0144.043] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0144.043] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="VSTO", cAlternateFileName="")) returned 1 [0144.044] GetProcessHeap () returned 0xfd0000 [0144.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a650d0 [0144.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.044] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.044] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0144.044] GetProcessHeap () returned 0xfd0000 [0144.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a330a8 [0144.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0144.048] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.048] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="1033", cAlternateFileName="")) returned 1 [0144.048] GetProcessHeap () returned 0xfd0000 [0144.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a430b0 [0144.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7dd, dwReserved1=0x9dd, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.051] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe7dd, dwReserved1=0x9dd, cFileName="..", cAlternateFileName="")) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0xffffe7dd, dwReserved1=0x9dd, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0xffffe7dd, dwReserved1=0x9dd, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7780, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0xffffe7dd, dwReserved1=0x9dd, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0144.051] FindClose (in: hFindFile=0x10b7780 | out: hFindFile=0x10b7780) returned 1 [0144.051] GetProcessHeap () returned 0xfd0000 [0144.051] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a430b0 | out: hHeap=0xfd0000) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0144.051] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0144.051] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0144.052] GetProcessHeap () returned 0xfd0000 [0144.052] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a330a8 | out: hHeap=0xfd0000) returned 1 [0144.052] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0144.052] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0144.052] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0144.052] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0144.052] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0144.053] GetProcessHeap () returned 0xfd0000 [0144.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a650d0 | out: hHeap=0xfd0000) returned 1 [0144.053] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="VSTO", cAlternateFileName="")) returned 0 [0144.053] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0144.053] GetProcessHeap () returned 0xfd0000 [0144.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540c0 | out: hHeap=0xfd0000) returned 1 [0144.054] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0144.054] GetProcessHeap () returned 0xfd0000 [0144.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0144.055] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="..", cAlternateFileName="")) returned 1 [0144.055] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x17e, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0144.055] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x17e, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0144.055] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0144.056] GetProcessHeap () returned 0xfd0000 [0144.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0144.056] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0144.056] GetProcessHeap () returned 0xfd0000 [0144.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0144.246] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="..", cAlternateFileName="")) returned 1 [0144.255] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="ado", cAlternateFileName="")) returned 1 [0144.255] GetProcessHeap () returned 0xfd0000 [0144.285] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.286] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="..", cAlternateFileName="")) returned 1 [0144.286] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0144.286] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0144.286] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.286] GetProcessHeap () returned 0xfd0000 [0144.286] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.286] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0144.287] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.287] GetProcessHeap () returned 0xfd0000 [0144.287] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0144.287] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0144.288] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0144.288] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.288] GetProcessHeap () returned 0xfd0000 [0144.288] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.289] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x17e, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0144.289] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.289] GetProcessHeap () returned 0xfd0000 [0144.289] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.289] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="..", cAlternateFileName="")) returned 1 [0144.289] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0144.290] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0144.290] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0144.290] GetProcessHeap () returned 0xfd0000 [0144.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.290] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="msadc", cAlternateFileName="")) returned 1 [0144.290] GetProcessHeap () returned 0xfd0000 [0144.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0144.290] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="..", cAlternateFileName="")) returned 1 [0144.290] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0144.290] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0144.290] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.290] GetProcessHeap () returned 0xfd0000 [0144.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0144.291] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0144.291] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.292] GetProcessHeap () returned 0xfd0000 [0144.292] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0144.292] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0144.292] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0144.292] GetProcessHeap () returned 0xfd0000 [0144.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.293] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17e, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0144.293] GetProcessHeap () returned 0xfd0000 [0144.293] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.294] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="..", cAlternateFileName="")) returned 1 [0144.294] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.294] GetProcessHeap () returned 0xfd0000 [0144.294] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.294] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="..", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x1ee, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0144.295] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.295] GetProcessHeap () returned 0xfd0000 [0144.295] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0144.295] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0144.296] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x3ef, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0144.296] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.296] GetProcessHeap () returned 0xfd0000 [0144.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.297] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x17e, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0144.297] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x17e, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0144.297] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x17e, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0144.297] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0144.298] GetProcessHeap () returned 0xfd0000 [0144.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0144.298] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0144.298] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0144.298] GetProcessHeap () returned 0xfd0000 [0144.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0144.298] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x430054, dwReserved1=0x714, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.299] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0144.299] GetProcessHeap () returned 0xfd0000 [0144.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0144.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.299] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.299] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50817450, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0xfa861600, ftLastAccessTime.dwHighDateTime=0x1d5d020, ftLastWriteTime.dwLowDateTime=0xfa861600, ftLastWriteTime.dwHighDateTime=0x1d5d020, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="appointment_impressed.exe", cAlternateFileName="APPOIN~1.EXE")) returned 1 [0144.299] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.299] GetProcessHeap () returned 0xfd0000 [0144.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0144.300] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.300] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0144.300] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0144.300] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0144.300] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0144.300] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0144.300] GetProcessHeap () returned 0xfd0000 [0144.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.300] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0144.300] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212334b0, ftCreationTime.dwHighDateTime=0x1d589bc, ftLastAccessTime.dwLowDateTime=0xf7007d40, ftLastAccessTime.dwHighDateTime=0x1d59f42, ftLastWriteTime.dwLowDateTime=0xf7007d40, ftLastWriteTime.dwHighDateTime=0x1d59f42, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0144.301] GetProcessHeap () returned 0xfd0000 [0144.301] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.301] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b7800, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0144.301] FindClose (in: hFindFile=0x10b7800 | out: hFindFile=0x10b7800) returned 1 [0144.301] GetProcessHeap () returned 0xfd0000 [0144.301] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.301] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0144.302] GetProcessHeap () returned 0xfd0000 [0144.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0144.302] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.302] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0144.302] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0144.302] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0144.302] GetProcessHeap () returned 0xfd0000 [0144.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.302] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0144.302] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0144.302] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0144.302] GetProcessHeap () returned 0xfd0000 [0144.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0144.303] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Java", cAlternateFileName="")) returned 1 [0144.303] GetProcessHeap () returned 0xfd0000 [0144.303] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0144.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0144.501] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.501] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a59d780, ftCreationTime.dwHighDateTime=0x1d5b2ea, ftLastAccessTime.dwLowDateTime=0xa2bc2510, ftLastAccessTime.dwHighDateTime=0x1d5bd45, ftLastWriteTime.dwLowDateTime=0xa2bc2510, ftLastWriteTime.dwHighDateTime=0x1d5bd45, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="brook_den.exe", cAlternateFileName="BROOK_~1.EXE")) returned 1 [0144.501] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0144.501] GetProcessHeap () returned 0xfd0000 [0144.501] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.504] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.504] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0144.504] GetProcessHeap () returned 0xfd0000 [0144.504] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0144.507] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="..", cAlternateFileName="")) returned 1 [0144.508] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0144.508] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0144.508] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0144.508] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0144.509] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0144.509] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0144.509] GetProcessHeap () returned 0xfd0000 [0144.509] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0144.510] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="..", cAlternateFileName="")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x7dc, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0144.510] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0144.510] GetProcessHeap () returned 0xfd0000 [0144.510] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="java.dll", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="java.exe", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0144.511] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0144.513] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0144.514] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x1fc, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0144.514] GetProcessHeap () returned 0xfd0000 [0144.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.515] GetProcessHeap () returned 0xfd0000 [0144.515] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.516] GetProcessHeap () returned 0xfd0000 [0144.516] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f30050 [0144.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7dc, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0144.517] GetProcessHeap () returned 0xfd0000 [0144.517] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f30050 | out: hHeap=0xfd0000) returned 1 [0144.517] GetProcessHeap () returned 0xfd0000 [0144.517] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0144.517] GetProcessHeap () returned 0xfd0000 [0144.517] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0144.524] GetProcessHeap () returned 0xfd0000 [0144.524] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0144.526] GetProcessHeap () returned 0xfd0000 [0144.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.527] GetProcessHeap () returned 0xfd0000 [0144.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.527] GetProcessHeap () returned 0xfd0000 [0144.527] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.527] GetProcessHeap () returned 0xfd0000 [0144.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0144.528] GetProcessHeap () returned 0xfd0000 [0144.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.528] GetProcessHeap () returned 0xfd0000 [0144.528] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0144.531] GetProcessHeap () returned 0xfd0000 [0144.531] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.531] GetProcessHeap () returned 0xfd0000 [0144.531] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.534] GetProcessHeap () returned 0xfd0000 [0144.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.534] GetProcessHeap () returned 0xfd0000 [0144.534] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0144.537] GetProcessHeap () returned 0xfd0000 [0144.537] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.537] GetProcessHeap () returned 0xfd0000 [0144.537] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0144.538] GetProcessHeap () returned 0xfd0000 [0144.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a410a0 [0144.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5db, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.749] GetProcessHeap () returned 0xfd0000 [0144.749] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a410a0 | out: hHeap=0xfd0000) returned 1 [0144.749] GetProcessHeap () returned 0xfd0000 [0144.749] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.750] GetProcessHeap () returned 0xfd0000 [0144.750] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0144.752] GetProcessHeap () returned 0xfd0000 [0144.752] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.752] GetProcessHeap () returned 0xfd0000 [0144.752] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.758] GetProcessHeap () returned 0xfd0000 [0144.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.758] GetProcessHeap () returned 0xfd0000 [0144.758] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0144.761] GetProcessHeap () returned 0xfd0000 [0144.761] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.761] GetProcessHeap () returned 0xfd0000 [0144.761] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0144.762] GetProcessHeap () returned 0xfd0000 [0144.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.762] GetProcessHeap () returned 0xfd0000 [0144.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0144.763] GetProcessHeap () returned 0xfd0000 [0144.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0144.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0144.763] GetProcessHeap () returned 0xfd0000 [0144.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0144.764] GetProcessHeap () returned 0xfd0000 [0144.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.764] GetProcessHeap () returned 0xfd0000 [0144.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.770] GetProcessHeap () returned 0xfd0000 [0144.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0144.770] GetProcessHeap () returned 0xfd0000 [0144.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0144.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0144.771] GetProcessHeap () returned 0xfd0000 [0144.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.775] GetProcessHeap () returned 0xfd0000 [0144.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0144.775] GetProcessHeap () returned 0xfd0000 [0144.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0144.776] GetProcessHeap () returned 0xfd0000 [0144.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0144.987] GetProcessHeap () returned 0xfd0000 [0144.987] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.988] GetProcessHeap () returned 0xfd0000 [0144.988] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0144.989] GetProcessHeap () returned 0xfd0000 [0144.989] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a410a0 [0144.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d9, cFileName=".", cAlternateFileName="")) returned 0x10b79c0 [0144.993] GetProcessHeap () returned 0xfd0000 [0144.993] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a410a0 | out: hHeap=0xfd0000) returned 1 [0144.993] GetProcessHeap () returned 0xfd0000 [0144.993] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.994] GetProcessHeap () returned 0xfd0000 [0144.994] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0144.994] GetProcessHeap () returned 0xfd0000 [0144.994] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0144.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0144.996] GetProcessHeap () returned 0xfd0000 [0144.996] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0144.999] GetProcessHeap () returned 0xfd0000 [0144.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0144.999] GetProcessHeap () returned 0xfd0000 [0144.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0144.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0145.214] GetProcessHeap () returned 0xfd0000 [0145.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.214] GetProcessHeap () returned 0xfd0000 [0145.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0145.218] GetProcessHeap () returned 0xfd0000 [0145.218] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.218] GetProcessHeap () returned 0xfd0000 [0145.218] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.219] GetProcessHeap () returned 0xfd0000 [0145.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7880 [0145.226] GetProcessHeap () returned 0xfd0000 [0145.226] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.226] GetProcessHeap () returned 0xfd0000 [0145.226] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0145.228] GetProcessHeap () returned 0xfd0000 [0145.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.228] GetProcessHeap () returned 0xfd0000 [0145.228] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0145.238] GetProcessHeap () returned 0xfd0000 [0145.238] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.238] GetProcessHeap () returned 0xfd0000 [0145.238] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0145.920] GetProcessHeap () returned 0xfd0000 [0145.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.921] GetProcessHeap () returned 0xfd0000 [0145.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0145.922] GetProcessHeap () returned 0xfd0000 [0145.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.922] GetProcessHeap () returned 0xfd0000 [0145.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0145.924] GetProcessHeap () returned 0xfd0000 [0145.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0145.931] GetProcessHeap () returned 0xfd0000 [0145.931] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.931] GetProcessHeap () returned 0xfd0000 [0145.931] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0145.932] GetProcessHeap () returned 0xfd0000 [0145.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.932] GetProcessHeap () returned 0xfd0000 [0145.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0145.933] GetProcessHeap () returned 0xfd0000 [0145.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.933] GetProcessHeap () returned 0xfd0000 [0145.933] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7780 [0145.937] GetProcessHeap () returned 0xfd0000 [0145.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0145.937] GetProcessHeap () returned 0xfd0000 [0145.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0145.939] GetProcessHeap () returned 0xfd0000 [0145.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0145.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0145.943] GetProcessHeap () returned 0xfd0000 [0145.943] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0145.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8b68835, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8b68835, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0145.946] GetProcessHeap () returned 0xfd0000 [0145.946] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0145.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b7800 [0145.947] GetProcessHeap () returned 0xfd0000 [0145.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0145.947] GetProcessHeap () returned 0xfd0000 [0145.947] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0145.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x99937c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99937c0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0145.951] GetProcessHeap () returned 0xfd0000 [0145.951] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0145.964] GetProcessHeap () returned 0xfd0000 [0145.964] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0145.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0145.970] GetProcessHeap () returned 0xfd0000 [0145.970] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0145.970] GetProcessHeap () returned 0xfd0000 [0145.970] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0145.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0145.978] GetProcessHeap () returned 0xfd0000 [0145.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0145.978] GetProcessHeap () returned 0xfd0000 [0145.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a31098 [0145.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0145.981] GetProcessHeap () returned 0xfd0000 [0145.981] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a31098 | out: hHeap=0xfd0000) returned 1 [0146.336] GetProcessHeap () returned 0xfd0000 [0146.336] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0146.336] GetProcessHeap () returned 0xfd0000 [0146.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0146.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.337] GetProcessHeap () returned 0xfd0000 [0146.337] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0146.337] GetProcessHeap () returned 0xfd0000 [0146.337] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0146.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0146.338] GetProcessHeap () returned 0xfd0000 [0146.338] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0146.338] GetProcessHeap () returned 0xfd0000 [0146.338] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0146.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0146.339] GetProcessHeap () returned 0xfd0000 [0146.339] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0146.339] GetProcessHeap () returned 0xfd0000 [0146.339] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0146.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc9872e88, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc9872e88, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0146.342] GetProcessHeap () returned 0xfd0000 [0146.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0146.342] GetProcessHeap () returned 0xfd0000 [0146.342] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0146.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0146.345] GetProcessHeap () returned 0xfd0000 [0146.345] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0146.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0146.346] GetProcessHeap () returned 0xfd0000 [0146.346] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a630c0 [0146.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0146.350] GetProcessHeap () returned 0xfd0000 [0146.350] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0146.353] GetProcessHeap () returned 0xfd0000 [0146.353] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.353] GetProcessHeap () returned 0xfd0000 [0146.353] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0146.357] GetProcessHeap () returned 0xfd0000 [0146.357] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.357] GetProcessHeap () returned 0xfd0000 [0146.357] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0146.396] GetProcessHeap () returned 0xfd0000 [0146.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.396] GetProcessHeap () returned 0xfd0000 [0146.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.401] GetProcessHeap () returned 0xfd0000 [0146.401] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.401] GetProcessHeap () returned 0xfd0000 [0146.401] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.414] GetProcessHeap () returned 0xfd0000 [0146.414] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.414] GetProcessHeap () returned 0xfd0000 [0146.414] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.417] GetProcessHeap () returned 0xfd0000 [0146.417] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.417] GetProcessHeap () returned 0xfd0000 [0146.417] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0146.420] GetProcessHeap () returned 0xfd0000 [0146.420] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.420] GetProcessHeap () returned 0xfd0000 [0146.420] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0146.424] GetProcessHeap () returned 0xfd0000 [0146.424] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.424] GetProcessHeap () returned 0xfd0000 [0146.424] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0146.427] GetProcessHeap () returned 0xfd0000 [0146.427] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.427] GetProcessHeap () returned 0xfd0000 [0146.427] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.434] GetProcessHeap () returned 0xfd0000 [0146.434] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.434] GetProcessHeap () returned 0xfd0000 [0146.434] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.437] GetProcessHeap () returned 0xfd0000 [0146.437] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.437] GetProcessHeap () returned 0xfd0000 [0146.437] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0146.440] GetProcessHeap () returned 0xfd0000 [0146.440] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.440] GetProcessHeap () returned 0xfd0000 [0146.440] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0146.694] GetProcessHeap () returned 0xfd0000 [0146.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.694] GetProcessHeap () returned 0xfd0000 [0146.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0146.697] GetProcessHeap () returned 0xfd0000 [0146.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.697] GetProcessHeap () returned 0xfd0000 [0146.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0146.701] GetProcessHeap () returned 0xfd0000 [0146.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.701] GetProcessHeap () returned 0xfd0000 [0146.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0146.704] GetProcessHeap () returned 0xfd0000 [0146.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.704] GetProcessHeap () returned 0xfd0000 [0146.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0146.709] GetProcessHeap () returned 0xfd0000 [0146.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.709] GetProcessHeap () returned 0xfd0000 [0146.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0146.712] GetProcessHeap () returned 0xfd0000 [0146.712] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.712] GetProcessHeap () returned 0xfd0000 [0146.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.722] GetProcessHeap () returned 0xfd0000 [0146.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.722] GetProcessHeap () returned 0xfd0000 [0146.722] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.726] GetProcessHeap () returned 0xfd0000 [0146.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.726] GetProcessHeap () returned 0xfd0000 [0146.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0146.729] GetProcessHeap () returned 0xfd0000 [0146.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0146.729] GetProcessHeap () returned 0xfd0000 [0146.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0146.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.139] GetProcessHeap () returned 0xfd0000 [0147.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.139] GetProcessHeap () returned 0xfd0000 [0147.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.143] GetProcessHeap () returned 0xfd0000 [0147.143] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.143] GetProcessHeap () returned 0xfd0000 [0147.143] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.148] GetProcessHeap () returned 0xfd0000 [0147.148] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.149] GetProcessHeap () returned 0xfd0000 [0147.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.151] GetProcessHeap () returned 0xfd0000 [0147.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.152] GetProcessHeap () returned 0xfd0000 [0147.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\nl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0147.154] GetProcessHeap () returned 0xfd0000 [0147.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.155] GetProcessHeap () returned 0xfd0000 [0147.155] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.158] GetProcessHeap () returned 0xfd0000 [0147.158] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.158] GetProcessHeap () returned 0xfd0000 [0147.158] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.161] GetProcessHeap () returned 0xfd0000 [0147.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.161] GetProcessHeap () returned 0xfd0000 [0147.161] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-BR\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0147.164] GetProcessHeap () returned 0xfd0000 [0147.164] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.164] GetProcessHeap () returned 0xfd0000 [0147.164] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-pt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.168] GetProcessHeap () returned 0xfd0000 [0147.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.168] GetProcessHeap () returned 0xfd0000 [0147.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ro\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.171] GetProcessHeap () returned 0xfd0000 [0147.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.171] GetProcessHeap () returned 0xfd0000 [0147.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ru\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0147.174] GetProcessHeap () returned 0xfd0000 [0147.174] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.174] GetProcessHeap () returned 0xfd0000 [0147.174] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0147.177] GetProcessHeap () returned 0xfd0000 [0147.177] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.177] GetProcessHeap () returned 0xfd0000 [0147.177] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.375] GetProcessHeap () returned 0xfd0000 [0147.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.375] GetProcessHeap () returned 0xfd0000 [0147.375] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Cyrl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.420] GetProcessHeap () returned 0xfd0000 [0147.420] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.420] GetProcessHeap () returned 0xfd0000 [0147.420] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.428] GetProcessHeap () returned 0xfd0000 [0147.428] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.428] GetProcessHeap () returned 0xfd0000 [0147.428] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn-CS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0147.432] GetProcessHeap () returned 0xfd0000 [0147.432] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.432] GetProcessHeap () returned 0xfd0000 [0147.432] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.440] GetProcessHeap () returned 0xfd0000 [0147.440] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.440] GetProcessHeap () returned 0xfd0000 [0147.440] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\th\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1860d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.445] GetProcessHeap () returned 0xfd0000 [0147.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.445] GetProcessHeap () returned 0xfd0000 [0147.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\tr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.454] GetProcessHeap () returned 0xfd0000 [0147.454] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.454] GetProcessHeap () returned 0xfd0000 [0147.454] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\uk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0147.461] GetProcessHeap () returned 0xfd0000 [0147.461] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.462] GetProcessHeap () returned 0xfd0000 [0147.462] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\vi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0147.467] GetProcessHeap () returned 0xfd0000 [0147.467] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.467] GetProcessHeap () returned 0xfd0000 [0147.467] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0147.470] GetProcessHeap () returned 0xfd0000 [0147.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.470] GetProcessHeap () returned 0xfd0000 [0147.470] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANT\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.473] GetProcessHeap () returned 0xfd0000 [0147.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.473] GetProcessHeap () returned 0xfd0000 [0147.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a630c0 | out: hHeap=0xfd0000) returned 1 [0147.474] GetProcessHeap () returned 0xfd0000 [0147.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.474] GetProcessHeap () returned 0xfd0000 [0147.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0147.477] GetProcessHeap () returned 0xfd0000 [0147.477] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0147.477] GetProcessHeap () returned 0xfd0000 [0147.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0147.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0147.480] GetProcessHeap () returned 0xfd0000 [0147.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.483] GetProcessHeap () returned 0xfd0000 [0147.483] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.483] GetProcessHeap () returned 0xfd0000 [0147.483] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0147.591] GetProcessHeap () returned 0xfd0000 [0147.591] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.591] GetProcessHeap () returned 0xfd0000 [0147.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.596] GetProcessHeap () returned 0xfd0000 [0147.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.596] GetProcessHeap () returned 0xfd0000 [0147.596] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.599] GetProcessHeap () returned 0xfd0000 [0147.599] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.599] GetProcessHeap () returned 0xfd0000 [0147.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.602] GetProcessHeap () returned 0xfd0000 [0147.602] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.602] GetProcessHeap () returned 0xfd0000 [0147.602] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.605] GetProcessHeap () returned 0xfd0000 [0147.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.605] GetProcessHeap () returned 0xfd0000 [0147.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.609] GetProcessHeap () returned 0xfd0000 [0147.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.609] GetProcessHeap () returned 0xfd0000 [0147.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.612] GetProcessHeap () returned 0xfd0000 [0147.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.612] GetProcessHeap () returned 0xfd0000 [0147.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.615] GetProcessHeap () returned 0xfd0000 [0147.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.615] GetProcessHeap () returned 0xfd0000 [0147.615] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0147.618] GetProcessHeap () returned 0xfd0000 [0147.618] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.618] GetProcessHeap () returned 0xfd0000 [0147.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0147.621] GetProcessHeap () returned 0xfd0000 [0147.621] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.621] GetProcessHeap () returned 0xfd0000 [0147.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.624] GetProcessHeap () returned 0xfd0000 [0147.624] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.624] GetProcessHeap () returned 0xfd0000 [0147.624] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0147.627] GetProcessHeap () returned 0xfd0000 [0147.627] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.627] GetProcessHeap () returned 0xfd0000 [0147.627] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0147.630] GetProcessHeap () returned 0xfd0000 [0147.630] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.630] GetProcessHeap () returned 0xfd0000 [0147.630] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.779] GetProcessHeap () returned 0xfd0000 [0147.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.779] GetProcessHeap () returned 0xfd0000 [0147.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.787] GetProcessHeap () returned 0xfd0000 [0147.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.788] GetProcessHeap () returned 0xfd0000 [0147.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.791] GetProcessHeap () returned 0xfd0000 [0147.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.791] GetProcessHeap () returned 0xfd0000 [0147.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0147.793] GetProcessHeap () returned 0xfd0000 [0147.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.794] GetProcessHeap () returned 0xfd0000 [0147.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0147.796] GetProcessHeap () returned 0xfd0000 [0147.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.796] GetProcessHeap () returned 0xfd0000 [0147.796] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.799] GetProcessHeap () returned 0xfd0000 [0147.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.799] GetProcessHeap () returned 0xfd0000 [0147.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.802] GetProcessHeap () returned 0xfd0000 [0147.802] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.803] GetProcessHeap () returned 0xfd0000 [0147.803] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.805] GetProcessHeap () returned 0xfd0000 [0147.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.805] GetProcessHeap () returned 0xfd0000 [0147.805] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0147.809] GetProcessHeap () returned 0xfd0000 [0147.809] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.809] GetProcessHeap () returned 0xfd0000 [0147.809] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.811] GetProcessHeap () returned 0xfd0000 [0147.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.812] GetProcessHeap () returned 0xfd0000 [0147.812] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.815] GetProcessHeap () returned 0xfd0000 [0147.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.815] GetProcessHeap () returned 0xfd0000 [0147.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0147.818] GetProcessHeap () returned 0xfd0000 [0147.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.818] GetProcessHeap () returned 0xfd0000 [0147.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0147.821] GetProcessHeap () returned 0xfd0000 [0147.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.821] GetProcessHeap () returned 0xfd0000 [0147.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0147.984] GetProcessHeap () returned 0xfd0000 [0147.984] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.984] GetProcessHeap () returned 0xfd0000 [0147.984] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.987] GetProcessHeap () returned 0xfd0000 [0147.987] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.987] GetProcessHeap () returned 0xfd0000 [0147.987] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.990] GetProcessHeap () returned 0xfd0000 [0147.990] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.990] GetProcessHeap () returned 0xfd0000 [0147.990] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0147.996] GetProcessHeap () returned 0xfd0000 [0147.996] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.996] GetProcessHeap () returned 0xfd0000 [0147.996] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0147.999] GetProcessHeap () returned 0xfd0000 [0147.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0147.999] GetProcessHeap () returned 0xfd0000 [0147.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0147.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.002] GetProcessHeap () returned 0xfd0000 [0148.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.002] GetProcessHeap () returned 0xfd0000 [0148.002] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.005] GetProcessHeap () returned 0xfd0000 [0148.005] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.005] GetProcessHeap () returned 0xfd0000 [0148.005] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0148.008] GetProcessHeap () returned 0xfd0000 [0148.008] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.008] GetProcessHeap () returned 0xfd0000 [0148.008] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.011] GetProcessHeap () returned 0xfd0000 [0148.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.012] GetProcessHeap () returned 0xfd0000 [0148.012] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.014] GetProcessHeap () returned 0xfd0000 [0148.014] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.014] GetProcessHeap () returned 0xfd0000 [0148.014] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.017] GetProcessHeap () returned 0xfd0000 [0148.017] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.017] GetProcessHeap () returned 0xfd0000 [0148.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.020] GetProcessHeap () returned 0xfd0000 [0148.020] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.020] GetProcessHeap () returned 0xfd0000 [0148.020] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.224] GetProcessHeap () returned 0xfd0000 [0148.224] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.224] GetProcessHeap () returned 0xfd0000 [0148.224] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.227] GetProcessHeap () returned 0xfd0000 [0148.227] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.227] GetProcessHeap () returned 0xfd0000 [0148.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0148.231] GetProcessHeap () returned 0xfd0000 [0148.231] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.231] GetProcessHeap () returned 0xfd0000 [0148.231] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0148.234] GetProcessHeap () returned 0xfd0000 [0148.234] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.234] GetProcessHeap () returned 0xfd0000 [0148.234] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.236] GetProcessHeap () returned 0xfd0000 [0148.236] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.236] GetProcessHeap () returned 0xfd0000 [0148.236] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0148.236] GetProcessHeap () returned 0xfd0000 [0148.236] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0148.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0148.242] GetProcessHeap () returned 0xfd0000 [0148.242] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.245] GetProcessHeap () returned 0xfd0000 [0148.245] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.245] GetProcessHeap () returned 0xfd0000 [0148.245] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.249] GetProcessHeap () returned 0xfd0000 [0148.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.249] GetProcessHeap () returned 0xfd0000 [0148.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.253] GetProcessHeap () returned 0xfd0000 [0148.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.253] GetProcessHeap () returned 0xfd0000 [0148.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0148.256] GetProcessHeap () returned 0xfd0000 [0148.256] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.256] GetProcessHeap () returned 0xfd0000 [0148.256] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.259] GetProcessHeap () returned 0xfd0000 [0148.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.259] GetProcessHeap () returned 0xfd0000 [0148.259] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.263] GetProcessHeap () returned 0xfd0000 [0148.263] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.263] GetProcessHeap () returned 0xfd0000 [0148.263] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0148.266] GetProcessHeap () returned 0xfd0000 [0148.266] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.266] GetProcessHeap () returned 0xfd0000 [0148.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.474] GetProcessHeap () returned 0xfd0000 [0148.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.474] GetProcessHeap () returned 0xfd0000 [0148.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.475] GetProcessHeap () returned 0xfd0000 [0148.475] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.475] GetProcessHeap () returned 0xfd0000 [0148.475] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.480] GetProcessHeap () returned 0xfd0000 [0148.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.480] GetProcessHeap () returned 0xfd0000 [0148.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.484] GetProcessHeap () returned 0xfd0000 [0148.484] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.484] GetProcessHeap () returned 0xfd0000 [0148.484] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.488] GetProcessHeap () returned 0xfd0000 [0148.488] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.488] GetProcessHeap () returned 0xfd0000 [0148.488] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.491] GetProcessHeap () returned 0xfd0000 [0148.491] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.491] GetProcessHeap () returned 0xfd0000 [0148.491] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.496] GetProcessHeap () returned 0xfd0000 [0148.496] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.497] GetProcessHeap () returned 0xfd0000 [0148.497] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0148.500] GetProcessHeap () returned 0xfd0000 [0148.500] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.500] GetProcessHeap () returned 0xfd0000 [0148.500] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.507] GetProcessHeap () returned 0xfd0000 [0148.507] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.507] GetProcessHeap () returned 0xfd0000 [0148.507] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0148.512] GetProcessHeap () returned 0xfd0000 [0148.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.512] GetProcessHeap () returned 0xfd0000 [0148.512] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.515] GetProcessHeap () returned 0xfd0000 [0148.515] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.515] GetProcessHeap () returned 0xfd0000 [0148.515] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0148.730] GetProcessHeap () returned 0xfd0000 [0148.730] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.730] GetProcessHeap () returned 0xfd0000 [0148.730] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0148.733] GetProcessHeap () returned 0xfd0000 [0148.733] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.734] GetProcessHeap () returned 0xfd0000 [0148.734] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0148.737] GetProcessHeap () returned 0xfd0000 [0148.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.737] GetProcessHeap () returned 0xfd0000 [0148.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.750] GetProcessHeap () returned 0xfd0000 [0148.750] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.750] GetProcessHeap () returned 0xfd0000 [0148.750] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0148.755] GetProcessHeap () returned 0xfd0000 [0148.755] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.755] GetProcessHeap () returned 0xfd0000 [0148.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.760] GetProcessHeap () returned 0xfd0000 [0148.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.760] GetProcessHeap () returned 0xfd0000 [0148.760] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.764] GetProcessHeap () returned 0xfd0000 [0148.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.764] GetProcessHeap () returned 0xfd0000 [0148.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.767] GetProcessHeap () returned 0xfd0000 [0148.767] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.768] GetProcessHeap () returned 0xfd0000 [0148.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0148.772] GetProcessHeap () returned 0xfd0000 [0148.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.772] GetProcessHeap () returned 0xfd0000 [0148.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0148.777] GetProcessHeap () returned 0xfd0000 [0148.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.777] GetProcessHeap () returned 0xfd0000 [0148.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0148.784] GetProcessHeap () returned 0xfd0000 [0148.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.784] GetProcessHeap () returned 0xfd0000 [0148.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0148.787] GetProcessHeap () returned 0xfd0000 [0148.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0148.788] GetProcessHeap () returned 0xfd0000 [0148.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0148.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0149.011] GetProcessHeap () returned 0xfd0000 [0149.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.011] GetProcessHeap () returned 0xfd0000 [0149.011] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.015] GetProcessHeap () returned 0xfd0000 [0149.015] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.015] GetProcessHeap () returned 0xfd0000 [0149.015] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0149.017] GetProcessHeap () returned 0xfd0000 [0149.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf145ad52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0149.018] GetProcessHeap () returned 0xfd0000 [0149.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.018] GetProcessHeap () returned 0xfd0000 [0149.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.018] GetProcessHeap () returned 0xfd0000 [0149.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.018] GetProcessHeap () returned 0xfd0000 [0149.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0149.019] GetProcessHeap () returned 0xfd0000 [0149.019] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.019] GetProcessHeap () returned 0xfd0000 [0149.019] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.020] GetProcessHeap () returned 0xfd0000 [0149.020] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.020] GetProcessHeap () returned 0xfd0000 [0149.020] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0149.021] GetProcessHeap () returned 0xfd0000 [0149.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.021] GetProcessHeap () returned 0xfd0000 [0149.021] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.022] GetProcessHeap () returned 0xfd0000 [0149.022] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.022] GetProcessHeap () returned 0xfd0000 [0149.022] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.023] GetProcessHeap () returned 0xfd0000 [0149.023] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.023] GetProcessHeap () returned 0xfd0000 [0149.023] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0149.053] GetProcessHeap () returned 0xfd0000 [0149.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.053] GetProcessHeap () returned 0xfd0000 [0149.053] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.055] GetProcessHeap () returned 0xfd0000 [0149.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.055] GetProcessHeap () returned 0xfd0000 [0149.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0149.056] GetProcessHeap () returned 0xfd0000 [0149.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.056] GetProcessHeap () returned 0xfd0000 [0149.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0149.057] GetProcessHeap () returned 0xfd0000 [0149.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.057] GetProcessHeap () returned 0xfd0000 [0149.057] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0149.058] GetProcessHeap () returned 0xfd0000 [0149.058] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.058] GetProcessHeap () returned 0xfd0000 [0149.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.059] GetProcessHeap () returned 0xfd0000 [0149.059] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.060] GetProcessHeap () returned 0xfd0000 [0149.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.061] GetProcessHeap () returned 0xfd0000 [0149.061] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.061] GetProcessHeap () returned 0xfd0000 [0149.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0149.062] GetProcessHeap () returned 0xfd0000 [0149.062] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.062] GetProcessHeap () returned 0xfd0000 [0149.062] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.064] GetProcessHeap () returned 0xfd0000 [0149.064] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.064] GetProcessHeap () returned 0xfd0000 [0149.064] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0149.065] GetProcessHeap () returned 0xfd0000 [0149.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.065] GetProcessHeap () returned 0xfd0000 [0149.065] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0149.066] GetProcessHeap () returned 0xfd0000 [0149.066] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.066] GetProcessHeap () returned 0xfd0000 [0149.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0149.067] GetProcessHeap () returned 0xfd0000 [0149.067] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.067] GetProcessHeap () returned 0xfd0000 [0149.067] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0149.068] GetProcessHeap () returned 0xfd0000 [0149.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.068] GetProcessHeap () returned 0xfd0000 [0149.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0149.069] GetProcessHeap () returned 0xfd0000 [0149.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.069] GetProcessHeap () returned 0xfd0000 [0149.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.085] GetProcessHeap () returned 0xfd0000 [0149.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.085] GetProcessHeap () returned 0xfd0000 [0149.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.087] GetProcessHeap () returned 0xfd0000 [0149.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.087] GetProcessHeap () returned 0xfd0000 [0149.087] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.088] GetProcessHeap () returned 0xfd0000 [0149.088] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.088] GetProcessHeap () returned 0xfd0000 [0149.088] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.089] GetProcessHeap () returned 0xfd0000 [0149.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.089] GetProcessHeap () returned 0xfd0000 [0149.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.090] GetProcessHeap () returned 0xfd0000 [0149.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.090] GetProcessHeap () returned 0xfd0000 [0149.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.092] GetProcessHeap () returned 0xfd0000 [0149.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.092] GetProcessHeap () returned 0xfd0000 [0149.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.092] GetProcessHeap () returned 0xfd0000 [0149.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.092] GetProcessHeap () returned 0xfd0000 [0149.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0149.094] GetProcessHeap () returned 0xfd0000 [0149.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.094] GetProcessHeap () returned 0xfd0000 [0149.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.095] GetProcessHeap () returned 0xfd0000 [0149.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.095] GetProcessHeap () returned 0xfd0000 [0149.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.322] GetProcessHeap () returned 0xfd0000 [0149.322] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.322] GetProcessHeap () returned 0xfd0000 [0149.322] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0149.323] GetProcessHeap () returned 0xfd0000 [0149.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.323] GetProcessHeap () returned 0xfd0000 [0149.324] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.324] GetProcessHeap () returned 0xfd0000 [0149.324] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.325] GetProcessHeap () returned 0xfd0000 [0149.325] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.326] GetProcessHeap () returned 0xfd0000 [0149.326] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.326] GetProcessHeap () returned 0xfd0000 [0149.326] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0149.327] GetProcessHeap () returned 0xfd0000 [0149.327] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.327] GetProcessHeap () returned 0xfd0000 [0149.327] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0149.328] GetProcessHeap () returned 0xfd0000 [0149.328] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.328] GetProcessHeap () returned 0xfd0000 [0149.328] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0149.329] GetProcessHeap () returned 0xfd0000 [0149.329] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.329] GetProcessHeap () returned 0xfd0000 [0149.329] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0149.330] GetProcessHeap () returned 0xfd0000 [0149.330] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.330] GetProcessHeap () returned 0xfd0000 [0149.330] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.331] GetProcessHeap () returned 0xfd0000 [0149.331] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.331] GetProcessHeap () returned 0xfd0000 [0149.331] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0149.332] GetProcessHeap () returned 0xfd0000 [0149.332] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.332] GetProcessHeap () returned 0xfd0000 [0149.332] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.333] GetProcessHeap () returned 0xfd0000 [0149.333] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.333] GetProcessHeap () returned 0xfd0000 [0149.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.334] GetProcessHeap () returned 0xfd0000 [0149.334] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.334] GetProcessHeap () returned 0xfd0000 [0149.334] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0149.335] GetProcessHeap () returned 0xfd0000 [0149.335] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.335] GetProcessHeap () returned 0xfd0000 [0149.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0149.336] GetProcessHeap () returned 0xfd0000 [0149.336] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.336] GetProcessHeap () returned 0xfd0000 [0149.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0149.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0149.337] GetProcessHeap () returned 0xfd0000 [0149.337] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0149.337] GetProcessHeap () returned 0xfd0000 [0149.337] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.337] GetProcessHeap () returned 0xfd0000 [0149.337] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0149.341] GetProcessHeap () returned 0xfd0000 [0149.341] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.341] GetProcessHeap () returned 0xfd0000 [0149.341] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0149.347] GetProcessHeap () returned 0xfd0000 [0149.347] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.348] GetProcessHeap () returned 0xfd0000 [0149.348] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0149.351] GetProcessHeap () returned 0xfd0000 [0149.351] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.351] GetProcessHeap () returned 0xfd0000 [0149.351] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0149.354] GetProcessHeap () returned 0xfd0000 [0149.354] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.354] GetProcessHeap () returned 0xfd0000 [0149.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0149.358] GetProcessHeap () returned 0xfd0000 [0149.358] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.358] GetProcessHeap () returned 0xfd0000 [0149.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0149.362] GetProcessHeap () returned 0xfd0000 [0149.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.362] GetProcessHeap () returned 0xfd0000 [0149.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.365] GetProcessHeap () returned 0xfd0000 [0149.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.365] GetProcessHeap () returned 0xfd0000 [0149.365] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.604] GetProcessHeap () returned 0xfd0000 [0149.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.604] GetProcessHeap () returned 0xfd0000 [0149.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0149.712] GetProcessHeap () returned 0xfd0000 [0149.712] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.712] GetProcessHeap () returned 0xfd0000 [0149.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.722] GetProcessHeap () returned 0xfd0000 [0149.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.722] GetProcessHeap () returned 0xfd0000 [0149.722] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0149.737] GetProcessHeap () returned 0xfd0000 [0149.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.737] GetProcessHeap () returned 0xfd0000 [0149.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0149.758] GetProcessHeap () returned 0xfd0000 [0149.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.758] GetProcessHeap () returned 0xfd0000 [0149.758] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0149.776] GetProcessHeap () returned 0xfd0000 [0149.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.776] GetProcessHeap () returned 0xfd0000 [0149.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0149.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0149.779] GetProcessHeap () returned 0xfd0000 [0149.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0149.779] GetProcessHeap () returned 0xfd0000 [0149.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0149.780] GetProcessHeap () returned 0xfd0000 [0149.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0149.782] GetProcessHeap () returned 0xfd0000 [0149.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0149.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17728794, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17728794, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0149.786] GetProcessHeap () returned 0xfd0000 [0149.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0149.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x176dc2d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0149.997] GetProcessHeap () returned 0xfd0000 [0149.998] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0149.998] GetProcessHeap () returned 0xfd0000 [0150.005] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0150.017] GetProcessHeap () returned 0xfd0000 [0150.017] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.017] GetProcessHeap () returned 0xfd0000 [0150.017] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.017] GetProcessHeap () returned 0xfd0000 [0150.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.021] GetProcessHeap () returned 0xfd0000 [0150.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.021] GetProcessHeap () returned 0xfd0000 [0150.021] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1774e9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1774e9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.024] GetProcessHeap () returned 0xfd0000 [0150.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.025] GetProcessHeap () returned 0xfd0000 [0150.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.027] GetProcessHeap () returned 0xfd0000 [0150.027] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cd4a32, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.030] GetProcessHeap () returned 0xfd0000 [0150.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.030] GetProcessHeap () returned 0xfd0000 [0150.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.031] GetProcessHeap () returned 0xfd0000 [0150.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0150.032] GetProcessHeap () returned 0xfd0000 [0150.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.033] GetProcessHeap () returned 0xfd0000 [0150.033] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.034] GetProcessHeap () returned 0xfd0000 [0150.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.034] GetProcessHeap () returned 0xfd0000 [0150.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.034] GetProcessHeap () returned 0xfd0000 [0150.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.037] GetProcessHeap () returned 0xfd0000 [0150.037] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca90ec5a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca90ec5a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.038] GetProcessHeap () returned 0xfd0000 [0150.038] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0150.069] GetProcessHeap () returned 0xfd0000 [0150.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.069] GetProcessHeap () returned 0xfd0000 [0150.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.069] GetProcessHeap () returned 0xfd0000 [0150.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.235] GetProcessHeap () returned 0xfd0000 [0150.235] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ff3259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x186355ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x186355ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.236] GetProcessHeap () returned 0xfd0000 [0150.236] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0150.242] GetProcessHeap () returned 0xfd0000 [0150.242] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0150.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18aadbcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18aadbcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18aadbcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.244] GetProcessHeap () returned 0xfd0000 [0150.244] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0150.244] GetProcessHeap () returned 0xfd0000 [0150.245] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0150.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0150.252] GetProcessHeap () returned 0xfd0000 [0150.252] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0150.252] GetProcessHeap () returned 0xfd0000 [0150.252] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0150.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0150.253] GetProcessHeap () returned 0xfd0000 [0150.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0150.253] GetProcessHeap () returned 0xfd0000 [0150.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.253] GetProcessHeap () returned 0xfd0000 [0150.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.253] GetProcessHeap () returned 0xfd0000 [0150.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0150.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0150.263] GetProcessHeap () returned 0xfd0000 [0150.263] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0150.263] GetProcessHeap () returned 0xfd0000 [0150.263] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.263] GetProcessHeap () returned 0xfd0000 [0150.263] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.264] GetProcessHeap () returned 0xfd0000 [0150.264] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.265] GetProcessHeap () returned 0xfd0000 [0150.265] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.270] GetProcessHeap () returned 0xfd0000 [0150.270] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.270] GetProcessHeap () returned 0xfd0000 [0150.270] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.291] GetProcessHeap () returned 0xfd0000 [0150.291] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.291] GetProcessHeap () returned 0xfd0000 [0150.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0150.294] GetProcessHeap () returned 0xfd0000 [0150.294] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.294] GetProcessHeap () returned 0xfd0000 [0150.294] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.294] GetProcessHeap () returned 0xfd0000 [0150.294] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0150.298] GetProcessHeap () returned 0xfd0000 [0150.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.298] GetProcessHeap () returned 0xfd0000 [0150.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0150.299] GetProcessHeap () returned 0xfd0000 [0150.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0150.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.300] GetProcessHeap () returned 0xfd0000 [0150.300] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0150.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0150.304] GetProcessHeap () returned 0xfd0000 [0150.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0150.304] GetProcessHeap () returned 0xfd0000 [0150.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0150.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0150.305] GetProcessHeap () returned 0xfd0000 [0150.305] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0150.305] GetProcessHeap () returned 0xfd0000 [0150.305] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0150.305] GetProcessHeap () returned 0xfd0000 [0150.305] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.306] GetProcessHeap () returned 0xfd0000 [0150.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0150.310] GetProcessHeap () returned 0xfd0000 [0150.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.310] GetProcessHeap () returned 0xfd0000 [0150.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.311] GetProcessHeap () returned 0xfd0000 [0150.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0150.312] GetProcessHeap () returned 0xfd0000 [0150.312] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.563] GetProcessHeap () returned 0xfd0000 [0150.572] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.572] GetProcessHeap () returned 0xfd0000 [0150.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\SOLVER\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.581] GetProcessHeap () returned 0xfd0000 [0150.581] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.581] GetProcessHeap () returned 0xfd0000 [0150.581] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.582] GetProcessHeap () returned 0xfd0000 [0150.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.626] GetProcessHeap () returned 0xfd0000 [0150.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.631] GetProcessHeap () returned 0xfd0000 [0150.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b22ac67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b22ac67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.636] GetProcessHeap () returned 0xfd0000 [0150.636] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0150.828] GetProcessHeap () returned 0xfd0000 [0150.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0150.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b3a83c3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b3a83c3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0150.863] GetProcessHeap () returned 0xfd0000 [0150.863] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ar\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0150.864] GetProcessHeap () returned 0xfd0000 [0150.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.864] GetProcessHeap () returned 0xfd0000 [0150.864] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\bg\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.865] GetProcessHeap () returned 0xfd0000 [0150.865] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.865] GetProcessHeap () returned 0xfd0000 [0150.865] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0150.866] GetProcessHeap () returned 0xfd0000 [0150.866] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.866] GetProcessHeap () returned 0xfd0000 [0150.866] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\cs\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.869] GetProcessHeap () returned 0xfd0000 [0150.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.869] GetProcessHeap () returned 0xfd0000 [0150.869] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\da\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.870] GetProcessHeap () returned 0xfd0000 [0150.870] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.870] GetProcessHeap () returned 0xfd0000 [0150.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\de\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.875] GetProcessHeap () returned 0xfd0000 [0150.875] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.875] GetProcessHeap () returned 0xfd0000 [0150.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\el\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0150.876] GetProcessHeap () returned 0xfd0000 [0150.876] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.876] GetProcessHeap () returned 0xfd0000 [0150.876] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\en-us\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.877] GetProcessHeap () returned 0xfd0000 [0150.877] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.877] GetProcessHeap () returned 0xfd0000 [0150.877] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\es\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0150.878] GetProcessHeap () returned 0xfd0000 [0150.878] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.878] GetProcessHeap () returned 0xfd0000 [0150.878] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\et\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.879] GetProcessHeap () returned 0xfd0000 [0150.879] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.879] GetProcessHeap () returned 0xfd0000 [0150.879] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\eu\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0150.880] GetProcessHeap () returned 0xfd0000 [0150.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.880] GetProcessHeap () returned 0xfd0000 [0150.880] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fi\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0150.881] GetProcessHeap () returned 0xfd0000 [0150.881] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.881] GetProcessHeap () returned 0xfd0000 [0150.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fr\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0150.881] GetProcessHeap () returned 0xfd0000 [0150.881] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.882] GetProcessHeap () returned 0xfd0000 [0150.882] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\gl\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0150.882] GetProcessHeap () returned 0xfd0000 [0150.882] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.883] GetProcessHeap () returned 0xfd0000 [0150.883] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.883] GetProcessHeap () returned 0xfd0000 [0150.884] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.884] GetProcessHeap () returned 0xfd0000 [0150.884] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hi\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.885] GetProcessHeap () returned 0xfd0000 [0150.885] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.885] GetProcessHeap () returned 0xfd0000 [0150.885] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hr\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0150.886] GetProcessHeap () returned 0xfd0000 [0150.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.886] GetProcessHeap () returned 0xfd0000 [0150.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hu\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.887] GetProcessHeap () returned 0xfd0000 [0150.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.887] GetProcessHeap () returned 0xfd0000 [0150.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\id\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.888] GetProcessHeap () returned 0xfd0000 [0150.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.889] GetProcessHeap () returned 0xfd0000 [0150.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\it\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b433, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59b433, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59b433, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.890] GetProcessHeap () returned 0xfd0000 [0150.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.890] GetProcessHeap () returned 0xfd0000 [0150.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ja\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.891] GetProcessHeap () returned 0xfd0000 [0150.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.891] GetProcessHeap () returned 0xfd0000 [0150.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\kk\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0150.892] GetProcessHeap () returned 0xfd0000 [0150.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.892] GetProcessHeap () returned 0xfd0000 [0150.892] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ko\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0150.893] GetProcessHeap () returned 0xfd0000 [0150.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.893] GetProcessHeap () returned 0xfd0000 [0150.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lt\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0150.893] GetProcessHeap () returned 0xfd0000 [0150.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.893] GetProcessHeap () returned 0xfd0000 [0150.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lv\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0150.894] GetProcessHeap () returned 0xfd0000 [0150.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.894] GetProcessHeap () returned 0xfd0000 [0150.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ms\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0150.895] GetProcessHeap () returned 0xfd0000 [0150.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.895] GetProcessHeap () returned 0xfd0000 [0150.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\nl\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf2dd35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf2dd35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.896] GetProcessHeap () returned 0xfd0000 [0150.896] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.896] GetProcessHeap () returned 0xfd0000 [0150.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\no\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0150.897] GetProcessHeap () returned 0xfd0000 [0150.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.897] GetProcessHeap () returned 0xfd0000 [0150.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pl\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.898] GetProcessHeap () returned 0xfd0000 [0150.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.898] GetProcessHeap () returned 0xfd0000 [0150.898] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0150.899] GetProcessHeap () returned 0xfd0000 [0150.899] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.899] GetProcessHeap () returned 0xfd0000 [0150.899] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt-BR\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0150.901] GetProcessHeap () returned 0xfd0000 [0150.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.901] GetProcessHeap () returned 0xfd0000 [0150.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ro\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0150.902] GetProcessHeap () returned 0xfd0000 [0150.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.902] GetProcessHeap () returned 0xfd0000 [0150.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ru\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0150.903] GetProcessHeap () returned 0xfd0000 [0150.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.903] GetProcessHeap () returned 0xfd0000 [0150.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sk\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0150.904] GetProcessHeap () returned 0xfd0000 [0150.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.904] GetProcessHeap () returned 0xfd0000 [0150.904] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sl\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0150.904] GetProcessHeap () returned 0xfd0000 [0150.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.904] GetProcessHeap () returned 0xfd0000 [0150.904] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-BA\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0150.905] GetProcessHeap () returned 0xfd0000 [0150.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.905] GetProcessHeap () returned 0xfd0000 [0150.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-CS\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0150.905] GetProcessHeap () returned 0xfd0000 [0150.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.905] GetProcessHeap () returned 0xfd0000 [0150.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Latn-CS\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0150.906] GetProcessHeap () returned 0xfd0000 [0150.906] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.906] GetProcessHeap () returned 0xfd0000 [0150.906] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sv\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0150.907] GetProcessHeap () returned 0xfd0000 [0150.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.907] GetProcessHeap () returned 0xfd0000 [0150.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\th\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0150.908] GetProcessHeap () returned 0xfd0000 [0150.908] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.908] GetProcessHeap () returned 0xfd0000 [0150.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\tr\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0150.908] GetProcessHeap () returned 0xfd0000 [0150.908] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.908] GetProcessHeap () returned 0xfd0000 [0150.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\uk\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0150.909] GetProcessHeap () returned 0xfd0000 [0150.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.909] GetProcessHeap () returned 0xfd0000 [0150.909] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\vi\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0150.910] GetProcessHeap () returned 0xfd0000 [0150.910] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.910] GetProcessHeap () returned 0xfd0000 [0150.910] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-CN\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0150.911] GetProcessHeap () returned 0xfd0000 [0150.911] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0150.912] GetProcessHeap () returned 0xfd0000 [0150.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0150.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-TW\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0151.197] GetProcessHeap () returned 0xfd0000 [0151.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0151.197] GetProcessHeap () returned 0xfd0000 [0151.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.203] GetProcessHeap () returned 0xfd0000 [0151.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0151.206] GetProcessHeap () returned 0xfd0000 [0151.206] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.207] GetProcessHeap () returned 0xfd0000 [0151.207] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0151.212] GetProcessHeap () returned 0xfd0000 [0151.212] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.212] GetProcessHeap () returned 0xfd0000 [0151.212] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0151.217] GetProcessHeap () returned 0xfd0000 [0151.217] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.217] GetProcessHeap () returned 0xfd0000 [0151.217] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0151.220] GetProcessHeap () returned 0xfd0000 [0151.220] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0151.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0151.222] GetProcessHeap () returned 0xfd0000 [0151.222] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0151.222] GetProcessHeap () returned 0xfd0000 [0151.222] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0151.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1036\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0151.223] GetProcessHeap () returned 0xfd0000 [0151.223] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0151.223] GetProcessHeap () returned 0xfd0000 [0151.223] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0151.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\3082\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0151.224] GetProcessHeap () returned 0xfd0000 [0151.224] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0151.224] GetProcessHeap () returned 0xfd0000 [0151.224] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.224] GetProcessHeap () returned 0xfd0000 [0151.224] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0151.228] GetProcessHeap () returned 0xfd0000 [0151.228] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.229] GetProcessHeap () returned 0xfd0000 [0151.229] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc3bb225, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x241382dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x241382dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0151.239] GetProcessHeap () returned 0xfd0000 [0151.239] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.239] GetProcessHeap () returned 0xfd0000 [0151.239] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\QUERIES\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0151.239] GetProcessHeap () returned 0xfd0000 [0151.239] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.240] GetProcessHeap () returned 0xfd0000 [0151.240] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0151.241] GetProcessHeap () returned 0xfd0000 [0151.241] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.242] GetProcessHeap () returned 0xfd0000 [0151.242] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\STARTUP\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0151.243] GetProcessHeap () returned 0xfd0000 [0151.243] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.473] GetProcessHeap () returned 0xfd0000 [0151.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0xa326fd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xa326fd, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0151.474] GetProcessHeap () returned 0xfd0000 [0151.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0151.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0151.768] GetProcessHeap () returned 0xfd0000 [0151.768] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0151.768] GetProcessHeap () returned 0xfd0000 [0151.768] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.768] GetProcessHeap () returned 0xfd0000 [0151.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\XLSTART\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1fc, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0151.769] GetProcessHeap () returned 0xfd0000 [0151.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.769] GetProcessHeap () returned 0xfd0000 [0151.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0151.770] GetProcessHeap () returned 0xfd0000 [0151.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0151.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\rsod\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0151.778] GetProcessHeap () returned 0xfd0000 [0151.778] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0151.778] GetProcessHeap () returned 0xfd0000 [0151.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0151.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0151.778] GetProcessHeap () returned 0xfd0000 [0151.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0151.786] GetProcessHeap () returned 0xfd0000 [0151.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0151.786] GetProcessHeap () returned 0xfd0000 [0151.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0151.787] GetProcessHeap () returned 0xfd0000 [0151.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0151.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0151.788] GetProcessHeap () returned 0xfd0000 [0151.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0151.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb571036, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0151.791] GetProcessHeap () returned 0xfd0000 [0151.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0151.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb5bd4f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb5bd4f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0151.793] GetProcessHeap () returned 0xfd0000 [0151.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0151.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb62fbf7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0151.795] GetProcessHeap () returned 0xfd0000 [0151.795] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0151.796] GetProcessHeap () returned 0xfd0000 [0151.796] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0151.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0151.798] GetProcessHeap () returned 0xfd0000 [0151.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0151.798] GetProcessHeap () returned 0xfd0000 [0151.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0151.798] GetProcessHeap () returned 0xfd0000 [0151.798] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0151.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\GettingStarted16\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e332373, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e332373, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e332373, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0152.070] GetProcessHeap () returned 0xfd0000 [0152.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.071] GetProcessHeap () returned 0xfd0000 [0152.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0152.089] GetProcessHeap () returned 0xfd0000 [0152.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0152.089] GetProcessHeap () returned 0xfd0000 [0152.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Notebook Templates\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.090] GetProcessHeap () returned 0xfd0000 [0152.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.090] GetProcessHeap () returned 0xfd0000 [0152.091] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0152.091] GetProcessHeap () returned 0xfd0000 [0152.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.091] GetProcessHeap () returned 0xfd0000 [0152.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.091] GetProcessHeap () returned 0xfd0000 [0152.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.092] GetProcessHeap () returned 0xfd0000 [0152.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0152.092] GetProcessHeap () returned 0xfd0000 [0152.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0152.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0152.094] GetProcessHeap () returned 0xfd0000 [0152.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0152.094] GetProcessHeap () returned 0xfd0000 [0152.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0152.095] GetProcessHeap () returned 0xfd0000 [0152.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0152.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0152.095] GetProcessHeap () returned 0xfd0000 [0152.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0152.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.097] GetProcessHeap () returned 0xfd0000 [0152.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0152.099] GetProcessHeap () returned 0xfd0000 [0152.099] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0152.101] GetProcessHeap () returned 0xfd0000 [0152.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\Heartbeat\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0152.102] GetProcessHeap () returned 0xfd0000 [0152.102] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.102] GetProcessHeap () returned 0xfd0000 [0152.102] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.102] GetProcessHeap () returned 0xfd0000 [0152.102] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\VISIO\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0152.103] GetProcessHeap () returned 0xfd0000 [0152.103] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.103] GetProcessHeap () returned 0xfd0000 [0152.103] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.104] GetProcessHeap () returned 0xfd0000 [0152.104] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.108] GetProcessHeap () returned 0xfd0000 [0152.108] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.108] GetProcessHeap () returned 0xfd0000 [0152.108] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0152.109] GetProcessHeap () returned 0xfd0000 [0152.109] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0152.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0152.340] GetProcessHeap () returned 0xfd0000 [0152.340] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0152.345] GetProcessHeap () returned 0xfd0000 [0152.345] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.345] GetProcessHeap () returned 0xfd0000 [0152.345] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0152.346] GetProcessHeap () returned 0xfd0000 [0152.346] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0152.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.347] GetProcessHeap () returned 0xfd0000 [0152.347] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.355] GetProcessHeap () returned 0xfd0000 [0152.355] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.355] GetProcessHeap () returned 0xfd0000 [0152.355] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0152.355] GetProcessHeap () returned 0xfd0000 [0152.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0152.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0152.356] GetProcessHeap () returned 0xfd0000 [0152.356] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb975fdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb975fdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb975fdf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0152.357] GetProcessHeap () returned 0xfd0000 [0152.357] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0152.357] GetProcessHeap () returned 0xfd0000 [0152.357] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0152.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0152.358] GetProcessHeap () returned 0xfd0000 [0152.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.360] GetProcessHeap () returned 0xfd0000 [0152.360] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf47e9c8f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.361] GetProcessHeap () returned 0xfd0000 [0152.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.361] GetProcessHeap () returned 0xfd0000 [0152.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.361] GetProcessHeap () returned 0xfd0000 [0152.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.364] GetProcessHeap () returned 0xfd0000 [0152.364] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4620012, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.365] GetProcessHeap () returned 0xfd0000 [0152.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.365] GetProcessHeap () returned 0xfd0000 [0152.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.365] GetProcessHeap () returned 0xfd0000 [0152.365] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EURO\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.366] GetProcessHeap () returned 0xfd0000 [0152.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.366] GetProcessHeap () returned 0xfd0000 [0152.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.367] GetProcessHeap () returned 0xfd0000 [0152.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.367] GetProcessHeap () returned 0xfd0000 [0152.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0152.370] GetProcessHeap () returned 0xfd0000 [0152.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.370] GetProcessHeap () returned 0xfd0000 [0152.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.373] GetProcessHeap () returned 0xfd0000 [0152.373] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.373] GetProcessHeap () returned 0xfd0000 [0152.373] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.374] GetProcessHeap () returned 0xfd0000 [0152.374] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.374] GetProcessHeap () returned 0xfd0000 [0152.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.376] GetProcessHeap () returned 0xfd0000 [0152.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc541ed37, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.380] GetProcessHeap () returned 0xfd0000 [0152.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.380] GetProcessHeap () returned 0xfd0000 [0152.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc461cf97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc461cf97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc461cf97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0152.381] GetProcessHeap () returned 0xfd0000 [0152.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.381] GetProcessHeap () returned 0xfd0000 [0152.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.589] GetProcessHeap () returned 0xfd0000 [0152.589] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0152.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.705] GetProcessHeap () returned 0xfd0000 [0152.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0152.705] GetProcessHeap () returned 0xfd0000 [0152.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0152.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.712] GetProcessHeap () returned 0xfd0000 [0152.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0152.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0152.713] GetProcessHeap () returned 0xfd0000 [0152.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0152.713] GetProcessHeap () returned 0xfd0000 [0152.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0152.713] GetProcessHeap () returned 0xfd0000 [0152.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.714] GetProcessHeap () returned 0xfd0000 [0152.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0152.715] GetProcessHeap () returned 0xfd0000 [0152.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.716] GetProcessHeap () returned 0xfd0000 [0152.716] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef915def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef915def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0152.717] GetProcessHeap () returned 0xfd0000 [0152.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0152.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.718] GetProcessHeap () returned 0xfd0000 [0152.718] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0152.718] GetProcessHeap () returned 0xfd0000 [0152.718] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.718] GetProcessHeap () returned 0xfd0000 [0152.718] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.718] GetProcessHeap () returned 0xfd0000 [0152.718] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.719] GetProcessHeap () returned 0xfd0000 [0152.719] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.719] GetProcessHeap () returned 0xfd0000 [0152.719] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0152.722] GetProcessHeap () returned 0xfd0000 [0152.722] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf07b04e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf07b04e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.722] GetProcessHeap () returned 0xfd0000 [0152.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.723] GetProcessHeap () returned 0xfd0000 [0152.723] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0152.723] GetProcessHeap () returned 0xfd0000 [0152.723] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0152.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.724] GetProcessHeap () returned 0xfd0000 [0152.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0152.724] GetProcessHeap () returned 0xfd0000 [0152.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.724] GetProcessHeap () returned 0xfd0000 [0152.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.725] GetProcessHeap () returned 0xfd0000 [0152.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.726] GetProcessHeap () returned 0xfd0000 [0152.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.726] GetProcessHeap () returned 0xfd0000 [0152.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0152.727] GetProcessHeap () returned 0xfd0000 [0152.727] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0152.727] GetProcessHeap () returned 0xfd0000 [0152.727] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0152.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0152.816] GetProcessHeap () returned 0xfd0000 [0152.816] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0152.817] GetProcessHeap () returned 0xfd0000 [0152.817] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.817] GetProcessHeap () returned 0xfd0000 [0152.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0152.818] GetProcessHeap () returned 0xfd0000 [0152.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.818] GetProcessHeap () returned 0xfd0000 [0152.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.818] GetProcessHeap () returned 0xfd0000 [0152.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.818] GetProcessHeap () returned 0xfd0000 [0152.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.819] GetProcessHeap () returned 0xfd0000 [0152.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.819] GetProcessHeap () returned 0xfd0000 [0152.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.820] GetProcessHeap () returned 0xfd0000 [0152.820] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.820] GetProcessHeap () returned 0xfd0000 [0152.820] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.821] GetProcessHeap () returned 0xfd0000 [0152.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.821] GetProcessHeap () returned 0xfd0000 [0152.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.822] GetProcessHeap () returned 0xfd0000 [0152.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.822] GetProcessHeap () returned 0xfd0000 [0152.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.823] GetProcessHeap () returned 0xfd0000 [0152.823] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.823] GetProcessHeap () returned 0xfd0000 [0152.823] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.824] GetProcessHeap () returned 0xfd0000 [0152.824] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.824] GetProcessHeap () returned 0xfd0000 [0152.824] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0152.825] GetProcessHeap () returned 0xfd0000 [0152.825] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.825] GetProcessHeap () returned 0xfd0000 [0152.825] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.826] GetProcessHeap () returned 0xfd0000 [0152.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.826] GetProcessHeap () returned 0xfd0000 [0152.826] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0152.827] GetProcessHeap () returned 0xfd0000 [0152.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.827] GetProcessHeap () returned 0xfd0000 [0152.827] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.827] GetProcessHeap () returned 0xfd0000 [0152.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.828] GetProcessHeap () returned 0xfd0000 [0152.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.829] GetProcessHeap () returned 0xfd0000 [0152.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.830] GetProcessHeap () returned 0xfd0000 [0152.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.830] GetProcessHeap () returned 0xfd0000 [0152.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.830] GetProcessHeap () returned 0xfd0000 [0152.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.831] GetProcessHeap () returned 0xfd0000 [0152.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.831] GetProcessHeap () returned 0xfd0000 [0152.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.832] GetProcessHeap () returned 0xfd0000 [0152.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.832] GetProcessHeap () returned 0xfd0000 [0152.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.833] GetProcessHeap () returned 0xfd0000 [0152.833] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.833] GetProcessHeap () returned 0xfd0000 [0152.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.833] GetProcessHeap () returned 0xfd0000 [0152.833] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.834] GetProcessHeap () returned 0xfd0000 [0152.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.834] GetProcessHeap () returned 0xfd0000 [0152.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.834] GetProcessHeap () returned 0xfd0000 [0152.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0152.835] GetProcessHeap () returned 0xfd0000 [0152.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.835] GetProcessHeap () returned 0xfd0000 [0152.835] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.836] GetProcessHeap () returned 0xfd0000 [0152.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.836] GetProcessHeap () returned 0xfd0000 [0152.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.836] GetProcessHeap () returned 0xfd0000 [0152.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.837] GetProcessHeap () returned 0xfd0000 [0152.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0152.838] GetProcessHeap () returned 0xfd0000 [0152.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.838] GetProcessHeap () returned 0xfd0000 [0152.838] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.838] GetProcessHeap () returned 0xfd0000 [0152.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.838] GetProcessHeap () returned 0xfd0000 [0152.838] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0152.839] GetProcessHeap () returned 0xfd0000 [0152.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.839] GetProcessHeap () returned 0xfd0000 [0152.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.840] GetProcessHeap () returned 0xfd0000 [0152.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.840] GetProcessHeap () returned 0xfd0000 [0152.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0152.840] GetProcessHeap () returned 0xfd0000 [0152.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.841] GetProcessHeap () returned 0xfd0000 [0152.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0152.841] GetProcessHeap () returned 0xfd0000 [0152.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.841] GetProcessHeap () returned 0xfd0000 [0152.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.842] GetProcessHeap () returned 0xfd0000 [0152.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.842] GetProcessHeap () returned 0xfd0000 [0152.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0152.843] GetProcessHeap () returned 0xfd0000 [0152.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.843] GetProcessHeap () returned 0xfd0000 [0152.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0152.844] GetProcessHeap () returned 0xfd0000 [0152.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.844] GetProcessHeap () returned 0xfd0000 [0152.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0152.845] GetProcessHeap () returned 0xfd0000 [0152.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.845] GetProcessHeap () returned 0xfd0000 [0152.845] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.846] GetProcessHeap () returned 0xfd0000 [0152.846] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.846] GetProcessHeap () returned 0xfd0000 [0152.846] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.847] GetProcessHeap () returned 0xfd0000 [0152.847] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.847] GetProcessHeap () returned 0xfd0000 [0152.847] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0152.848] GetProcessHeap () returned 0xfd0000 [0152.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.848] GetProcessHeap () returned 0xfd0000 [0152.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0152.849] GetProcessHeap () returned 0xfd0000 [0152.849] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.849] GetProcessHeap () returned 0xfd0000 [0152.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.850] GetProcessHeap () returned 0xfd0000 [0152.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.850] GetProcessHeap () returned 0xfd0000 [0152.850] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0152.850] GetProcessHeap () returned 0xfd0000 [0152.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.851] GetProcessHeap () returned 0xfd0000 [0152.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.851] GetProcessHeap () returned 0xfd0000 [0152.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.852] GetProcessHeap () returned 0xfd0000 [0152.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.853] GetProcessHeap () returned 0xfd0000 [0152.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.853] GetProcessHeap () returned 0xfd0000 [0152.853] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.853] GetProcessHeap () returned 0xfd0000 [0152.854] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.854] GetProcessHeap () returned 0xfd0000 [0152.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.854] GetProcessHeap () returned 0xfd0000 [0152.854] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.854] GetProcessHeap () returned 0xfd0000 [0152.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0152.855] GetProcessHeap () returned 0xfd0000 [0152.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0152.855] GetProcessHeap () returned 0xfd0000 [0152.855] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0152.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0153.186] GetProcessHeap () returned 0xfd0000 [0153.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0153.186] GetProcessHeap () returned 0xfd0000 [0153.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0153.186] GetProcessHeap () returned 0xfd0000 [0153.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0153.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0153.207] GetProcessHeap () returned 0xfd0000 [0153.207] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0153.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc85db99, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc85db99, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0153.216] GetProcessHeap () returned 0xfd0000 [0153.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0153.216] GetProcessHeap () returned 0xfd0000 [0153.216] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0153.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0153.232] GetProcessHeap () returned 0xfd0000 [0153.232] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0153.232] GetProcessHeap () returned 0xfd0000 [0153.232] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0153.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0153.234] GetProcessHeap () returned 0xfd0000 [0153.234] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0153.235] GetProcessHeap () returned 0xfd0000 [0153.235] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0153.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0153.236] GetProcessHeap () returned 0xfd0000 [0153.236] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0153.236] GetProcessHeap () returned 0xfd0000 [0153.236] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0153.236] GetProcessHeap () returned 0xfd0000 [0153.236] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0153.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0154.291] GetProcessHeap () returned 0xfd0000 [0154.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.291] GetProcessHeap () returned 0xfd0000 [0154.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecf3682d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.293] GetProcessHeap () returned 0xfd0000 [0154.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.293] GetProcessHeap () returned 0xfd0000 [0154.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.293] GetProcessHeap () returned 0xfd0000 [0154.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.294] GetProcessHeap () returned 0xfd0000 [0154.294] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0154.294] GetProcessHeap () returned 0xfd0000 [0154.294] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.297] GetProcessHeap () returned 0xfd0000 [0154.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.297] GetProcessHeap () returned 0xfd0000 [0154.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.297] GetProcessHeap () returned 0xfd0000 [0154.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.298] GetProcessHeap () returned 0xfd0000 [0154.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0154.298] GetProcessHeap () returned 0xfd0000 [0154.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.298] GetProcessHeap () returned 0xfd0000 [0154.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0154.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0154.299] GetProcessHeap () returned 0xfd0000 [0154.299] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0154.299] GetProcessHeap () returned 0xfd0000 [0154.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.301] GetProcessHeap () returned 0xfd0000 [0154.301] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.302] GetProcessHeap () returned 0xfd0000 [0154.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.303] GetProcessHeap () returned 0xfd0000 [0154.303] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.303] GetProcessHeap () returned 0xfd0000 [0154.303] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0154.304] GetProcessHeap () returned 0xfd0000 [0154.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\Data Sources\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.304] GetProcessHeap () returned 0xfd0000 [0154.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.304] GetProcessHeap () returned 0xfd0000 [0154.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.304] GetProcessHeap () returned 0xfd0000 [0154.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0154.305] GetProcessHeap () returned 0xfd0000 [0154.305] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0154.305] GetProcessHeap () returned 0xfd0000 [0154.305] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.306] GetProcessHeap () returned 0xfd0000 [0154.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.306] GetProcessHeap () returned 0xfd0000 [0154.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.306] GetProcessHeap () returned 0xfd0000 [0154.306] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\ole db\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0154.307] GetProcessHeap () returned 0xfd0000 [0154.307] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.307] GetProcessHeap () returned 0xfd0000 [0154.307] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.308] GetProcessHeap () returned 0xfd0000 [0154.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0154.308] GetProcessHeap () returned 0xfd0000 [0154.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0154.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.308] GetProcessHeap () returned 0xfd0000 [0154.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0154.311] GetProcessHeap () returned 0xfd0000 [0154.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.314] GetProcessHeap () returned 0xfd0000 [0154.314] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.314] GetProcessHeap () returned 0xfd0000 [0154.314] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.316] GetProcessHeap () returned 0xfd0000 [0154.316] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1028\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12dd5ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0154.317] GetProcessHeap () returned 0xfd0000 [0154.317] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.317] GetProcessHeap () returned 0xfd0000 [0154.317] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1031\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0154.318] GetProcessHeap () returned 0xfd0000 [0154.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.318] GetProcessHeap () returned 0xfd0000 [0154.318] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.318] GetProcessHeap () returned 0xfd0000 [0154.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.318] GetProcessHeap () returned 0xfd0000 [0154.319] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1036\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.319] GetProcessHeap () returned 0xfd0000 [0154.319] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.319] GetProcessHeap () returned 0xfd0000 [0154.319] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1040\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.319] GetProcessHeap () returned 0xfd0000 [0154.319] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.319] GetProcessHeap () returned 0xfd0000 [0154.319] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1041\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0154.320] GetProcessHeap () returned 0xfd0000 [0154.320] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.320] GetProcessHeap () returned 0xfd0000 [0154.320] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1042\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.321] GetProcessHeap () returned 0xfd0000 [0154.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.321] GetProcessHeap () returned 0xfd0000 [0154.321] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1046\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0154.322] GetProcessHeap () returned 0xfd0000 [0154.322] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.322] GetProcessHeap () returned 0xfd0000 [0154.322] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1049\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0154.323] GetProcessHeap () returned 0xfd0000 [0154.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.323] GetProcessHeap () returned 0xfd0000 [0154.323] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\2052\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.323] GetProcessHeap () returned 0xfd0000 [0154.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.323] GetProcessHeap () returned 0xfd0000 [0154.323] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\3082\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.323] GetProcessHeap () returned 0xfd0000 [0154.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.323] GetProcessHeap () returned 0xfd0000 [0154.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.324] GetProcessHeap () returned 0xfd0000 [0154.324] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.565] GetProcessHeap () returned 0xfd0000 [0154.565] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4512fb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd4512fb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0154.565] GetProcessHeap () returned 0xfd0000 [0154.565] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.566] GetProcessHeap () returned 0xfd0000 [0154.566] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc436e5a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc436e5a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc436e5a6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.566] GetProcessHeap () returned 0xfd0000 [0154.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.566] GetProcessHeap () returned 0xfd0000 [0154.566] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.567] GetProcessHeap () returned 0xfd0000 [0154.567] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.567] GetProcessHeap () returned 0xfd0000 [0154.567] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.567] GetProcessHeap () returned 0xfd0000 [0154.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.567] GetProcessHeap () returned 0xfd0000 [0154.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.568] GetProcessHeap () returned 0xfd0000 [0154.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.568] GetProcessHeap () returned 0xfd0000 [0154.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.568] GetProcessHeap () returned 0xfd0000 [0154.568] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0154.569] GetProcessHeap () returned 0xfd0000 [0154.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.569] GetProcessHeap () returned 0xfd0000 [0154.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.569] GetProcessHeap () returned 0xfd0000 [0154.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0154.570] GetProcessHeap () returned 0xfd0000 [0154.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.574] GetProcessHeap () returned 0xfd0000 [0154.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.574] GetProcessHeap () returned 0xfd0000 [0154.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.574] GetProcessHeap () returned 0xfd0000 [0154.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.574] GetProcessHeap () returned 0xfd0000 [0154.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.576] GetProcessHeap () returned 0xfd0000 [0154.576] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.577] GetProcessHeap () returned 0xfd0000 [0154.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.577] GetProcessHeap () returned 0xfd0000 [0154.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.577] GetProcessHeap () returned 0xfd0000 [0154.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.577] GetProcessHeap () returned 0xfd0000 [0154.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.578] GetProcessHeap () returned 0xfd0000 [0154.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.578] GetProcessHeap () returned 0xfd0000 [0154.578] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0154.579] GetProcessHeap () returned 0xfd0000 [0154.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\ole db\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.580] GetProcessHeap () returned 0xfd0000 [0154.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.580] GetProcessHeap () returned 0xfd0000 [0154.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.580] GetProcessHeap () returned 0xfd0000 [0154.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0154.581] GetProcessHeap () returned 0xfd0000 [0154.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0154.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.584] GetProcessHeap () returned 0xfd0000 [0154.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.585] GetProcessHeap () returned 0xfd0000 [0154.585] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0154.586] GetProcessHeap () returned 0xfd0000 [0154.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0154.588] GetProcessHeap () returned 0xfd0000 [0154.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2aebe60a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2aebe60a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0154.591] GetProcessHeap () returned 0xfd0000 [0154.591] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.591] GetProcessHeap () returned 0xfd0000 [0154.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.591] GetProcessHeap () returned 0xfd0000 [0154.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0154.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0154.592] GetProcessHeap () returned 0xfd0000 [0154.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0154.592] GetProcessHeap () returned 0xfd0000 [0154.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.592] GetProcessHeap () returned 0xfd0000 [0154.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.593] GetProcessHeap () returned 0xfd0000 [0154.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.593] GetProcessHeap () returned 0xfd0000 [0154.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.593] GetProcessHeap () returned 0xfd0000 [0154.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.594] GetProcessHeap () returned 0xfd0000 [0154.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.594] GetProcessHeap () returned 0xfd0000 [0154.594] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0154.595] GetProcessHeap () returned 0xfd0000 [0154.595] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.596] GetProcessHeap () returned 0xfd0000 [0154.596] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0154.596] GetProcessHeap () returned 0xfd0000 [0154.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.596] GetProcessHeap () returned 0xfd0000 [0154.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.596] GetProcessHeap () returned 0xfd0000 [0154.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.597] GetProcessHeap () returned 0xfd0000 [0154.597] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.598] GetProcessHeap () returned 0xfd0000 [0154.598] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.599] GetProcessHeap () returned 0xfd0000 [0154.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.599] GetProcessHeap () returned 0xfd0000 [0154.600] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.600] GetProcessHeap () returned 0xfd0000 [0154.600] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.600] GetProcessHeap () returned 0xfd0000 [0154.600] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.600] GetProcessHeap () returned 0xfd0000 [0154.600] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0154.601] GetProcessHeap () returned 0xfd0000 [0154.601] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0154.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0154.776] GetProcessHeap () returned 0xfd0000 [0154.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.778] GetProcessHeap () returned 0xfd0000 [0154.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.778] GetProcessHeap () returned 0xfd0000 [0154.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0154.780] GetProcessHeap () returned 0xfd0000 [0154.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.785] GetProcessHeap () returned 0xfd0000 [0154.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.785] GetProcessHeap () returned 0xfd0000 [0154.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0154.786] GetProcessHeap () returned 0xfd0000 [0154.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0154.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.787] GetProcessHeap () returned 0xfd0000 [0154.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0154.787] GetProcessHeap () returned 0xfd0000 [0154.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.787] GetProcessHeap () returned 0xfd0000 [0154.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.788] GetProcessHeap () returned 0xfd0000 [0154.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.788] GetProcessHeap () returned 0xfd0000 [0154.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.788] GetProcessHeap () returned 0xfd0000 [0154.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.788] GetProcessHeap () returned 0xfd0000 [0154.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0154.792] GetProcessHeap () returned 0xfd0000 [0154.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd43957d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca99edb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e1424f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.794] GetProcessHeap () returned 0xfd0000 [0154.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.795] GetProcessHeap () returned 0xfd0000 [0154.795] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0154.800] GetProcessHeap () returned 0xfd0000 [0154.800] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\1033\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.800] GetProcessHeap () returned 0xfd0000 [0154.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.801] GetProcessHeap () returned 0xfd0000 [0154.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0154.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0154.804] GetProcessHeap () returned 0xfd0000 [0154.804] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0154.805] GetProcessHeap () returned 0xfd0000 [0154.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.805] GetProcessHeap () returned 0xfd0000 [0154.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.810] GetProcessHeap () returned 0xfd0000 [0154.810] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.810] GetProcessHeap () returned 0xfd0000 [0154.810] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.811] GetProcessHeap () returned 0xfd0000 [0154.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.812] GetProcessHeap () returned 0xfd0000 [0154.812] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0154.812] GetProcessHeap () returned 0xfd0000 [0154.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.812] GetProcessHeap () returned 0xfd0000 [0154.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.812] GetProcessHeap () returned 0xfd0000 [0154.812] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.813] GetProcessHeap () returned 0xfd0000 [0154.813] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0154.813] GetProcessHeap () returned 0xfd0000 [0154.814] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.815] GetProcessHeap () returned 0xfd0000 [0154.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0154.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.815] GetProcessHeap () returned 0xfd0000 [0154.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0154.815] GetProcessHeap () returned 0xfd0000 [0154.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.815] GetProcessHeap () returned 0xfd0000 [0154.815] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.816] GetProcessHeap () returned 0xfd0000 [0154.816] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0154.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0154.817] GetProcessHeap () returned 0xfd0000 [0154.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0154.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0154.818] GetProcessHeap () returned 0xfd0000 [0154.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0154.818] GetProcessHeap () returned 0xfd0000 [0154.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0154.818] GetProcessHeap () returned 0xfd0000 [0154.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0154.819] GetProcessHeap () returned 0xfd0000 [0154.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0154.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.007] GetProcessHeap () returned 0xfd0000 [0155.007] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.007] GetProcessHeap () returned 0xfd0000 [0155.007] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0155.009] GetProcessHeap () returned 0xfd0000 [0155.009] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.009] GetProcessHeap () returned 0xfd0000 [0155.009] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0155.010] GetProcessHeap () returned 0xfd0000 [0155.010] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0155.011] GetProcessHeap () returned 0xfd0000 [0155.011] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0155.012] GetProcessHeap () returned 0xfd0000 [0155.012] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0155.013] GetProcessHeap () returned 0xfd0000 [0155.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0155.014] GetProcessHeap () returned 0xfd0000 [0155.014] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.014] GetProcessHeap () returned 0xfd0000 [0155.014] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.014] GetProcessHeap () returned 0xfd0000 [0155.014] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.014] GetProcessHeap () returned 0xfd0000 [0155.014] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0155.016] GetProcessHeap () returned 0xfd0000 [0155.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0155.017] GetProcessHeap () returned 0xfd0000 [0155.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0155.018] GetProcessHeap () returned 0xfd0000 [0155.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.018] GetProcessHeap () returned 0xfd0000 [0155.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.018] GetProcessHeap () returned 0xfd0000 [0155.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0155.019] GetProcessHeap () returned 0xfd0000 [0155.019] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0155.019] GetProcessHeap () returned 0xfd0000 [0155.019] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.019] GetProcessHeap () returned 0xfd0000 [0155.019] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.020] GetProcessHeap () returned 0xfd0000 [0155.020] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0155.020] GetProcessHeap () returned 0xfd0000 [0155.021] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0155.021] GetProcessHeap () returned 0xfd0000 [0155.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.021] GetProcessHeap () returned 0xfd0000 [0155.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.021] GetProcessHeap () returned 0xfd0000 [0155.021] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0155.022] GetProcessHeap () returned 0xfd0000 [0155.022] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0155.022] GetProcessHeap () returned 0xfd0000 [0155.022] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.022] GetProcessHeap () returned 0xfd0000 [0155.022] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.022] GetProcessHeap () returned 0xfd0000 [0155.022] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0155.023] GetProcessHeap () returned 0xfd0000 [0155.023] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.024] GetProcessHeap () returned 0xfd0000 [0155.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.024] GetProcessHeap () returned 0xfd0000 [0155.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.024] GetProcessHeap () returned 0xfd0000 [0155.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.024] GetProcessHeap () returned 0xfd0000 [0155.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0155.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0155.025] GetProcessHeap () returned 0xfd0000 [0155.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0155.025] GetProcessHeap () returned 0xfd0000 [0155.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.025] GetProcessHeap () returned 0xfd0000 [0155.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.026] GetProcessHeap () returned 0xfd0000 [0155.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.026] GetProcessHeap () returned 0xfd0000 [0155.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0155.026] GetProcessHeap () returned 0xfd0000 [0155.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.026] GetProcessHeap () returned 0xfd0000 [0155.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0155.027] GetProcessHeap () returned 0xfd0000 [0155.027] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc434832e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0155.027] GetProcessHeap () returned 0xfd0000 [0155.028] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.028] GetProcessHeap () returned 0xfd0000 [0155.028] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0155.028] GetProcessHeap () returned 0xfd0000 [0155.028] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.028] GetProcessHeap () returned 0xfd0000 [0155.028] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0155.029] GetProcessHeap () returned 0xfd0000 [0155.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.029] GetProcessHeap () returned 0xfd0000 [0155.029] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.030] GetProcessHeap () returned 0xfd0000 [0155.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.030] GetProcessHeap () returned 0xfd0000 [0155.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.030] GetProcessHeap () returned 0xfd0000 [0155.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.030] GetProcessHeap () returned 0xfd0000 [0155.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.031] GetProcessHeap () returned 0xfd0000 [0155.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0155.031] GetProcessHeap () returned 0xfd0000 [0155.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0155.031] GetProcessHeap () returned 0xfd0000 [0155.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.032] GetProcessHeap () returned 0xfd0000 [0155.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.032] GetProcessHeap () returned 0xfd0000 [0155.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0155.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0155.032] GetProcessHeap () returned 0xfd0000 [0155.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0155.032] GetProcessHeap () returned 0xfd0000 [0155.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.032] GetProcessHeap () returned 0xfd0000 [0155.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.033] GetProcessHeap () returned 0xfd0000 [0155.033] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.034] GetProcessHeap () returned 0xfd0000 [0155.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.034] GetProcessHeap () returned 0xfd0000 [0155.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.034] GetProcessHeap () returned 0xfd0000 [0155.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.034] GetProcessHeap () returned 0xfd0000 [0155.035] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0155.035] GetProcessHeap () returned 0xfd0000 [0155.035] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.035] GetProcessHeap () returned 0xfd0000 [0155.035] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6a2f1b6, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a2f1b6, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0155.036] GetProcessHeap () returned 0xfd0000 [0155.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0155.036] GetProcessHeap () returned 0xfd0000 [0155.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.036] GetProcessHeap () returned 0xfd0000 [0155.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.036] GetProcessHeap () returned 0xfd0000 [0155.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0155.296] GetProcessHeap () returned 0xfd0000 [0155.296] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb0da723, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xece35df2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xece35df2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0155.298] GetProcessHeap () returned 0xfd0000 [0155.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb40aac, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb40aac, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0155.299] GetProcessHeap () returned 0xfd0000 [0155.299] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.299] GetProcessHeap () returned 0xfd0000 [0155.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\features\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0155.302] GetProcessHeap () returned 0xfd0000 [0155.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.302] GetProcessHeap () returned 0xfd0000 [0155.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0155.302] GetProcessHeap () returned 0xfd0000 [0155.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.302] GetProcessHeap () returned 0xfd0000 [0155.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.304] GetProcessHeap () returned 0xfd0000 [0155.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec080216, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0155.305] GetProcessHeap () returned 0xfd0000 [0155.305] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0155.306] GetProcessHeap () returned 0xfd0000 [0155.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.306] GetProcessHeap () returned 0xfd0000 [0155.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.307] GetProcessHeap () returned 0xfd0000 [0155.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0155.307] GetProcessHeap () returned 0xfd0000 [0155.307] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.307] GetProcessHeap () returned 0xfd0000 [0155.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\fonts\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0f2926, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecbad561, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecbad561, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.308] GetProcessHeap () returned 0xfd0000 [0155.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.308] GetProcessHeap () returned 0xfd0000 [0155.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecaee98b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecaee98b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0155.309] GetProcessHeap () returned 0xfd0000 [0155.309] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0155.310] GetProcessHeap () returned 0xfd0000 [0155.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.310] GetProcessHeap () returned 0xfd0000 [0155.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.310] GetProcessHeap () returned 0xfd0000 [0155.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9d2ec34, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef639ad2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef639ad2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0155.315] GetProcessHeap () returned 0xfd0000 [0155.315] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.315] GetProcessHeap () returned 0xfd0000 [0155.315] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.315] GetProcessHeap () returned 0xfd0000 [0155.315] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe6a7b68f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a7b68f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0155.318] GetProcessHeap () returned 0xfd0000 [0155.318] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0155.319] GetProcessHeap () returned 0xfd0000 [0155.319] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0155.319] GetProcessHeap () returned 0xfd0000 [0155.320] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0155.321] GetProcessHeap () returned 0xfd0000 [0155.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.321] GetProcessHeap () returned 0xfd0000 [0155.321] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0155.321] GetProcessHeap () returned 0xfd0000 [0155.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.321] GetProcessHeap () returned 0xfd0000 [0155.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.321] GetProcessHeap () returned 0xfd0000 [0155.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.322] GetProcessHeap () returned 0xfd0000 [0155.322] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.322] GetProcessHeap () returned 0xfd0000 [0155.322] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe6bd2adf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bd2adf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0155.323] GetProcessHeap () returned 0xfd0000 [0155.323] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0155.324] GetProcessHeap () returned 0xfd0000 [0155.324] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0155.325] GetProcessHeap () returned 0xfd0000 [0155.325] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.326] GetProcessHeap () returned 0xfd0000 [0155.326] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0155.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0155.331] GetProcessHeap () returned 0xfd0000 [0155.331] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0155.331] GetProcessHeap () returned 0xfd0000 [0155.331] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.332] GetProcessHeap () returned 0xfd0000 [0155.332] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0155.611] GetProcessHeap () returned 0xfd0000 [0155.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0155.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0155.612] GetProcessHeap () returned 0xfd0000 [0155.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0155.612] GetProcessHeap () returned 0xfd0000 [0155.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0155.613] GetProcessHeap () returned 0xfd0000 [0155.613] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0155.613] GetProcessHeap () returned 0xfd0000 [0155.613] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.614] GetProcessHeap () returned 0xfd0000 [0155.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.614] GetProcessHeap () returned 0xfd0000 [0155.614] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa73e1bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8390c831, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0155.617] GetProcessHeap () returned 0xfd0000 [0155.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\Logs\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0155.623] GetProcessHeap () returned 0xfd0000 [0155.623] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0155.623] GetProcessHeap () returned 0xfd0000 [0155.623] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.623] GetProcessHeap () returned 0xfd0000 [0155.623] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0155.629] GetProcessHeap () returned 0xfd0000 [0155.629] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0155.629] GetProcessHeap () returned 0xfd0000 [0155.629] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0155.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xe69bc7dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69bc7dd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0155.633] GetProcessHeap () returned 0xfd0000 [0155.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0155.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0155.634] GetProcessHeap () returned 0xfd0000 [0155.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0155.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0155.635] GetProcessHeap () returned 0xfd0000 [0155.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0155.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0155.637] GetProcessHeap () returned 0xfd0000 [0155.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0155.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0155.641] GetProcessHeap () returned 0xfd0000 [0155.641] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0155.644] GetProcessHeap () returned 0xfd0000 [0155.644] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0155.644] GetProcessHeap () returned 0xfd0000 [0155.644] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0155.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0156.146] GetProcessHeap () returned 0xfd0000 [0156.146] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.146] GetProcessHeap () returned 0xfd0000 [0156.146] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.148] GetProcessHeap () returned 0xfd0000 [0156.148] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.149] GetProcessHeap () returned 0xfd0000 [0156.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0156.151] GetProcessHeap () returned 0xfd0000 [0156.151] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.151] GetProcessHeap () returned 0xfd0000 [0156.151] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0156.154] GetProcessHeap () returned 0xfd0000 [0156.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.154] GetProcessHeap () returned 0xfd0000 [0156.154] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0156.157] GetProcessHeap () returned 0xfd0000 [0156.157] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.157] GetProcessHeap () returned 0xfd0000 [0156.157] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.177] GetProcessHeap () returned 0xfd0000 [0156.177] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.177] GetProcessHeap () returned 0xfd0000 [0156.177] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.180] GetProcessHeap () returned 0xfd0000 [0156.180] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.180] GetProcessHeap () returned 0xfd0000 [0156.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.183] GetProcessHeap () returned 0xfd0000 [0156.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.183] GetProcessHeap () returned 0xfd0000 [0156.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.186] GetProcessHeap () returned 0xfd0000 [0156.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.186] GetProcessHeap () returned 0xfd0000 [0156.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.189] GetProcessHeap () returned 0xfd0000 [0156.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.189] GetProcessHeap () returned 0xfd0000 [0156.189] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0156.191] GetProcessHeap () returned 0xfd0000 [0156.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.191] GetProcessHeap () returned 0xfd0000 [0156.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0156.194] GetProcessHeap () returned 0xfd0000 [0156.194] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.194] GetProcessHeap () returned 0xfd0000 [0156.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0156.197] GetProcessHeap () returned 0xfd0000 [0156.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.197] GetProcessHeap () returned 0xfd0000 [0156.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0156.445] GetProcessHeap () returned 0xfd0000 [0156.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.445] GetProcessHeap () returned 0xfd0000 [0156.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0156.448] GetProcessHeap () returned 0xfd0000 [0156.448] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.448] GetProcessHeap () returned 0xfd0000 [0156.448] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0156.450] GetProcessHeap () returned 0xfd0000 [0156.450] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.450] GetProcessHeap () returned 0xfd0000 [0156.450] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0156.453] GetProcessHeap () returned 0xfd0000 [0156.453] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.453] GetProcessHeap () returned 0xfd0000 [0156.453] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.457] GetProcessHeap () returned 0xfd0000 [0156.457] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.457] GetProcessHeap () returned 0xfd0000 [0156.457] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0156.459] GetProcessHeap () returned 0xfd0000 [0156.459] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.459] GetProcessHeap () returned 0xfd0000 [0156.460] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.462] GetProcessHeap () returned 0xfd0000 [0156.462] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.462] GetProcessHeap () returned 0xfd0000 [0156.462] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.465] GetProcessHeap () returned 0xfd0000 [0156.465] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.465] GetProcessHeap () returned 0xfd0000 [0156.465] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0156.467] GetProcessHeap () returned 0xfd0000 [0156.467] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.467] GetProcessHeap () returned 0xfd0000 [0156.467] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0156.470] GetProcessHeap () returned 0xfd0000 [0156.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.470] GetProcessHeap () returned 0xfd0000 [0156.470] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0156.473] GetProcessHeap () returned 0xfd0000 [0156.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.473] GetProcessHeap () returned 0xfd0000 [0156.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0156.476] GetProcessHeap () returned 0xfd0000 [0156.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.476] GetProcessHeap () returned 0xfd0000 [0156.476] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.478] GetProcessHeap () returned 0xfd0000 [0156.478] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.478] GetProcessHeap () returned 0xfd0000 [0156.478] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0156.481] GetProcessHeap () returned 0xfd0000 [0156.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.481] GetProcessHeap () returned 0xfd0000 [0156.481] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.652] GetProcessHeap () returned 0xfd0000 [0156.652] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.652] GetProcessHeap () returned 0xfd0000 [0156.652] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.655] GetProcessHeap () returned 0xfd0000 [0156.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.655] GetProcessHeap () returned 0xfd0000 [0156.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.659] GetProcessHeap () returned 0xfd0000 [0156.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.659] GetProcessHeap () returned 0xfd0000 [0156.659] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.662] GetProcessHeap () returned 0xfd0000 [0156.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.662] GetProcessHeap () returned 0xfd0000 [0156.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.665] GetProcessHeap () returned 0xfd0000 [0156.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.665] GetProcessHeap () returned 0xfd0000 [0156.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0156.668] GetProcessHeap () returned 0xfd0000 [0156.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.668] GetProcessHeap () returned 0xfd0000 [0156.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0156.671] GetProcessHeap () returned 0xfd0000 [0156.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.671] GetProcessHeap () returned 0xfd0000 [0156.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.674] GetProcessHeap () returned 0xfd0000 [0156.674] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.674] GetProcessHeap () returned 0xfd0000 [0156.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.677] GetProcessHeap () returned 0xfd0000 [0156.677] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.677] GetProcessHeap () returned 0xfd0000 [0156.677] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0156.681] GetProcessHeap () returned 0xfd0000 [0156.681] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.682] GetProcessHeap () returned 0xfd0000 [0156.682] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.685] GetProcessHeap () returned 0xfd0000 [0156.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.685] GetProcessHeap () returned 0xfd0000 [0156.685] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0156.688] GetProcessHeap () returned 0xfd0000 [0156.688] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.688] GetProcessHeap () returned 0xfd0000 [0156.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0156.861] GetProcessHeap () returned 0xfd0000 [0156.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.861] GetProcessHeap () returned 0xfd0000 [0156.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0156.866] GetProcessHeap () returned 0xfd0000 [0156.866] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.866] GetProcessHeap () returned 0xfd0000 [0156.866] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.868] GetProcessHeap () returned 0xfd0000 [0156.868] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.869] GetProcessHeap () returned 0xfd0000 [0156.869] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.871] GetProcessHeap () returned 0xfd0000 [0156.871] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.871] GetProcessHeap () returned 0xfd0000 [0156.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.874] GetProcessHeap () returned 0xfd0000 [0156.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.874] GetProcessHeap () returned 0xfd0000 [0156.874] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.877] GetProcessHeap () returned 0xfd0000 [0156.877] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.877] GetProcessHeap () returned 0xfd0000 [0156.877] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0156.880] GetProcessHeap () returned 0xfd0000 [0156.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.880] GetProcessHeap () returned 0xfd0000 [0156.880] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0156.883] GetProcessHeap () returned 0xfd0000 [0156.883] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.883] GetProcessHeap () returned 0xfd0000 [0156.883] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.885] GetProcessHeap () returned 0xfd0000 [0156.885] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.885] GetProcessHeap () returned 0xfd0000 [0156.885] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.888] GetProcessHeap () returned 0xfd0000 [0156.888] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.888] GetProcessHeap () returned 0xfd0000 [0156.888] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0156.891] GetProcessHeap () returned 0xfd0000 [0156.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.891] GetProcessHeap () returned 0xfd0000 [0156.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0156.894] GetProcessHeap () returned 0xfd0000 [0156.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.894] GetProcessHeap () returned 0xfd0000 [0156.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0156.897] GetProcessHeap () returned 0xfd0000 [0156.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0156.897] GetProcessHeap () returned 0xfd0000 [0156.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0156.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.146] GetProcessHeap () returned 0xfd0000 [0157.146] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.146] GetProcessHeap () returned 0xfd0000 [0157.146] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0157.149] GetProcessHeap () returned 0xfd0000 [0157.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.149] GetProcessHeap () returned 0xfd0000 [0157.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0157.152] GetProcessHeap () returned 0xfd0000 [0157.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.152] GetProcessHeap () returned 0xfd0000 [0157.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0157.154] GetProcessHeap () returned 0xfd0000 [0157.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.155] GetProcessHeap () returned 0xfd0000 [0157.155] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0157.157] GetProcessHeap () returned 0xfd0000 [0157.157] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.157] GetProcessHeap () returned 0xfd0000 [0157.157] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0157.159] GetProcessHeap () returned 0xfd0000 [0157.159] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.159] GetProcessHeap () returned 0xfd0000 [0157.159] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0157.162] GetProcessHeap () returned 0xfd0000 [0157.162] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.162] GetProcessHeap () returned 0xfd0000 [0157.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.165] GetProcessHeap () returned 0xfd0000 [0157.165] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.165] GetProcessHeap () returned 0xfd0000 [0157.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0157.168] GetProcessHeap () returned 0xfd0000 [0157.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.168] GetProcessHeap () returned 0xfd0000 [0157.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.171] GetProcessHeap () returned 0xfd0000 [0157.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.171] GetProcessHeap () returned 0xfd0000 [0157.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0157.173] GetProcessHeap () returned 0xfd0000 [0157.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.173] GetProcessHeap () returned 0xfd0000 [0157.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0157.176] GetProcessHeap () returned 0xfd0000 [0157.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.176] GetProcessHeap () returned 0xfd0000 [0157.176] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0157.178] GetProcessHeap () returned 0xfd0000 [0157.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.178] GetProcessHeap () returned 0xfd0000 [0157.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.181] GetProcessHeap () returned 0xfd0000 [0157.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.181] GetProcessHeap () returned 0xfd0000 [0157.181] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.378] GetProcessHeap () returned 0xfd0000 [0157.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.379] GetProcessHeap () returned 0xfd0000 [0157.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0157.384] GetProcessHeap () returned 0xfd0000 [0157.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.384] GetProcessHeap () returned 0xfd0000 [0157.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0157.387] GetProcessHeap () returned 0xfd0000 [0157.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.387] GetProcessHeap () returned 0xfd0000 [0157.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0157.387] GetProcessHeap () returned 0xfd0000 [0157.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0157.388] GetProcessHeap () returned 0xfd0000 [0157.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0157.388] GetProcessHeap () returned 0xfd0000 [0157.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.389] GetProcessHeap () returned 0xfd0000 [0157.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xb9e664f2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb9e664f2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0157.391] GetProcessHeap () returned 0xfd0000 [0157.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.392] GetProcessHeap () returned 0xfd0000 [0157.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.392] GetProcessHeap () returned 0xfd0000 [0157.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0157.392] GetProcessHeap () returned 0xfd0000 [0157.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.395] GetProcessHeap () returned 0xfd0000 [0157.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.395] GetProcessHeap () returned 0xfd0000 [0157.395] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0157.395] GetProcessHeap () returned 0xfd0000 [0157.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.395] GetProcessHeap () returned 0xfd0000 [0157.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.396] GetProcessHeap () returned 0xfd0000 [0157.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0157.398] GetProcessHeap () returned 0xfd0000 [0157.398] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0157.399] GetProcessHeap () returned 0xfd0000 [0157.399] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.399] GetProcessHeap () returned 0xfd0000 [0157.399] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.399] GetProcessHeap () returned 0xfd0000 [0157.399] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0157.400] GetProcessHeap () returned 0xfd0000 [0157.400] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0157.401] GetProcessHeap () returned 0xfd0000 [0157.401] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.401] GetProcessHeap () returned 0xfd0000 [0157.401] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.401] GetProcessHeap () returned 0xfd0000 [0157.401] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.402] GetProcessHeap () returned 0xfd0000 [0157.402] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0157.405] GetProcessHeap () returned 0xfd0000 [0157.405] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.405] GetProcessHeap () returned 0xfd0000 [0157.405] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0157.405] GetProcessHeap () returned 0xfd0000 [0157.405] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.405] GetProcessHeap () returned 0xfd0000 [0157.405] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0157.542] GetProcessHeap () returned 0xfd0000 [0157.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.542] GetProcessHeap () returned 0xfd0000 [0157.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0157.545] GetProcessHeap () returned 0xfd0000 [0157.545] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.545] GetProcessHeap () returned 0xfd0000 [0157.545] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0157.546] GetProcessHeap () returned 0xfd0000 [0157.546] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.546] GetProcessHeap () returned 0xfd0000 [0157.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0157.546] GetProcessHeap () returned 0xfd0000 [0157.546] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.546] GetProcessHeap () returned 0xfd0000 [0157.546] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.546] GetProcessHeap () returned 0xfd0000 [0157.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0157.546] GetProcessHeap () returned 0xfd0000 [0157.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.547] GetProcessHeap () returned 0xfd0000 [0157.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b3a1ae, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b3a1ae, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0157.548] GetProcessHeap () returned 0xfd0000 [0157.548] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.549] GetProcessHeap () returned 0xfd0000 [0157.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0157.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0157.549] GetProcessHeap () returned 0xfd0000 [0157.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0157.549] GetProcessHeap () returned 0xfd0000 [0157.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.550] GetProcessHeap () returned 0xfd0000 [0157.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0157.752] GetProcessHeap () returned 0xfd0000 [0157.752] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0157.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0157.753] GetProcessHeap () returned 0xfd0000 [0157.753] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0157.753] GetProcessHeap () returned 0xfd0000 [0157.753] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.753] GetProcessHeap () returned 0xfd0000 [0157.753] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.753] GetProcessHeap () returned 0xfd0000 [0157.753] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0157.755] GetProcessHeap () returned 0xfd0000 [0157.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0157.756] GetProcessHeap () returned 0xfd0000 [0157.756] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.756] GetProcessHeap () returned 0xfd0000 [0157.756] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.756] GetProcessHeap () returned 0xfd0000 [0157.756] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0157.757] GetProcessHeap () returned 0xfd0000 [0157.757] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.757] GetProcessHeap () returned 0xfd0000 [0157.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0157.758] GetProcessHeap () returned 0xfd0000 [0157.758] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0157.759] GetProcessHeap () returned 0xfd0000 [0157.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0157.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0157.760] GetProcessHeap () returned 0xfd0000 [0157.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0157.760] GetProcessHeap () returned 0xfd0000 [0157.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.760] GetProcessHeap () returned 0xfd0000 [0157.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.761] GetProcessHeap () returned 0xfd0000 [0157.761] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.762] GetProcessHeap () returned 0xfd0000 [0157.762] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0157.763] GetProcessHeap () returned 0xfd0000 [0157.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.763] GetProcessHeap () returned 0xfd0000 [0157.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0157.763] GetProcessHeap () returned 0xfd0000 [0157.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.763] GetProcessHeap () returned 0xfd0000 [0157.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.764] GetProcessHeap () returned 0xfd0000 [0157.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="咊\x97þ巠Ă\x7f")) returned 0xffffffff [0157.764] GetProcessHeap () returned 0xfd0000 [0157.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0157.764] GetProcessHeap () returned 0xfd0000 [0157.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0157.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0157.765] GetProcessHeap () returned 0xfd0000 [0157.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502c09b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0157.766] GetProcessHeap () returned 0xfd0000 [0157.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0157.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502cf82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0157.767] GetProcessHeap () returned 0xfd0000 [0157.767] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0157.767] GetProcessHeap () returned 0xfd0000 [0157.767] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0157.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0157.767] GetProcessHeap () returned 0xfd0000 [0157.767] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0157.767] GetProcessHeap () returned 0xfd0000 [0157.767] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0157.768] GetProcessHeap () returned 0xfd0000 [0157.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0157.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0157.770] GetProcessHeap () returned 0xfd0000 [0157.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0157.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0157.771] GetProcessHeap () returned 0xfd0000 [0157.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0157.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0157.773] GetProcessHeap () returned 0xfd0000 [0157.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0157.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0157.773] GetProcessHeap () returned 0xfd0000 [0157.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0157.775] GetProcessHeap () returned 0xfd0000 [0157.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.775] GetProcessHeap () returned 0xfd0000 [0157.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0157.775] GetProcessHeap () returned 0xfd0000 [0157.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0157.775] GetProcessHeap () returned 0xfd0000 [0157.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0157.775] GetProcessHeap () returned 0xfd0000 [0157.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0157.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0157.776] GetProcessHeap () returned 0xfd0000 [0157.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0157.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0157.777] GetProcessHeap () returned 0xfd0000 [0157.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0157.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e5961, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0157.778] GetProcessHeap () returned 0xfd0000 [0157.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0157.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0157.779] GetProcessHeap () returned 0xfd0000 [0157.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0157.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0157.780] GetProcessHeap () returned 0xfd0000 [0157.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0157.780] GetProcessHeap () returned 0xfd0000 [0157.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0157.780] GetProcessHeap () returned 0xfd0000 [0157.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0157.781] GetProcessHeap () returned 0xfd0000 [0157.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0157.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0157.782] GetProcessHeap () returned 0xfd0000 [0157.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0157.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0157.783] GetProcessHeap () returned 0xfd0000 [0157.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0157.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e755b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0157.783] GetProcessHeap () returned 0xfd0000 [0157.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0157.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0157.784] GetProcessHeap () returned 0xfd0000 [0157.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0157.784] GetProcessHeap () returned 0xfd0000 [0157.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0157.785] GetProcessHeap () returned 0xfd0000 [0157.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0157.785] GetProcessHeap () returned 0xfd0000 [0157.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0157.786] GetProcessHeap () returned 0xfd0000 [0157.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0157.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0157.786] GetProcessHeap () returned 0xfd0000 [0157.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0157.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e85b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0158.005] GetProcessHeap () returned 0xfd0000 [0158.006] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0158.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0158.006] GetProcessHeap () returned 0xfd0000 [0158.006] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0158.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0158.006] GetProcessHeap () returned 0xfd0000 [0158.007] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0158.007] GetProcessHeap () returned 0xfd0000 [0158.007] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0158.007] GetProcessHeap () returned 0xfd0000 [0158.007] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0158.008] GetProcessHeap () returned 0xfd0000 [0158.008] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0158.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0158.009] GetProcessHeap () returned 0xfd0000 [0158.009] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0158.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0158.010] GetProcessHeap () returned 0xfd0000 [0158.010] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0158.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0158.010] GetProcessHeap () returned 0xfd0000 [0158.010] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0158.010] GetProcessHeap () returned 0xfd0000 [0158.010] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0158.010] GetProcessHeap () returned 0xfd0000 [0158.010] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0158.011] GetProcessHeap () returned 0xfd0000 [0158.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0158.011] GetProcessHeap () returned 0xfd0000 [0158.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0158.011] GetProcessHeap () returned 0xfd0000 [0158.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0158.012] GetProcessHeap () returned 0xfd0000 [0158.012] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0158.012] GetProcessHeap () returned 0xfd0000 [0158.012] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0158.013] GetProcessHeap () returned 0xfd0000 [0158.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0158.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0158.014] GetProcessHeap () returned 0xfd0000 [0158.014] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0158.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0158.015] GetProcessHeap () returned 0xfd0000 [0158.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0158.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb5188061, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0158.081] GetProcessHeap () returned 0xfd0000 [0158.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0158.082] GetProcessHeap () returned 0xfd0000 [0158.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0158.082] GetProcessHeap () returned 0xfd0000 [0158.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0158.082] GetProcessHeap () returned 0xfd0000 [0158.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0158.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0158.092] GetProcessHeap () returned 0xfd0000 [0158.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0158.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0158.123] GetProcessHeap () returned 0xfd0000 [0158.123] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0158.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e40b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0158.124] GetProcessHeap () returned 0xfd0000 [0158.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0158.124] GetProcessHeap () returned 0xfd0000 [0158.124] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0158.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4446, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0158.125] GetProcessHeap () returned 0xfd0000 [0158.125] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0158.125] GetProcessHeap () returned 0xfd0000 [0158.125] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0158.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0158.128] GetProcessHeap () returned 0xfd0000 [0158.128] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0158.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e545b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0158.129] GetProcessHeap () returned 0xfd0000 [0158.129] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0158.129] GetProcessHeap () returned 0xfd0000 [0158.129] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0158.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0158.130] GetProcessHeap () returned 0xfd0000 [0158.130] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0158.130] GetProcessHeap () returned 0xfd0000 [0158.130] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0158.130] GetProcessHeap () returned 0xfd0000 [0158.130] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0158.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0159.590] GetProcessHeap () returned 0xfd0000 [0159.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524d244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x326cf05, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0159.596] GetProcessHeap () returned 0xfd0000 [0159.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.596] GetProcessHeap () returned 0xfd0000 [0159.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.596] GetProcessHeap () returned 0xfd0000 [0159.596] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0159.602] GetProcessHeap () returned 0xfd0000 [0159.602] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.602] GetProcessHeap () returned 0xfd0000 [0159.602] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0159.603] GetProcessHeap () returned 0xfd0000 [0159.603] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0159.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0159.618] GetProcessHeap () returned 0xfd0000 [0159.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529f7d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.619] GetProcessHeap () returned 0xfd0000 [0159.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.619] GetProcessHeap () returned 0xfd0000 [0159.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529ffc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0159.631] GetProcessHeap () returned 0xfd0000 [0159.631] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.631] GetProcessHeap () returned 0xfd0000 [0159.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.632] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.632] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1 [0159.632] GetProcessHeap () returned 0xfd0000 [0159.632] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0159.633] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1107, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.633] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1 [0159.633] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1 [0159.633] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0 [0159.633] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0159.633] GetProcessHeap () returned 0xfd0000 [0159.633] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.633] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0159.633] GetProcessHeap () returned 0xfd0000 [0159.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0159.634] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.634] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1 [0159.634] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0 [0159.634] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0159.634] GetProcessHeap () returned 0xfd0000 [0159.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.634] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0159.634] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0159.634] GetProcessHeap () returned 0xfd0000 [0159.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.634] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0159.634] GetProcessHeap () returned 0xfd0000 [0159.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.655] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.655] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1 [0159.655] GetProcessHeap () returned 0xfd0000 [0159.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb537bc07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a628ff7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1021, dwReserved0=0x0, dwReserved1=0x0, cFileName="Be.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLike.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLike.Tests.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96efdfa3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96efdfa3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96efdfa3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLikeExactly.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLikeExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1 [0159.657] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x573, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeOfType.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeOfType.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contain.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e8b875, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e8b875, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96efdfa3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exist.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Match.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1340, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Set-TestInconclusive.ps1", cAlternateFileName="")) returned 1 [0159.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Should.ps1", cAlternateFileName="")) returned 1 [0159.659] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1 [0159.659] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1 [0159.659] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0 [0159.659] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0159.660] GetProcessHeap () returned 0xfd0000 [0159.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-A.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-B.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1 [0159.660] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe941, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x370d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4033, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0 [0159.662] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0159.662] GetProcessHeap () returned 0xfd0000 [0159.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fe2e0e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fe2e0e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fe2e0e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.psd1", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6956, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.psm1", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b95, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e6560d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e6560d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e6560d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.md", cAlternateFileName="")) returned 1 [0159.662] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snippets", cAlternateFileName="")) returned 1 [0159.662] GetProcessHeap () returned 0xfd0000 [0159.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.664] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f706d4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9702f2dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9702f2dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9702f2dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f4a475, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f4a475, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f4a475, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f706d4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f706d4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0159.665] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0 [0159.665] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0159.666] GetProcessHeap () returned 0xfd0000 [0159.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.666] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snippets", cAlternateFileName="")) returned 0 [0159.666] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0159.666] GetProcessHeap () returned 0xfd0000 [0159.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0159.667] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0159.667] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0159.668] GetProcessHeap () returned 0xfd0000 [0159.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0159.668] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0159.668] GetProcessHeap () returned 0xfd0000 [0159.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0159.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0159.668] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.668] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0159.668] GetProcessHeap () returned 0xfd0000 [0159.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0159.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0159.671] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.671] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0159.671] GetProcessHeap () returned 0xfd0000 [0159.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a790e0 [0159.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0159.671] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb53ed28c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.671] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1 [0159.672] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 0 [0159.672] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0159.672] GetProcessHeap () returned 0xfd0000 [0159.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a790e0 | out: hHeap=0xfd0000) returned 1 [0159.672] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0159.672] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Format.ps1xml", cAlternateFileName="PSGETF~1.PS1")) returned 1 [0159.672] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13872, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1 [0159.672] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 1 [0159.672] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 0 [0159.672] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0159.672] GetProcessHeap () returned 0xfd0000 [0159.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0159.673] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0159.673] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0159.673] GetProcessHeap () returned 0xfd0000 [0159.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0159.673] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0159.673] GetProcessHeap () returned 0xfd0000 [0159.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0159.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0159.673] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.674] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1 [0159.674] GetProcessHeap () returned 0xfd0000 [0159.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0159.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0159.948] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.948] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0159.948] GetProcessHeap () returned 0xfd0000 [0159.948] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\en\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.949] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xb5478c6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xfb6a7fd7, ftLastAccessTime.dwHighDateTime=0x1d1a04a, ftLastWriteTime.dwLowDateTime=0xfb6a7fd7, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2ff0e, ftCreationTime.dwHighDateTime=0x1d1a04a, ftLastAccessTime.dwLowDateTime=0xfb6a7fd7, ftLastAccessTime.dwHighDateTime=0x1d1a04a, ftLastWriteTime.dwLowDateTime=0xfb6a7fd7, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0159.950] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0159.950] GetProcessHeap () returned 0xfd0000 [0159.950] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline.psd1", cAlternateFileName="PSREAD~1.PSD")) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 0 [0159.951] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0159.951] GetProcessHeap () returned 0xfd0000 [0159.951] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0159.951] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0159.951] GetProcessHeap () returned 0xfd0000 [0159.951] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0159.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.955] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.956] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0159.956] GetProcessHeap () returned 0xfd0000 [0159.956] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\en\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0159.956] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xb54d81cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.956] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0159.956] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x884e2a3c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x884e2a3c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.Resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0159.956] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0159.956] GetProcessHeap () returned 0xfd0000 [0159.956] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.956] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0159.956] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline.psd1", cAlternateFileName="PSREAD~1.PSD")) returned 1 [0159.956] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 1 [0159.957] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline.psm1", cAlternateFileName="PSREAD~1.PSM")) returned 0 [0159.957] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0159.957] GetProcessHeap () returned 0xfd0000 [0159.957] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0159.957] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0 [0159.957] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0159.957] GetProcessHeap () returned 0xfd0000 [0159.957] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0159.958] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0159.958] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0159.958] GetProcessHeap () returned 0xfd0000 [0159.958] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0159.958] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0159.958] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0159.958] GetProcessHeap () returned 0xfd0000 [0159.958] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0159.959] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0159.959] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0159.959] GetProcessHeap () returned 0xfd0000 [0159.959] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0159.959] FindNextFileW (in: hFindFile=0xfe9800, lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0159.959] GetProcessHeap () returned 0xfd0000 [0159.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0159.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0159.960] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="..", cAlternateFileName="")) returned 1 [0159.960] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Adobe", cAlternateFileName="")) returned 1 [0159.960] GetProcessHeap () returned 0xfd0000 [0159.960] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0159.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0159.960] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.960] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC", cAlternateFileName="ACROBA~1")) returned 1 [0159.960] GetProcessHeap () returned 0xfd0000 [0159.960] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0159.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0159.961] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.961] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0159.961] GetProcessHeap () returned 0xfd0000 [0159.961] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0159.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0159.967] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdec183d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.967] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4f1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0159.967] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4f1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0 [0159.968] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0159.968] GetProcessHeap () returned 0xfd0000 [0159.968] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0159.968] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0159.968] GetProcessHeap () returned 0xfd0000 [0159.968] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0159.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0159.969] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.978] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191cc8f5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x2d9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf", cAlternateFileName="149487~1.PDF")) returned 1 [0159.978] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb16256d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x28bf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1 [0159.978] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xded496a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xe8ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACE.dll", cAlternateFileName="")) returned 1 [0159.978] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroApp", cAlternateFileName="")) returned 1 [0159.978] GetProcessHeap () returned 0xfd0000 [0159.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0159.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0159.983] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3632d245, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.983] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0159.983] GetProcessHeap () returned 0xfd0000 [0159.983] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0159.990] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.991] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCenter_R.aapp", cAlternateFileName="APPCEN~1.AAP")) returned 1 [0159.991] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates_R.aapp", cAlternateFileName="CERTIF~1.AAP")) returned 1 [0159.991] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3639f962, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures.aapp", cAlternateFileName="COLLEC~1.AAP")) returned 1 [0159.991] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Combine_R_RHP.aapp", cAlternateFileName="COMBIN~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d500f0c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comments.aapp", cAlternateFileName="COMMEN~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf2622c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compare_R_RHP.aapp", cAlternateFileName="COMPAR~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPDF_Full.aapp", cAlternateFileName="CPDF_F~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPDF_RHP.aapp", cAlternateFileName="CPDF_R~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf2622c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_Exp_RHP.aapp", cAlternateFileName="EDIT_R~3.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a61b10, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_Full.aapp", cAlternateFileName="EDIT_R~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edit_R_RHP.aapp", cAlternateFileName="EDIT_R~2.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPDF_Full.aapp", cAlternateFileName="EPDF_F~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363534a5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPDF_RHP.aapp", cAlternateFileName="EPDF_R~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d52724e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0xa7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FillSign.aapp", cAlternateFileName="FILLSI~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1d551e46, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x163, dwReserved0=0x0, dwReserved1=0x0, cFileName="Home.aapp", cAlternateFileName="HOME~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363ebe21, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Measure.aapp", cAlternateFileName="MEASUR~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MoreTools.aapp", cAlternateFileName="MORETO~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf4c482, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OptimizePDF_R_RHP.aapp", cAlternateFileName="OPTIMI~1.AAP")) returned 1 [0159.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pages_R_RHP.aapp", cAlternateFileName="PAGES_~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf4c482, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect_R_RHP.aapp", cAlternateFileName="PROTEC~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf726db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Redact_R_RHP.aapp", cAlternateFileName="REDACT~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaf726db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scan_R_RHP.aapp", cAlternateFileName="SCAN_R~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x363ebe21, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamp.aapp", cAlternateFileName="STAMP~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3637970e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrackedSend.aapp", cAlternateFileName="TRACKE~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer.aapp", cAlternateFileName="VIEWER~1.AAP")) returned 1 [0159.993] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer.aapp", cAlternateFileName="VIEWER~1.AAP")) returned 0 [0159.993] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0159.994] GetProcessHeap () returned 0xfd0000 [0159.994] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0159.994] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 0 [0159.994] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0159.994] GetProcessHeap () returned 0xfd0000 [0159.994] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0159.994] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0159.994] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCEF", cAlternateFileName="")) returned 1 [0159.994] GetProcessHeap () returned 0xfd0000 [0159.994] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0159.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0159.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c8bdc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe15851ea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe15851ea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaad3e64, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef.pak", cAlternateFileName="")) returned 1 [0159.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac515e2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef_100_percent.pak", cAlternateFileName="CEF_10~1.PAK")) returned 1 [0159.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac77826, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef_200_percent.pak", cAlternateFileName="CEF_20~1.PAK")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac77826, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef_extensions.pak", cAlternateFileName="CEF_EX~1.PAK")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9f80ae4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x6b3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~1.DLL")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x190c1897, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x6994, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYING.LGPLv2.1.txt", cAlternateFileName="COPYIN~1.TXT")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9fa6d5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x202368, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dcompiler_43.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaefffe5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x392eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~2.DLL")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9f5a940, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x9b49f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt.dll", cAlternateFileName="")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe293087a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x458f9f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libcef.dll", cAlternateFileName="")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xd9fa6d5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x15650, dwReserved0=0x0, dwReserved1=0x0, cFileName="libEGL.dll", cAlternateFileName="")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda3accdd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x2ca650, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x190e7af4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x69b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE.txt", cAlternateFileName="")) returned 1 [0159.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="locales", cAlternateFileName="")) returned 1 [0159.999] GetProcessHeap () returned 0xfd0000 [0159.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0159.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0160.000] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac9da78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdac9da78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdac9da78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 0 [0160.000] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0160.000] GetProcessHeap () returned 0xfd0000 [0160.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdb54228e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbff7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdrCEF.exe", cAlternateFileName="")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdbc431b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x13279f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdrServicesUpdater.exe", cAlternateFileName="RDRSER~1.EXE")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaad3e64, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda576987, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x361f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1 [0160.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda576987, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x361f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 0 [0160.000] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0160.001] GetProcessHeap () returned 0xfd0000 [0160.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf33f4ce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x16dc3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.dll", cAlternateFileName="")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf3b1bc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x21fdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.exe", cAlternateFileName="")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf3d7e46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Info.exe", cAlternateFileName="ACRORD~1.EXE")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf66062a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xe07ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Res.dll", cAlternateFileName="ACRORD~1.DLL")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec648c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroSup64.dll", cAlternateFileName="ACROSU~1.DLL")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf6d2df0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xaff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroTextExtractor.exe", cAlternateFileName="ACROTE~1.EXE")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x21df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADelRCP.exe", cAlternateFileName="")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37bc3c75, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.Reader.Dependencies.manifest", cAlternateFileName="ADOBER~1.MAN")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2a15668, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xd87f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.exe", cAlternateFileName="ADOBEC~1.EXE")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea0236a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7e1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeLinguistic.dll", cAlternateFileName="ADOBEL~1.DLL")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1f95cdaa, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x45650, dwReserved0=0x0, dwReserved1=0x0, cFileName="adoberfp.dll", cAlternateFileName="")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b58fe2e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x4ae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeXMP.dll", cAlternateFileName="")) returned 1 [0160.001] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc98600, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf876737, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3cc98600, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x4e5df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGM.dll", cAlternateFileName="")) returned 1 [0160.002] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36fd7dc6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGMGPUOptIn.ini", cAlternateFileName="AGMGPU~1.INI")) returned 1 [0160.002] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1ab2191d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x426b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahclient.dll", cAlternateFileName="")) returned 1 [0160.002] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xda8e3fa2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x116c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDE.dll", cAlternateFileName="")) returned 1 [0160.002] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR", cAlternateFileName="")) returned 1 [0160.002] GetProcessHeap () returned 0xfd0000 [0160.002] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AIR\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.007] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde91d4f2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde91d4f2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.007] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1 [0160.007] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde91d4f2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.dll", cAlternateFileName="")) returned 0 [0160.007] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0160.008] GetProcessHeap () returned 0xfd0000 [0160.008] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.008] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1 [0160.008] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdecd6f88, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x309f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXE8SharedExpat.dll", cAlternateFileName="AXE8SH~1.DLL")) returned 1 [0160.008] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a672c00, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xded23451, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3a672c00, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x989f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXSLE.dll", cAlternateFileName="")) returned 1 [0160.008] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf89c98d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1d1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIB.dll", cAlternateFileName="")) returned 1 [0160.008] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf89c98d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x269f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBUtils.dll", cAlternateFileName="")) returned 1 [0160.008] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Browser", cAlternateFileName="")) returned 1 [0160.008] GetProcessHeap () returned 0xfd0000 [0160.008] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.021] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352a2928, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xde9b5e59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.021] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde9b5e59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3adf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.dll", cAlternateFileName="")) returned 1 [0160.021] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 1 [0160.021] GetProcessHeap () returned 0xfd0000 [0160.021] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.021] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.021] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718de000, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x1923f03a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x718de000, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0160.021] GetProcessHeap () returned 0xfd0000 [0160.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.021] GetProcessHeap () returned 0xfd0000 [0160.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.218] GetProcessHeap () returned 0xfd0000 [0160.218] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3626e649, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0160.219] GetProcessHeap () returned 0xfd0000 [0160.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0160.220] GetProcessHeap () returned 0xfd0000 [0160.220] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.220] GetProcessHeap () returned 0xfd0000 [0160.220] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.220] GetProcessHeap () returned 0xfd0000 [0160.220] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.267] GetProcessHeap () returned 0xfd0000 [0160.267] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.267] GetProcessHeap () returned 0xfd0000 [0160.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0160.274] GetProcessHeap () returned 0xfd0000 [0160.274] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.274] GetProcessHeap () returned 0xfd0000 [0160.274] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.274] GetProcessHeap () returned 0xfd0000 [0160.274] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.275] GetProcessHeap () returned 0xfd0000 [0160.275] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.277] GetProcessHeap () returned 0xfd0000 [0160.277] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\en_US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0160.277] GetProcessHeap () returned 0xfd0000 [0160.277] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.277] GetProcessHeap () returned 0xfd0000 [0160.277] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.277] GetProcessHeap () returned 0xfd0000 [0160.277] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e2e03c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2e1b623, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2e1b623, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0160.289] GetProcessHeap () returned 0xfd0000 [0160.289] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342a67ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342cca47, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.290] GetProcessHeap () returned 0xfd0000 [0160.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0160.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.291] GetProcessHeap () returned 0xfd0000 [0160.291] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0160.291] GetProcessHeap () returned 0xfd0000 [0160.291] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.291] GetProcessHeap () returned 0xfd0000 [0160.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.292] GetProcessHeap () returned 0xfd0000 [0160.292] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0160.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.292] GetProcessHeap () returned 0xfd0000 [0160.292] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0160.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38979854, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3899fa98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3899fa98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.293] GetProcessHeap () returned 0xfd0000 [0160.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0160.293] GetProcessHeap () returned 0xfd0000 [0160.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0160.293] GetProcessHeap () returned 0xfd0000 [0160.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.295] GetProcessHeap () returned 0xfd0000 [0160.295] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3425a337, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3425a337, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.296] GetProcessHeap () returned 0xfd0000 [0160.296] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0160.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.296] GetProcessHeap () returned 0xfd0000 [0160.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0160.296] GetProcessHeap () returned 0xfd0000 [0160.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.296] GetProcessHeap () returned 0xfd0000 [0160.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\pi_brokers\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35209fae, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec8aaee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec8aaee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.297] GetProcessHeap () returned 0xfd0000 [0160.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.297] GetProcessHeap () returned 0xfd0000 [0160.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.298] GetProcessHeap () returned 0xfd0000 [0160.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0160.300] GetProcessHeap () returned 0xfd0000 [0160.300] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x34102da0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x34102da0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.302] GetProcessHeap () returned 0xfd0000 [0160.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0160.302] GetProcessHeap () returned 0xfd0000 [0160.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.302] GetProcessHeap () returned 0xfd0000 [0160.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387172c5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38907108, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38907108, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.305] GetProcessHeap () returned 0xfd0000 [0160.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.306] GetProcessHeap () returned 0xfd0000 [0160.306] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\UIThemes\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.306] GetProcessHeap () returned 0xfd0000 [0160.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0160.306] GetProcessHeap () returned 0xfd0000 [0160.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0160.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4008adde, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9798e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfe9798e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0160.307] GetProcessHeap () returned 0xfd0000 [0160.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0160.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0160.310] GetProcessHeap () returned 0xfd0000 [0160.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0160.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee66f38b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0160.311] GetProcessHeap () returned 0xfd0000 [0160.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0160.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.315] GetProcessHeap () returned 0xfd0000 [0160.315] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0160.316] GetProcessHeap () returned 0xfd0000 [0160.316] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.316] GetProcessHeap () returned 0xfd0000 [0160.316] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\cef\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.317] GetProcessHeap () returned 0xfd0000 [0160.317] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.317] GetProcessHeap () returned 0xfd0000 [0160.317] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.318] GetProcessHeap () returned 0xfd0000 [0160.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.318] GetProcessHeap () returned 0xfd0000 [0160.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.318] GetProcessHeap () returned 0xfd0000 [0160.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.319] GetProcessHeap () returned 0xfd0000 [0160.319] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.548] GetProcessHeap () returned 0xfd0000 [0160.548] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.549] GetProcessHeap () returned 0xfd0000 [0160.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.549] GetProcessHeap () returned 0xfd0000 [0160.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.549] GetProcessHeap () returned 0xfd0000 [0160.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0160.550] GetProcessHeap () returned 0xfd0000 [0160.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.550] GetProcessHeap () returned 0xfd0000 [0160.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.550] GetProcessHeap () returned 0xfd0000 [0160.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.551] GetProcessHeap () returned 0xfd0000 [0160.551] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.567] GetProcessHeap () returned 0xfd0000 [0160.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.567] GetProcessHeap () returned 0xfd0000 [0160.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.568] GetProcessHeap () returned 0xfd0000 [0160.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.568] GetProcessHeap () returned 0xfd0000 [0160.568] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.568] GetProcessHeap () returned 0xfd0000 [0160.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.568] GetProcessHeap () returned 0xfd0000 [0160.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.568] GetProcessHeap () returned 0xfd0000 [0160.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.569] GetProcessHeap () returned 0xfd0000 [0160.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0160.570] GetProcessHeap () returned 0xfd0000 [0160.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0160.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0160.610] GetProcessHeap () returned 0xfd0000 [0160.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.613] GetProcessHeap () returned 0xfd0000 [0160.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.615] GetProcessHeap () returned 0xfd0000 [0160.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.616] GetProcessHeap () returned 0xfd0000 [0160.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.616] GetProcessHeap () returned 0xfd0000 [0160.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.620] GetProcessHeap () returned 0xfd0000 [0160.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.620] GetProcessHeap () returned 0xfd0000 [0160.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.620] GetProcessHeap () returned 0xfd0000 [0160.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.621] GetProcessHeap () returned 0xfd0000 [0160.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.630] GetProcessHeap () returned 0xfd0000 [0160.630] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.630] GetProcessHeap () returned 0xfd0000 [0160.630] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.631] GetProcessHeap () returned 0xfd0000 [0160.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes\\dark\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee754143, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.634] GetProcessHeap () returned 0xfd0000 [0160.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.634] GetProcessHeap () returned 0xfd0000 [0160.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.634] GetProcessHeap () returned 0xfd0000 [0160.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0160.636] GetProcessHeap () returned 0xfd0000 [0160.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.637] GetProcessHeap () returned 0xfd0000 [0160.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\themes\\dark\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0160.640] GetProcessHeap () returned 0xfd0000 [0160.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.640] GetProcessHeap () returned 0xfd0000 [0160.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.640] GetProcessHeap () returned 0xfd0000 [0160.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.641] GetProcessHeap () returned 0xfd0000 [0160.641] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.681] GetProcessHeap () returned 0xfd0000 [0160.681] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.683] GetProcessHeap () returned 0xfd0000 [0160.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win8-scrollbar\\themes\\dark\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.685] GetProcessHeap () returned 0xfd0000 [0160.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.685] GetProcessHeap () returned 0xfd0000 [0160.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.685] GetProcessHeap () returned 0xfd0000 [0160.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.686] GetProcessHeap () returned 0xfd0000 [0160.686] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0160.687] GetProcessHeap () returned 0xfd0000 [0160.687] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0160.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0160.689] GetProcessHeap () returned 0xfd0000 [0160.689] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.690] GetProcessHeap () returned 0xfd0000 [0160.690] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.690] GetProcessHeap () returned 0xfd0000 [0160.690] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.692] GetProcessHeap () returned 0xfd0000 [0160.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ar-ae\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.693] GetProcessHeap () returned 0xfd0000 [0160.693] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.693] GetProcessHeap () returned 0xfd0000 [0160.693] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.694] GetProcessHeap () returned 0xfd0000 [0160.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.694] GetProcessHeap () returned 0xfd0000 [0160.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.695] GetProcessHeap () returned 0xfd0000 [0160.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.695] GetProcessHeap () returned 0xfd0000 [0160.695] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\da-dk\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.695] GetProcessHeap () returned 0xfd0000 [0160.696] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.696] GetProcessHeap () returned 0xfd0000 [0160.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\de-de\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.696] GetProcessHeap () returned 0xfd0000 [0160.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.697] GetProcessHeap () returned 0xfd0000 [0160.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-ae\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.697] GetProcessHeap () returned 0xfd0000 [0160.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.698] GetProcessHeap () returned 0xfd0000 [0160.698] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-gb\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.698] GetProcessHeap () returned 0xfd0000 [0160.698] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.698] GetProcessHeap () returned 0xfd0000 [0160.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\en-il\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.699] GetProcessHeap () returned 0xfd0000 [0160.699] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.699] GetProcessHeap () returned 0xfd0000 [0160.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\es-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.700] GetProcessHeap () returned 0xfd0000 [0160.700] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.700] GetProcessHeap () returned 0xfd0000 [0160.700] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\eu-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.701] GetProcessHeap () returned 0xfd0000 [0160.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.701] GetProcessHeap () returned 0xfd0000 [0160.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fi-fi\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.702] GetProcessHeap () returned 0xfd0000 [0160.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.702] GetProcessHeap () returned 0xfd0000 [0160.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-fr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.703] GetProcessHeap () returned 0xfd0000 [0160.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.703] GetProcessHeap () returned 0xfd0000 [0160.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\fr-ma\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.710] GetProcessHeap () returned 0xfd0000 [0160.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.710] GetProcessHeap () returned 0xfd0000 [0160.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\he-il\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.711] GetProcessHeap () returned 0xfd0000 [0160.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.711] GetProcessHeap () returned 0xfd0000 [0160.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hr-hr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.711] GetProcessHeap () returned 0xfd0000 [0160.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.711] GetProcessHeap () returned 0xfd0000 [0160.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\hu-hu\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.712] GetProcessHeap () returned 0xfd0000 [0160.712] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.712] GetProcessHeap () returned 0xfd0000 [0160.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\it-it\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.713] GetProcessHeap () returned 0xfd0000 [0160.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.713] GetProcessHeap () returned 0xfd0000 [0160.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ja-jp\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.713] GetProcessHeap () returned 0xfd0000 [0160.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.713] GetProcessHeap () returned 0xfd0000 [0160.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ko-kr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0160.714] GetProcessHeap () returned 0xfd0000 [0160.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.714] GetProcessHeap () returned 0xfd0000 [0160.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nb-no\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.714] GetProcessHeap () returned 0xfd0000 [0160.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.714] GetProcessHeap () returned 0xfd0000 [0160.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.715] GetProcessHeap () returned 0xfd0000 [0160.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.715] GetProcessHeap () returned 0xfd0000 [0160.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pl-pl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0160.715] GetProcessHeap () returned 0xfd0000 [0160.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.715] GetProcessHeap () returned 0xfd0000 [0160.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\pt-br\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0160.716] GetProcessHeap () returned 0xfd0000 [0160.716] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.716] GetProcessHeap () returned 0xfd0000 [0160.716] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ro-ro\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.716] GetProcessHeap () returned 0xfd0000 [0160.716] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.716] GetProcessHeap () returned 0xfd0000 [0160.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\root\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.717] GetProcessHeap () returned 0xfd0000 [0160.717] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.717] GetProcessHeap () returned 0xfd0000 [0160.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ru-ru\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.717] GetProcessHeap () returned 0xfd0000 [0160.717] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.717] GetProcessHeap () returned 0xfd0000 [0160.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sk-sk\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.718] GetProcessHeap () returned 0xfd0000 [0160.718] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.718] GetProcessHeap () returned 0xfd0000 [0160.718] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-si\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.719] GetProcessHeap () returned 0xfd0000 [0160.719] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.719] GetProcessHeap () returned 0xfd0000 [0160.719] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sl-sl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0160.720] GetProcessHeap () returned 0xfd0000 [0160.720] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.720] GetProcessHeap () returned 0xfd0000 [0160.720] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\sv-se\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.720] GetProcessHeap () returned 0xfd0000 [0160.720] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.720] GetProcessHeap () returned 0xfd0000 [0160.720] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\tr-tr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.720] GetProcessHeap () returned 0xfd0000 [0160.720] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.720] GetProcessHeap () returned 0xfd0000 [0160.720] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\uk-ua\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.721] GetProcessHeap () returned 0xfd0000 [0160.721] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.721] GetProcessHeap () returned 0xfd0000 [0160.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-cn\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.721] GetProcessHeap () returned 0xfd0000 [0160.721] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.721] GetProcessHeap () returned 0xfd0000 [0160.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\zh-tw\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.722] GetProcessHeap () returned 0xfd0000 [0160.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.722] GetProcessHeap () returned 0xfd0000 [0160.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.722] GetProcessHeap () returned 0xfd0000 [0160.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.723] GetProcessHeap () returned 0xfd0000 [0160.723] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.723] GetProcessHeap () returned 0xfd0000 [0160.723] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.724] GetProcessHeap () returned 0xfd0000 [0160.724] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.724] GetProcessHeap () returned 0xfd0000 [0160.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.725] GetProcessHeap () returned 0xfd0000 [0160.725] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.725] GetProcessHeap () returned 0xfd0000 [0160.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0160.725] GetProcessHeap () returned 0xfd0000 [0160.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0160.726] GetProcessHeap () returned 0xfd0000 [0160.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0160.788] GetProcessHeap () returned 0xfd0000 [0160.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ar-ae\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.825] GetProcessHeap () returned 0xfd0000 [0160.825] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.826] GetProcessHeap () returned 0xfd0000 [0160.826] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.827] GetProcessHeap () returned 0xfd0000 [0160.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.827] GetProcessHeap () returned 0xfd0000 [0160.827] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.829] GetProcessHeap () returned 0xfd0000 [0160.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.829] GetProcessHeap () returned 0xfd0000 [0160.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0160.829] GetProcessHeap () returned 0xfd0000 [0160.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.829] GetProcessHeap () returned 0xfd0000 [0160.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.831] GetProcessHeap () returned 0xfd0000 [0160.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.832] GetProcessHeap () returned 0xfd0000 [0160.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.832] GetProcessHeap () returned 0xfd0000 [0160.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.833] GetProcessHeap () returned 0xfd0000 [0160.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.834] GetProcessHeap () returned 0xfd0000 [0160.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.834] GetProcessHeap () returned 0xfd0000 [0160.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.836] GetProcessHeap () returned 0xfd0000 [0160.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.836] GetProcessHeap () returned 0xfd0000 [0160.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\es-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.837] GetProcessHeap () returned 0xfd0000 [0160.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.837] GetProcessHeap () returned 0xfd0000 [0160.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\eu-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.838] GetProcessHeap () returned 0xfd0000 [0160.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.838] GetProcessHeap () returned 0xfd0000 [0160.838] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fi-fi\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.839] GetProcessHeap () returned 0xfd0000 [0160.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.839] GetProcessHeap () returned 0xfd0000 [0160.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-fr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.840] GetProcessHeap () returned 0xfd0000 [0160.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.840] GetProcessHeap () returned 0xfd0000 [0160.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\fr-ma\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.841] GetProcessHeap () returned 0xfd0000 [0160.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.841] GetProcessHeap () returned 0xfd0000 [0160.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\he-il\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.843] GetProcessHeap () returned 0xfd0000 [0160.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.843] GetProcessHeap () returned 0xfd0000 [0160.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hr-hr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.843] GetProcessHeap () returned 0xfd0000 [0160.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.844] GetProcessHeap () returned 0xfd0000 [0160.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\hu-hu\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0160.849] GetProcessHeap () returned 0xfd0000 [0160.849] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.849] GetProcessHeap () returned 0xfd0000 [0160.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\it-it\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.850] GetProcessHeap () returned 0xfd0000 [0160.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.850] GetProcessHeap () returned 0xfd0000 [0160.850] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ja-jp\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.850] GetProcessHeap () returned 0xfd0000 [0160.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.850] GetProcessHeap () returned 0xfd0000 [0160.850] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ko-kr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.851] GetProcessHeap () returned 0xfd0000 [0160.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.851] GetProcessHeap () returned 0xfd0000 [0160.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nb-no\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.851] GetProcessHeap () returned 0xfd0000 [0160.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.852] GetProcessHeap () returned 0xfd0000 [0160.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\nl-nl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0160.852] GetProcessHeap () returned 0xfd0000 [0160.852] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.852] GetProcessHeap () returned 0xfd0000 [0160.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pl-pl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.852] GetProcessHeap () returned 0xfd0000 [0160.852] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.852] GetProcessHeap () returned 0xfd0000 [0160.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\pt-br\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0160.853] GetProcessHeap () returned 0xfd0000 [0160.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.853] GetProcessHeap () returned 0xfd0000 [0160.853] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ro-ro\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.854] GetProcessHeap () returned 0xfd0000 [0160.854] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.854] GetProcessHeap () returned 0xfd0000 [0160.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\root\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.855] GetProcessHeap () returned 0xfd0000 [0160.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.855] GetProcessHeap () returned 0xfd0000 [0160.855] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ru-ru\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.856] GetProcessHeap () returned 0xfd0000 [0160.856] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.856] GetProcessHeap () returned 0xfd0000 [0160.857] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sk-sk\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.857] GetProcessHeap () returned 0xfd0000 [0160.858] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.858] GetProcessHeap () returned 0xfd0000 [0160.858] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-si\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.858] GetProcessHeap () returned 0xfd0000 [0160.858] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.858] GetProcessHeap () returned 0xfd0000 [0160.858] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sl-sl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0160.858] GetProcessHeap () returned 0xfd0000 [0160.858] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.858] GetProcessHeap () returned 0xfd0000 [0160.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\sv-se\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.859] GetProcessHeap () returned 0xfd0000 [0160.859] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.859] GetProcessHeap () returned 0xfd0000 [0160.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\tr-tr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.859] GetProcessHeap () returned 0xfd0000 [0160.859] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.859] GetProcessHeap () returned 0xfd0000 [0160.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\uk-ua\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.860] GetProcessHeap () returned 0xfd0000 [0160.860] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.860] GetProcessHeap () returned 0xfd0000 [0160.860] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-cn\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.860] GetProcessHeap () returned 0xfd0000 [0160.860] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.860] GetProcessHeap () returned 0xfd0000 [0160.860] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\zh-tw\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.861] GetProcessHeap () returned 0xfd0000 [0160.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.861] GetProcessHeap () returned 0xfd0000 [0160.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0160.861] GetProcessHeap () returned 0xfd0000 [0160.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0160.862] GetProcessHeap () returned 0xfd0000 [0160.862] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0160.862] GetProcessHeap () returned 0xfd0000 [0160.862] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0160.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0160.868] GetProcessHeap () returned 0xfd0000 [0160.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0160.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0160.868] GetProcessHeap () returned 0xfd0000 [0160.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0160.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0160.883] GetProcessHeap () returned 0xfd0000 [0160.883] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ar-ae\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.885] GetProcessHeap () returned 0xfd0000 [0160.885] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.885] GetProcessHeap () returned 0xfd0000 [0160.885] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ca-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0160.993] GetProcessHeap () returned 0xfd0000 [0160.993] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0160.993] GetProcessHeap () returned 0xfd0000 [0160.993] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0160.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\cs-cz\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.160] GetProcessHeap () returned 0xfd0000 [0161.160] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.160] GetProcessHeap () returned 0xfd0000 [0161.160] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\da-dk\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.161] GetProcessHeap () returned 0xfd0000 [0161.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.161] GetProcessHeap () returned 0xfd0000 [0161.161] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\de-de\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.162] GetProcessHeap () returned 0xfd0000 [0161.162] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.162] GetProcessHeap () returned 0xfd0000 [0161.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-ae\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.163] GetProcessHeap () returned 0xfd0000 [0161.163] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.163] GetProcessHeap () returned 0xfd0000 [0161.163] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-gb\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.163] GetProcessHeap () returned 0xfd0000 [0161.163] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.163] GetProcessHeap () returned 0xfd0000 [0161.163] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\en-il\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.164] GetProcessHeap () returned 0xfd0000 [0161.164] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.164] GetProcessHeap () returned 0xfd0000 [0161.164] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\es-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.165] GetProcessHeap () returned 0xfd0000 [0161.165] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.165] GetProcessHeap () returned 0xfd0000 [0161.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\eu-es\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.166] GetProcessHeap () returned 0xfd0000 [0161.166] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.166] GetProcessHeap () returned 0xfd0000 [0161.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fi-fi\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.167] GetProcessHeap () returned 0xfd0000 [0161.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.167] GetProcessHeap () returned 0xfd0000 [0161.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-fr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.168] GetProcessHeap () returned 0xfd0000 [0161.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.168] GetProcessHeap () returned 0xfd0000 [0161.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\fr-ma\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.169] GetProcessHeap () returned 0xfd0000 [0161.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.169] GetProcessHeap () returned 0xfd0000 [0161.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.169] GetProcessHeap () returned 0xfd0000 [0161.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.169] GetProcessHeap () returned 0xfd0000 [0161.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0161.170] GetProcessHeap () returned 0xfd0000 [0161.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.170] GetProcessHeap () returned 0xfd0000 [0161.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.171] GetProcessHeap () returned 0xfd0000 [0161.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.171] GetProcessHeap () returned 0xfd0000 [0161.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\it-it\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.172] GetProcessHeap () returned 0xfd0000 [0161.172] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.172] GetProcessHeap () returned 0xfd0000 [0161.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ja-jp\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.173] GetProcessHeap () returned 0xfd0000 [0161.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.173] GetProcessHeap () returned 0xfd0000 [0161.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ko-kr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.174] GetProcessHeap () returned 0xfd0000 [0161.174] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.174] GetProcessHeap () returned 0xfd0000 [0161.174] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.174] GetProcessHeap () returned 0xfd0000 [0161.174] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.174] GetProcessHeap () returned 0xfd0000 [0161.174] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nl-nl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.175] GetProcessHeap () returned 0xfd0000 [0161.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.175] GetProcessHeap () returned 0xfd0000 [0161.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pl-pl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.176] GetProcessHeap () returned 0xfd0000 [0161.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.176] GetProcessHeap () returned 0xfd0000 [0161.176] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\pt-br\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0161.176] GetProcessHeap () returned 0xfd0000 [0161.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.176] GetProcessHeap () returned 0xfd0000 [0161.176] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ro-ro\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.177] GetProcessHeap () returned 0xfd0000 [0161.177] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.177] GetProcessHeap () returned 0xfd0000 [0161.177] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\root\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.178] GetProcessHeap () returned 0xfd0000 [0161.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.178] GetProcessHeap () returned 0xfd0000 [0161.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\ru-ru\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.179] GetProcessHeap () returned 0xfd0000 [0161.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.179] GetProcessHeap () returned 0xfd0000 [0161.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sk-sk\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0161.180] GetProcessHeap () returned 0xfd0000 [0161.180] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.180] GetProcessHeap () returned 0xfd0000 [0161.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-si\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.180] GetProcessHeap () returned 0xfd0000 [0161.180] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.180] GetProcessHeap () returned 0xfd0000 [0161.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sl-sl\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.181] GetProcessHeap () returned 0xfd0000 [0161.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.181] GetProcessHeap () returned 0xfd0000 [0161.181] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\sv-se\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.182] GetProcessHeap () returned 0xfd0000 [0161.182] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.182] GetProcessHeap () returned 0xfd0000 [0161.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\tr-tr\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.182] GetProcessHeap () returned 0xfd0000 [0161.182] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.182] GetProcessHeap () returned 0xfd0000 [0161.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\uk-ua\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0161.183] GetProcessHeap () returned 0xfd0000 [0161.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.183] GetProcessHeap () returned 0xfd0000 [0161.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-cn\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.183] GetProcessHeap () returned 0xfd0000 [0161.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.183] GetProcessHeap () returned 0xfd0000 [0161.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\zh-tw\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.184] GetProcessHeap () returned 0xfd0000 [0161.184] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.184] GetProcessHeap () returned 0xfd0000 [0161.184] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.190] GetProcessHeap () returned 0xfd0000 [0161.190] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0161.191] GetProcessHeap () returned 0xfd0000 [0161.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0161.191] GetProcessHeap () returned 0xfd0000 [0161.191] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0161.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.192] GetProcessHeap () returned 0xfd0000 [0161.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0161.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.193] GetProcessHeap () returned 0xfd0000 [0161.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\jquery.ui.touch-punch\\0.2.2\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0161.193] GetProcessHeap () returned 0xfd0000 [0161.193] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.193] GetProcessHeap () returned 0xfd0000 [0161.193] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0161.193] GetProcessHeap () returned 0xfd0000 [0161.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0161.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.194] GetProcessHeap () returned 0xfd0000 [0161.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.194] GetProcessHeap () returned 0xfd0000 [0161.194] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.194] GetProcessHeap () returned 0xfd0000 [0161.194] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0161.194] GetProcessHeap () returned 0xfd0000 [0161.194] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0161.195] GetProcessHeap () returned 0xfd0000 [0161.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0161.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\misc\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.197] GetProcessHeap () returned 0xfd0000 [0161.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0161.197] GetProcessHeap () returned 0xfd0000 [0161.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0161.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0161.200] GetProcessHeap () returned 0xfd0000 [0161.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0161.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.201] GetProcessHeap () returned 0xfd0000 [0161.201] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.415] GetProcessHeap () returned 0xfd0000 [0161.415] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.416] GetProcessHeap () returned 0xfd0000 [0161.416] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.507] GetProcessHeap () returned 0xfd0000 [0161.507] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.508] GetProcessHeap () returned 0xfd0000 [0161.508] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.511] GetProcessHeap () returned 0xfd0000 [0161.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.512] GetProcessHeap () returned 0xfd0000 [0161.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.512] GetProcessHeap () returned 0xfd0000 [0161.512] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.512] GetProcessHeap () returned 0xfd0000 [0161.512] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.513] GetProcessHeap () returned 0xfd0000 [0161.513] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.515] GetProcessHeap () returned 0xfd0000 [0161.515] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.516] GetProcessHeap () returned 0xfd0000 [0161.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.516] GetProcessHeap () returned 0xfd0000 [0161.516] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.516] GetProcessHeap () returned 0xfd0000 [0161.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.516] GetProcessHeap () returned 0xfd0000 [0161.517] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.517] GetProcessHeap () returned 0xfd0000 [0161.517] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.517] GetProcessHeap () returned 0xfd0000 [0161.517] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.518] GetProcessHeap () returned 0xfd0000 [0161.518] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.518] GetProcessHeap () returned 0xfd0000 [0161.518] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.519] GetProcessHeap () returned 0xfd0000 [0161.519] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.519] GetProcessHeap () returned 0xfd0000 [0161.519] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.520] GetProcessHeap () returned 0xfd0000 [0161.520] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.520] GetProcessHeap () returned 0xfd0000 [0161.520] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.520] GetProcessHeap () returned 0xfd0000 [0161.520] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.520] GetProcessHeap () returned 0xfd0000 [0161.520] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.521] GetProcessHeap () returned 0xfd0000 [0161.521] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.521] GetProcessHeap () returned 0xfd0000 [0161.521] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.522] GetProcessHeap () returned 0xfd0000 [0161.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.522] GetProcessHeap () returned 0xfd0000 [0161.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.522] GetProcessHeap () returned 0xfd0000 [0161.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.522] GetProcessHeap () returned 0xfd0000 [0161.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.523] GetProcessHeap () returned 0xfd0000 [0161.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.523] GetProcessHeap () returned 0xfd0000 [0161.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.524] GetProcessHeap () returned 0xfd0000 [0161.524] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.524] GetProcessHeap () returned 0xfd0000 [0161.524] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.530] GetProcessHeap () returned 0xfd0000 [0161.530] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.530] GetProcessHeap () returned 0xfd0000 [0161.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.530] GetProcessHeap () returned 0xfd0000 [0161.530] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.530] GetProcessHeap () returned 0xfd0000 [0161.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.531] GetProcessHeap () returned 0xfd0000 [0161.531] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.531] GetProcessHeap () returned 0xfd0000 [0161.531] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.532] GetProcessHeap () returned 0xfd0000 [0161.532] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.532] GetProcessHeap () returned 0xfd0000 [0161.532] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.534] GetProcessHeap () returned 0xfd0000 [0161.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.534] GetProcessHeap () returned 0xfd0000 [0161.534] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.534] GetProcessHeap () returned 0xfd0000 [0161.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.534] GetProcessHeap () returned 0xfd0000 [0161.534] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.535] GetProcessHeap () returned 0xfd0000 [0161.535] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.535] GetProcessHeap () returned 0xfd0000 [0161.535] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.536] GetProcessHeap () returned 0xfd0000 [0161.536] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.536] GetProcessHeap () returned 0xfd0000 [0161.536] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.536] GetProcessHeap () returned 0xfd0000 [0161.536] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.536] GetProcessHeap () returned 0xfd0000 [0161.536] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.537] GetProcessHeap () returned 0xfd0000 [0161.537] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.537] GetProcessHeap () returned 0xfd0000 [0161.537] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.538] GetProcessHeap () returned 0xfd0000 [0161.538] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.538] GetProcessHeap () returned 0xfd0000 [0161.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.538] GetProcessHeap () returned 0xfd0000 [0161.538] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.538] GetProcessHeap () returned 0xfd0000 [0161.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.539] GetProcessHeap () returned 0xfd0000 [0161.539] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.539] GetProcessHeap () returned 0xfd0000 [0161.539] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.539] GetProcessHeap () returned 0xfd0000 [0161.539] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.539] GetProcessHeap () returned 0xfd0000 [0161.539] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.540] GetProcessHeap () returned 0xfd0000 [0161.540] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.540] GetProcessHeap () returned 0xfd0000 [0161.540] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.541] GetProcessHeap () returned 0xfd0000 [0161.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.541] GetProcessHeap () returned 0xfd0000 [0161.541] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.542] GetProcessHeap () returned 0xfd0000 [0161.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.542] GetProcessHeap () returned 0xfd0000 [0161.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.542] GetProcessHeap () returned 0xfd0000 [0161.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.542] GetProcessHeap () returned 0xfd0000 [0161.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.542] GetProcessHeap () returned 0xfd0000 [0161.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.543] GetProcessHeap () returned 0xfd0000 [0161.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.543] GetProcessHeap () returned 0xfd0000 [0161.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.543] GetProcessHeap () returned 0xfd0000 [0161.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.543] GetProcessHeap () returned 0xfd0000 [0161.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.543] GetProcessHeap () returned 0xfd0000 [0161.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.544] GetProcessHeap () returned 0xfd0000 [0161.544] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.544] GetProcessHeap () returned 0xfd0000 [0161.544] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.544] GetProcessHeap () returned 0xfd0000 [0161.544] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.545] GetProcessHeap () returned 0xfd0000 [0161.545] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0161.545] GetProcessHeap () returned 0xfd0000 [0161.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0161.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.546] GetProcessHeap () returned 0xfd0000 [0161.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.547] GetProcessHeap () returned 0xfd0000 [0161.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.547] GetProcessHeap () returned 0xfd0000 [0161.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account-select\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.717] GetProcessHeap () returned 0xfd0000 [0161.717] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.718] GetProcessHeap () returned 0xfd0000 [0161.718] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0161.720] GetProcessHeap () returned 0xfd0000 [0161.720] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0161.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.728] GetProcessHeap () returned 0xfd0000 [0161.728] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.729] GetProcessHeap () returned 0xfd0000 [0161.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.729] GetProcessHeap () returned 0xfd0000 [0161.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.731] GetProcessHeap () returned 0xfd0000 [0161.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd8802e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.732] GetProcessHeap () returned 0xfd0000 [0161.732] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0161.735] GetProcessHeap () returned 0xfd0000 [0161.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.735] GetProcessHeap () returned 0xfd0000 [0161.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.735] GetProcessHeap () returned 0xfd0000 [0161.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.736] GetProcessHeap () returned 0xfd0000 [0161.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.737] GetProcessHeap () returned 0xfd0000 [0161.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0161.752] GetProcessHeap () returned 0xfd0000 [0161.752] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.753] GetProcessHeap () returned 0xfd0000 [0161.753] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.753] GetProcessHeap () returned 0xfd0000 [0161.753] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.754] GetProcessHeap () returned 0xfd0000 [0161.754] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.754] GetProcessHeap () returned 0xfd0000 [0161.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.755] GetProcessHeap () returned 0xfd0000 [0161.755] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.755] GetProcessHeap () returned 0xfd0000 [0161.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.756] GetProcessHeap () returned 0xfd0000 [0161.756] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.756] GetProcessHeap () returned 0xfd0000 [0161.756] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.762] GetProcessHeap () returned 0xfd0000 [0161.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.762] GetProcessHeap () returned 0xfd0000 [0161.762] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.763] GetProcessHeap () returned 0xfd0000 [0161.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.763] GetProcessHeap () returned 0xfd0000 [0161.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.763] GetProcessHeap () returned 0xfd0000 [0161.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.763] GetProcessHeap () returned 0xfd0000 [0161.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0161.764] GetProcessHeap () returned 0xfd0000 [0161.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.764] GetProcessHeap () returned 0xfd0000 [0161.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.765] GetProcessHeap () returned 0xfd0000 [0161.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.765] GetProcessHeap () returned 0xfd0000 [0161.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.765] GetProcessHeap () returned 0xfd0000 [0161.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.765] GetProcessHeap () returned 0xfd0000 [0161.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.941] GetProcessHeap () returned 0xfd0000 [0161.941] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.941] GetProcessHeap () returned 0xfd0000 [0161.941] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.941] GetProcessHeap () returned 0xfd0000 [0161.941] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.942] GetProcessHeap () returned 0xfd0000 [0161.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.942] GetProcessHeap () returned 0xfd0000 [0161.942] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.942] GetProcessHeap () returned 0xfd0000 [0161.942] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.942] GetProcessHeap () returned 0xfd0000 [0161.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.944] GetProcessHeap () returned 0xfd0000 [0161.944] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefedf550, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefedf550, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff77e79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.948] GetProcessHeap () returned 0xfd0000 [0161.948] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.948] GetProcessHeap () returned 0xfd0000 [0161.948] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.949] GetProcessHeap () returned 0xfd0000 [0161.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0161.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\cpdf\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.952] GetProcessHeap () returned 0xfd0000 [0161.952] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0161.952] GetProcessHeap () returned 0xfd0000 [0161.952] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0161.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\selection-action-plugins\\epdf\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0161.952] GetProcessHeap () returned 0xfd0000 [0161.952] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0161.952] GetProcessHeap () returned 0xfd0000 [0161.952] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.952] GetProcessHeap () returned 0xfd0000 [0161.952] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.953] GetProcessHeap () returned 0xfd0000 [0161.953] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.954] GetProcessHeap () returned 0xfd0000 [0161.954] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0161.954] GetProcessHeap () returned 0xfd0000 [0161.954] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0161.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0161.956] GetProcessHeap () returned 0xfd0000 [0161.956] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.957] GetProcessHeap () returned 0xfd0000 [0161.957] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.957] GetProcessHeap () returned 0xfd0000 [0161.957] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.959] GetProcessHeap () returned 0xfd0000 [0161.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.960] GetProcessHeap () returned 0xfd0000 [0161.960] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.963] GetProcessHeap () returned 0xfd0000 [0161.963] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.963] GetProcessHeap () returned 0xfd0000 [0161.963] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0161.963] GetProcessHeap () returned 0xfd0000 [0161.963] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0161.963] GetProcessHeap () returned 0xfd0000 [0161.963] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0161.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0161.964] GetProcessHeap () returned 0xfd0000 [0161.964] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0161.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0161.966] GetProcessHeap () returned 0xfd0000 [0161.966] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.967] GetProcessHeap () returned 0xfd0000 [0161.967] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.967] GetProcessHeap () returned 0xfd0000 [0161.967] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.968] GetProcessHeap () returned 0xfd0000 [0161.968] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.968] GetProcessHeap () returned 0xfd0000 [0161.968] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0161.968] GetProcessHeap () returned 0xfd0000 [0161.969] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.969] GetProcessHeap () returned 0xfd0000 [0161.969] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.969] GetProcessHeap () returned 0xfd0000 [0161.969] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.969] GetProcessHeap () returned 0xfd0000 [0161.969] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.970] GetProcessHeap () returned 0xfd0000 [0161.970] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.970] GetProcessHeap () returned 0xfd0000 [0161.970] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.971] GetProcessHeap () returned 0xfd0000 [0161.971] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.971] GetProcessHeap () returned 0xfd0000 [0161.971] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.972] GetProcessHeap () returned 0xfd0000 [0161.972] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.972] GetProcessHeap () returned 0xfd0000 [0161.972] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.972] GetProcessHeap () returned 0xfd0000 [0161.972] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.972] GetProcessHeap () returned 0xfd0000 [0161.972] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.973] GetProcessHeap () returned 0xfd0000 [0161.973] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.973] GetProcessHeap () returned 0xfd0000 [0161.973] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.974] GetProcessHeap () returned 0xfd0000 [0161.974] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.974] GetProcessHeap () returned 0xfd0000 [0161.974] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.974] GetProcessHeap () returned 0xfd0000 [0161.974] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.974] GetProcessHeap () returned 0xfd0000 [0161.974] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0161.975] GetProcessHeap () returned 0xfd0000 [0161.975] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.975] GetProcessHeap () returned 0xfd0000 [0161.975] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.976] GetProcessHeap () returned 0xfd0000 [0161.976] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.976] GetProcessHeap () returned 0xfd0000 [0161.976] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.976] GetProcessHeap () returned 0xfd0000 [0161.976] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.976] GetProcessHeap () returned 0xfd0000 [0161.976] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.977] GetProcessHeap () returned 0xfd0000 [0161.977] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.977] GetProcessHeap () returned 0xfd0000 [0161.977] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.978] GetProcessHeap () returned 0xfd0000 [0161.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.978] GetProcessHeap () returned 0xfd0000 [0161.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0161.978] GetProcessHeap () returned 0xfd0000 [0161.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.978] GetProcessHeap () returned 0xfd0000 [0161.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0161.979] GetProcessHeap () returned 0xfd0000 [0161.979] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.979] GetProcessHeap () returned 0xfd0000 [0161.979] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0161.980] GetProcessHeap () returned 0xfd0000 [0161.980] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0161.980] GetProcessHeap () returned 0xfd0000 [0161.980] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0161.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.261] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.261] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.261] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.261] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.266] GetProcessHeap () returned 0xfd0000 [0162.266] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.266] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0162.267] GetProcessHeap () returned 0xfd0000 [0162.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.283] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.283] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.283] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.283] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0162.283] GetProcessHeap () returned 0xfd0000 [0162.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.283] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0162.283] GetProcessHeap () returned 0xfd0000 [0162.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0162.284] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.284] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.284] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.284] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0162.284] GetProcessHeap () returned 0xfd0000 [0162.284] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.284] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0162.284] GetProcessHeap () returned 0xfd0000 [0162.284] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.285] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.285] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.285] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x465, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.285] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.285] GetProcessHeap () returned 0xfd0000 [0162.285] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.285] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0162.285] GetProcessHeap () returned 0xfd0000 [0162.285] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.286] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.286] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.286] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.286] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.286] GetProcessHeap () returned 0xfd0000 [0162.286] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.286] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0162.286] GetProcessHeap () returned 0xfd0000 [0162.286] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.287] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.287] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.287] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.287] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.287] GetProcessHeap () returned 0xfd0000 [0162.287] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.287] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0162.287] GetProcessHeap () returned 0xfd0000 [0162.287] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.288] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.288] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.288] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.288] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.288] GetProcessHeap () returned 0xfd0000 [0162.288] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.288] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0162.288] GetProcessHeap () returned 0xfd0000 [0162.288] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.289] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.289] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.289] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.289] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0162.289] GetProcessHeap () returned 0xfd0000 [0162.289] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.289] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0162.289] GetProcessHeap () returned 0xfd0000 [0162.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.290] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.290] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.290] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.290] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.290] GetProcessHeap () returned 0xfd0000 [0162.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.290] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0162.290] GetProcessHeap () returned 0xfd0000 [0162.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.291] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.291] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.291] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0162.291] GetProcessHeap () returned 0xfd0000 [0162.291] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.291] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0162.291] GetProcessHeap () returned 0xfd0000 [0162.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0162.291] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.291] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.291] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.291] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0162.292] GetProcessHeap () returned 0xfd0000 [0162.292] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.292] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0162.292] GetProcessHeap () returned 0xfd0000 [0162.292] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.292] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.292] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.292] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.292] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.292] GetProcessHeap () returned 0xfd0000 [0162.292] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.292] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.292] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0162.292] GetProcessHeap () returned 0xfd0000 [0162.292] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.293] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.293] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.293] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.293] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.293] GetProcessHeap () returned 0xfd0000 [0162.293] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.293] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0162.294] GetProcessHeap () returned 0xfd0000 [0162.294] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.294] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.294] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.294] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.295] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.295] GetProcessHeap () returned 0xfd0000 [0162.295] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.295] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0162.295] GetProcessHeap () returned 0xfd0000 [0162.295] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0162.295] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.296] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.296] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.296] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0162.296] GetProcessHeap () returned 0xfd0000 [0162.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.296] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0162.296] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.296] GetProcessHeap () returned 0xfd0000 [0162.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0162.296] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0162.296] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0162.296] GetProcessHeap () returned 0xfd0000 [0162.296] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0162.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.297] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.297] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0162.297] GetProcessHeap () returned 0xfd0000 [0162.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0162.297] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.297] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="combinepdf-selector.js", cAlternateFileName="COMBIN~1.JS")) returned 1 [0162.297] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2616, dwReserved0=0x0, dwReserved1=0x0, cFileName="combinepdf-tool-view.js", cAlternateFileName="COMBIN~2.JS")) returned 1 [0162.297] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2616, dwReserved0=0x0, dwReserved1=0x0, cFileName="combinepdf-tool-view.js", cAlternateFileName="COMBIN~2.JS")) returned 0 [0162.298] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.298] GetProcessHeap () returned 0xfd0000 [0162.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.298] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0162.298] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0162.298] GetProcessHeap () returned 0xfd0000 [0162.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0162.298] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0162.298] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0162.298] GetProcessHeap () returned 0xfd0000 [0162.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.299] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0162.299] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0162.299] GetProcessHeap () returned 0xfd0000 [0162.299] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0162.300] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0162.300] GetProcessHeap () returned 0xfd0000 [0162.300] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0162.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.300] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.300] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0162.300] GetProcessHeap () returned 0xfd0000 [0162.300] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.301] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.301] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0162.301] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0162.301] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0162.301] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.302] GetProcessHeap () returned 0xfd0000 [0162.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.302] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0162.302] GetProcessHeap () returned 0xfd0000 [0162.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0162.303] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0162.303] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0162.304] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0162.304] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0162.304] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0162.304] GetProcessHeap () returned 0xfd0000 [0162.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0162.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.304] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.305] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0162.305] GetProcessHeap () returned 0xfd0000 [0162.305] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0162.306] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.306] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0162.306] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0162.307] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon.png", cAlternateFileName="RHP_WO~2.PNG")) returned 1 [0162.307] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_2x.png", cAlternateFileName="RHP_WO~3.PNG")) returned 1 [0162.307] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_hover.png", cAlternateFileName="RHP_WO~4.PNG")) returned 1 [0162.307] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 1 [0162.307] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp_world_icon_hover_2x.png", cAlternateFileName="RHP_WO~1.PNG")) returned 0 [0162.307] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0162.308] GetProcessHeap () returned 0xfd0000 [0162.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.308] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0162.308] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0162.308] GetProcessHeap () returned 0xfd0000 [0162.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0162.308] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0162.308] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0162.308] GetProcessHeap () returned 0xfd0000 [0162.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.309] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0162.309] GetProcessHeap () returned 0xfd0000 [0162.309] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.311] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.311] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0162.311] GetProcessHeap () returned 0xfd0000 [0162.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0162.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.313] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.313] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0162.313] GetProcessHeap () returned 0xfd0000 [0162.313] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0162.314] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.314] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.315] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.315] GetProcessHeap () returned 0xfd0000 [0162.315] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.315] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0162.315] GetProcessHeap () returned 0xfd0000 [0162.315] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.316] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.316] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.316] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.316] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.316] GetProcessHeap () returned 0xfd0000 [0162.316] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.316] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0162.316] GetProcessHeap () returned 0xfd0000 [0162.316] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0162.498] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.498] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.504] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.504] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0162.515] GetProcessHeap () returned 0xfd0000 [0162.515] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.516] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0162.516] GetProcessHeap () returned 0xfd0000 [0162.516] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0162.527] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.527] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.527] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.527] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0162.527] GetProcessHeap () returned 0xfd0000 [0162.527] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.527] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0162.527] GetProcessHeap () returned 0xfd0000 [0162.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0162.528] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.528] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.528] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.528] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.528] GetProcessHeap () returned 0xfd0000 [0162.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.528] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0162.529] GetProcessHeap () returned 0xfd0000 [0162.529] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.529] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.529] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.529] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.529] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.530] GetProcessHeap () returned 0xfd0000 [0162.530] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.530] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0162.530] GetProcessHeap () returned 0xfd0000 [0162.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.530] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.530] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.530] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.530] GetProcessHeap () returned 0xfd0000 [0162.530] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.530] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0162.530] GetProcessHeap () returned 0xfd0000 [0162.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0162.531] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.531] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.531] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.531] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0162.531] GetProcessHeap () returned 0xfd0000 [0162.531] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.531] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0162.532] GetProcessHeap () returned 0xfd0000 [0162.532] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.532] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.532] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.532] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.532] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.532] GetProcessHeap () returned 0xfd0000 [0162.532] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.532] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0162.532] GetProcessHeap () returned 0xfd0000 [0162.532] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.533] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.533] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.533] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.533] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.533] GetProcessHeap () returned 0xfd0000 [0162.533] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.533] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0162.533] GetProcessHeap () returned 0xfd0000 [0162.533] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.534] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.534] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.534] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.534] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.534] GetProcessHeap () returned 0xfd0000 [0162.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.534] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0162.535] GetProcessHeap () returned 0xfd0000 [0162.535] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.535] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.535] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.535] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.535] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.536] GetProcessHeap () returned 0xfd0000 [0162.536] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.536] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0162.536] GetProcessHeap () returned 0xfd0000 [0162.536] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.536] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.537] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.537] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.537] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.537] GetProcessHeap () returned 0xfd0000 [0162.537] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.537] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0162.537] GetProcessHeap () returned 0xfd0000 [0162.537] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.538] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.538] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.538] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.538] GetProcessHeap () returned 0xfd0000 [0162.538] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.538] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0162.538] GetProcessHeap () returned 0xfd0000 [0162.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.538] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.538] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.538] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.538] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.539] GetProcessHeap () returned 0xfd0000 [0162.539] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.539] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0162.539] GetProcessHeap () returned 0xfd0000 [0162.539] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.539] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.539] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.539] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.540] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.540] GetProcessHeap () returned 0xfd0000 [0162.540] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.540] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0162.540] GetProcessHeap () returned 0xfd0000 [0162.540] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.540] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.540] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.540] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.540] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.541] GetProcessHeap () returned 0xfd0000 [0162.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.542] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0162.542] GetProcessHeap () returned 0xfd0000 [0162.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.542] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.542] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.542] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.542] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.542] GetProcessHeap () returned 0xfd0000 [0162.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.542] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0162.542] GetProcessHeap () returned 0xfd0000 [0162.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.543] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.543] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.543] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.543] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.543] GetProcessHeap () returned 0xfd0000 [0162.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.543] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0162.543] GetProcessHeap () returned 0xfd0000 [0162.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0162.544] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.544] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.544] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.544] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.544] GetProcessHeap () returned 0xfd0000 [0162.544] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.544] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0162.544] GetProcessHeap () returned 0xfd0000 [0162.544] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.544] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.545] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.545] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.545] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.545] GetProcessHeap () returned 0xfd0000 [0162.545] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.545] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0162.545] GetProcessHeap () returned 0xfd0000 [0162.545] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.545] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.545] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.545] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.545] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.545] GetProcessHeap () returned 0xfd0000 [0162.546] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.546] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0162.546] GetProcessHeap () returned 0xfd0000 [0162.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.546] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.546] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.546] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.547] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.547] GetProcessHeap () returned 0xfd0000 [0162.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.547] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0162.547] GetProcessHeap () returned 0xfd0000 [0162.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.547] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.548] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.548] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.548] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.548] GetProcessHeap () returned 0xfd0000 [0162.548] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.548] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0162.548] GetProcessHeap () returned 0xfd0000 [0162.548] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.548] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.548] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.548] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.548] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.548] GetProcessHeap () returned 0xfd0000 [0162.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.549] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0162.549] GetProcessHeap () returned 0xfd0000 [0162.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0162.549] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.549] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.549] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.549] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.549] GetProcessHeap () returned 0xfd0000 [0162.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.549] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0162.549] GetProcessHeap () returned 0xfd0000 [0162.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.550] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.550] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.550] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.550] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.550] GetProcessHeap () returned 0xfd0000 [0162.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.550] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0162.550] GetProcessHeap () returned 0xfd0000 [0162.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.551] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.551] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.551] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.551] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.551] GetProcessHeap () returned 0xfd0000 [0162.551] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.551] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0162.551] GetProcessHeap () returned 0xfd0000 [0162.551] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.552] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.552] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.552] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.552] GetProcessHeap () returned 0xfd0000 [0162.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.552] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0162.552] GetProcessHeap () returned 0xfd0000 [0162.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.552] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.552] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.552] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.553] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.553] GetProcessHeap () returned 0xfd0000 [0162.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.553] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0162.553] GetProcessHeap () returned 0xfd0000 [0162.553] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0162.553] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.553] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.553] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.553] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0162.553] GetProcessHeap () returned 0xfd0000 [0162.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.554] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.554] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0162.554] GetProcessHeap () returned 0xfd0000 [0162.554] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.554] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.554] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.554] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.554] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.554] GetProcessHeap () returned 0xfd0000 [0162.554] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.554] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0162.554] GetProcessHeap () returned 0xfd0000 [0162.554] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.555] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.555] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.555] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.555] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0162.555] GetProcessHeap () returned 0xfd0000 [0162.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.555] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0162.555] GetProcessHeap () returned 0xfd0000 [0162.555] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0162.555] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.556] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0162.556] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0162.556] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0162.556] GetProcessHeap () returned 0xfd0000 [0162.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.556] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0162.556] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0162.556] GetProcessHeap () returned 0xfd0000 [0162.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0162.556] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0162.556] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0162.556] GetProcessHeap () returned 0xfd0000 [0162.556] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0162.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0162.557] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.557] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0162.557] GetProcessHeap () returned 0xfd0000 [0162.557] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.558] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.558] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xf7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="createpdfupsell-app-selector.js", cAlternateFileName="CREATE~2.JS")) returned 1 [0162.558] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2771, dwReserved0=0x0, dwReserved1=0x0, cFileName="createpdfupsell-app-tool-view.js", cAlternateFileName="CREATE~1.JS")) returned 1 [0162.558] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2771, dwReserved0=0x0, dwReserved1=0x0, cFileName="createpdfupsell-app-tool-view.js", cAlternateFileName="CREATE~1.JS")) returned 0 [0162.558] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0162.558] GetProcessHeap () returned 0xfd0000 [0162.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.558] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0162.558] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0162.558] GetProcessHeap () returned 0xfd0000 [0162.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0162.558] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0162.558] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0162.558] GetProcessHeap () returned 0xfd0000 [0162.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.559] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0162.559] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0162.559] GetProcessHeap () returned 0xfd0000 [0162.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0162.560] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1 [0162.560] GetProcessHeap () returned 0xfd0000 [0162.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0162.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.771] GetProcessHeap () returned 0xfd0000 [0162.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.772] GetProcessHeap () returned 0xfd0000 [0162.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.772] GetProcessHeap () returned 0xfd0000 [0162.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\dc-annotations\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.773] GetProcessHeap () returned 0xfd0000 [0162.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.773] GetProcessHeap () returned 0xfd0000 [0162.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0162.773] GetProcessHeap () returned 0xfd0000 [0162.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0162.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0162.774] GetProcessHeap () returned 0xfd0000 [0162.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.775] GetProcessHeap () returned 0xfd0000 [0162.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0162.775] GetProcessHeap () returned 0xfd0000 [0162.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0162.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0162.776] GetProcessHeap () returned 0xfd0000 [0162.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0162.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0162.778] GetProcessHeap () returned 0xfd0000 [0162.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.779] GetProcessHeap () returned 0xfd0000 [0162.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.779] GetProcessHeap () returned 0xfd0000 [0162.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.780] GetProcessHeap () returned 0xfd0000 [0162.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.780] GetProcessHeap () returned 0xfd0000 [0162.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.781] GetProcessHeap () returned 0xfd0000 [0162.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.781] GetProcessHeap () returned 0xfd0000 [0162.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.782] GetProcessHeap () returned 0xfd0000 [0162.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.782] GetProcessHeap () returned 0xfd0000 [0162.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.783] GetProcessHeap () returned 0xfd0000 [0162.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.783] GetProcessHeap () returned 0xfd0000 [0162.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.784] GetProcessHeap () returned 0xfd0000 [0162.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.784] GetProcessHeap () returned 0xfd0000 [0162.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.784] GetProcessHeap () returned 0xfd0000 [0162.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.785] GetProcessHeap () returned 0xfd0000 [0162.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0162.786] GetProcessHeap () returned 0xfd0000 [0162.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.786] GetProcessHeap () returned 0xfd0000 [0162.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.786] GetProcessHeap () returned 0xfd0000 [0162.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.786] GetProcessHeap () returned 0xfd0000 [0162.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.787] GetProcessHeap () returned 0xfd0000 [0162.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.787] GetProcessHeap () returned 0xfd0000 [0162.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.787] GetProcessHeap () returned 0xfd0000 [0162.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.788] GetProcessHeap () returned 0xfd0000 [0162.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.788] GetProcessHeap () returned 0xfd0000 [0162.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.789] GetProcessHeap () returned 0xfd0000 [0162.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.789] GetProcessHeap () returned 0xfd0000 [0162.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.789] GetProcessHeap () returned 0xfd0000 [0162.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0162.790] GetProcessHeap () returned 0xfd0000 [0162.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.790] GetProcessHeap () returned 0xfd0000 [0162.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.794] GetProcessHeap () returned 0xfd0000 [0162.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.794] GetProcessHeap () returned 0xfd0000 [0162.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.794] GetProcessHeap () returned 0xfd0000 [0162.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.794] GetProcessHeap () returned 0xfd0000 [0162.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.795] GetProcessHeap () returned 0xfd0000 [0162.795] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.795] GetProcessHeap () returned 0xfd0000 [0162.795] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.796] GetProcessHeap () returned 0xfd0000 [0162.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.796] GetProcessHeap () returned 0xfd0000 [0162.796] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.797] GetProcessHeap () returned 0xfd0000 [0162.797] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.797] GetProcessHeap () returned 0xfd0000 [0162.797] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.798] GetProcessHeap () returned 0xfd0000 [0162.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.798] GetProcessHeap () returned 0xfd0000 [0162.798] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.798] GetProcessHeap () returned 0xfd0000 [0162.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.799] GetProcessHeap () returned 0xfd0000 [0162.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.800] GetProcessHeap () returned 0xfd0000 [0162.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.801] GetProcessHeap () returned 0xfd0000 [0162.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.801] GetProcessHeap () returned 0xfd0000 [0162.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.802] GetProcessHeap () returned 0xfd0000 [0162.802] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.802] GetProcessHeap () returned 0xfd0000 [0162.802] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.802] GetProcessHeap () returned 0xfd0000 [0162.802] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.803] GetProcessHeap () returned 0xfd0000 [0162.803] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.803] GetProcessHeap () returned 0xfd0000 [0162.803] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0162.803] GetProcessHeap () returned 0xfd0000 [0162.803] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.803] GetProcessHeap () returned 0xfd0000 [0162.803] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0162.804] GetProcessHeap () returned 0xfd0000 [0162.804] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.804] GetProcessHeap () returned 0xfd0000 [0162.804] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0162.805] GetProcessHeap () returned 0xfd0000 [0162.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.805] GetProcessHeap () returned 0xfd0000 [0162.805] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0162.806] GetProcessHeap () returned 0xfd0000 [0162.806] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.806] GetProcessHeap () returned 0xfd0000 [0162.806] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.809] GetProcessHeap () returned 0xfd0000 [0162.809] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.809] GetProcessHeap () returned 0xfd0000 [0162.809] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0162.810] GetProcessHeap () returned 0xfd0000 [0162.810] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0162.810] GetProcessHeap () returned 0xfd0000 [0162.810] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0162.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.047] GetProcessHeap () returned 0xfd0000 [0163.047] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.048] GetProcessHeap () returned 0xfd0000 [0163.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0163.049] GetProcessHeap () returned 0xfd0000 [0163.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.049] GetProcessHeap () returned 0xfd0000 [0163.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.049] GetProcessHeap () returned 0xfd0000 [0163.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.049] GetProcessHeap () returned 0xfd0000 [0163.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.049] GetProcessHeap () returned 0xfd0000 [0163.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.050] GetProcessHeap () returned 0xfd0000 [0163.050] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.051] GetProcessHeap () returned 0xfd0000 [0163.051] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.055] GetProcessHeap () returned 0xfd0000 [0163.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.056] GetProcessHeap () returned 0xfd0000 [0163.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.056] GetProcessHeap () returned 0xfd0000 [0163.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.057] GetProcessHeap () returned 0xfd0000 [0163.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.057] GetProcessHeap () returned 0xfd0000 [0163.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.057] GetProcessHeap () returned 0xfd0000 [0163.057] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.064] GetProcessHeap () returned 0xfd0000 [0163.064] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.065] GetProcessHeap () returned 0xfd0000 [0163.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.065] GetProcessHeap () returned 0xfd0000 [0163.065] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.066] GetProcessHeap () returned 0xfd0000 [0163.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.066] GetProcessHeap () returned 0xfd0000 [0163.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.067] GetProcessHeap () returned 0xfd0000 [0163.067] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.067] GetProcessHeap () returned 0xfd0000 [0163.067] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.067] GetProcessHeap () returned 0xfd0000 [0163.067] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.068] GetProcessHeap () returned 0xfd0000 [0163.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0163.069] GetProcessHeap () returned 0xfd0000 [0163.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.072] GetProcessHeap () returned 0xfd0000 [0163.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.073] GetProcessHeap () returned 0xfd0000 [0163.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.073] GetProcessHeap () returned 0xfd0000 [0163.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.073] GetProcessHeap () returned 0xfd0000 [0163.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.073] GetProcessHeap () returned 0xfd0000 [0163.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.074] GetProcessHeap () returned 0xfd0000 [0163.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.074] GetProcessHeap () returned 0xfd0000 [0163.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.074] GetProcessHeap () returned 0xfd0000 [0163.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.074] GetProcessHeap () returned 0xfd0000 [0163.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.075] GetProcessHeap () returned 0xfd0000 [0163.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.075] GetProcessHeap () returned 0xfd0000 [0163.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.076] GetProcessHeap () returned 0xfd0000 [0163.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.076] GetProcessHeap () returned 0xfd0000 [0163.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.077] GetProcessHeap () returned 0xfd0000 [0163.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.077] GetProcessHeap () returned 0xfd0000 [0163.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.078] GetProcessHeap () returned 0xfd0000 [0163.078] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.078] GetProcessHeap () returned 0xfd0000 [0163.078] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.078] GetProcessHeap () returned 0xfd0000 [0163.078] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.078] GetProcessHeap () returned 0xfd0000 [0163.078] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.079] GetProcessHeap () returned 0xfd0000 [0163.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.079] GetProcessHeap () returned 0xfd0000 [0163.079] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0163.080] GetProcessHeap () returned 0xfd0000 [0163.080] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.080] GetProcessHeap () returned 0xfd0000 [0163.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.081] GetProcessHeap () returned 0xfd0000 [0163.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.081] GetProcessHeap () returned 0xfd0000 [0163.081] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.081] GetProcessHeap () returned 0xfd0000 [0163.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.082] GetProcessHeap () returned 0xfd0000 [0163.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.082] GetProcessHeap () returned 0xfd0000 [0163.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.082] GetProcessHeap () returned 0xfd0000 [0163.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.082] GetProcessHeap () returned 0xfd0000 [0163.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.082] GetProcessHeap () returned 0xfd0000 [0163.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0163.187] GetProcessHeap () returned 0xfd0000 [0163.187] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.187] GetProcessHeap () returned 0xfd0000 [0163.187] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.188] GetProcessHeap () returned 0xfd0000 [0163.188] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.188] GetProcessHeap () returned 0xfd0000 [0163.188] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.189] GetProcessHeap () returned 0xfd0000 [0163.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.189] GetProcessHeap () returned 0xfd0000 [0163.189] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.190] GetProcessHeap () returned 0xfd0000 [0163.190] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.190] GetProcessHeap () returned 0xfd0000 [0163.190] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.190] GetProcessHeap () returned 0xfd0000 [0163.190] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.190] GetProcessHeap () returned 0xfd0000 [0163.190] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0163.191] GetProcessHeap () returned 0xfd0000 [0163.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.191] GetProcessHeap () returned 0xfd0000 [0163.191] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.191] GetProcessHeap () returned 0xfd0000 [0163.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.191] GetProcessHeap () returned 0xfd0000 [0163.191] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.195] GetProcessHeap () returned 0xfd0000 [0163.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.195] GetProcessHeap () returned 0xfd0000 [0163.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.195] GetProcessHeap () returned 0xfd0000 [0163.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.196] GetProcessHeap () returned 0xfd0000 [0163.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.196] GetProcessHeap () returned 0xfd0000 [0163.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.196] GetProcessHeap () returned 0xfd0000 [0163.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.197] GetProcessHeap () returned 0xfd0000 [0163.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.197] GetProcessHeap () returned 0xfd0000 [0163.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.198] GetProcessHeap () returned 0xfd0000 [0163.198] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.198] GetProcessHeap () returned 0xfd0000 [0163.198] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.198] GetProcessHeap () returned 0xfd0000 [0163.198] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.198] GetProcessHeap () returned 0xfd0000 [0163.198] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.198] GetProcessHeap () returned 0xfd0000 [0163.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.199] GetProcessHeap () returned 0xfd0000 [0163.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.199] GetProcessHeap () returned 0xfd0000 [0163.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.199] GetProcessHeap () returned 0xfd0000 [0163.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.199] GetProcessHeap () returned 0xfd0000 [0163.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.199] GetProcessHeap () returned 0xfd0000 [0163.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.200] GetProcessHeap () returned 0xfd0000 [0163.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.200] GetProcessHeap () returned 0xfd0000 [0163.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.200] GetProcessHeap () returned 0xfd0000 [0163.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.200] GetProcessHeap () returned 0xfd0000 [0163.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\digsig\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.201] GetProcessHeap () returned 0xfd0000 [0163.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.201] GetProcessHeap () returned 0xfd0000 [0163.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.201] GetProcessHeap () returned 0xfd0000 [0163.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.202] GetProcessHeap () returned 0xfd0000 [0163.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.202] GetProcessHeap () returned 0xfd0000 [0163.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.203] GetProcessHeap () returned 0xfd0000 [0163.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.224] GetProcessHeap () returned 0xfd0000 [0163.224] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.224] GetProcessHeap () returned 0xfd0000 [0163.224] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.225] GetProcessHeap () returned 0xfd0000 [0163.225] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.226] GetProcessHeap () returned 0xfd0000 [0163.226] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.241] GetProcessHeap () returned 0xfd0000 [0163.241] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.242] GetProcessHeap () returned 0xfd0000 [0163.242] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.242] GetProcessHeap () returned 0xfd0000 [0163.242] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.243] GetProcessHeap () returned 0xfd0000 [0163.243] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.244] GetProcessHeap () returned 0xfd0000 [0163.244] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.246] GetProcessHeap () returned 0xfd0000 [0163.246] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.249] GetProcessHeap () returned 0xfd0000 [0163.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.249] GetProcessHeap () returned 0xfd0000 [0163.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.250] GetProcessHeap () returned 0xfd0000 [0163.250] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.250] GetProcessHeap () returned 0xfd0000 [0163.250] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.251] GetProcessHeap () returned 0xfd0000 [0163.251] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.251] GetProcessHeap () returned 0xfd0000 [0163.251] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.253] GetProcessHeap () returned 0xfd0000 [0163.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.253] GetProcessHeap () returned 0xfd0000 [0163.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.254] GetProcessHeap () returned 0xfd0000 [0163.254] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.254] GetProcessHeap () returned 0xfd0000 [0163.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.255] GetProcessHeap () returned 0xfd0000 [0163.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.255] GetProcessHeap () returned 0xfd0000 [0163.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.255] GetProcessHeap () returned 0xfd0000 [0163.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.255] GetProcessHeap () returned 0xfd0000 [0163.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.257] GetProcessHeap () returned 0xfd0000 [0163.257] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.257] GetProcessHeap () returned 0xfd0000 [0163.257] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.258] GetProcessHeap () returned 0xfd0000 [0163.258] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.258] GetProcessHeap () returned 0xfd0000 [0163.258] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.259] GetProcessHeap () returned 0xfd0000 [0163.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.259] GetProcessHeap () returned 0xfd0000 [0163.259] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.260] GetProcessHeap () returned 0xfd0000 [0163.260] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.260] GetProcessHeap () returned 0xfd0000 [0163.260] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.296] GetProcessHeap () returned 0xfd0000 [0163.296] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.296] GetProcessHeap () returned 0xfd0000 [0163.296] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.297] GetProcessHeap () returned 0xfd0000 [0163.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.297] GetProcessHeap () returned 0xfd0000 [0163.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.298] GetProcessHeap () returned 0xfd0000 [0163.298] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.298] GetProcessHeap () returned 0xfd0000 [0163.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.299] GetProcessHeap () returned 0xfd0000 [0163.299] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.299] GetProcessHeap () returned 0xfd0000 [0163.299] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.300] GetProcessHeap () returned 0xfd0000 [0163.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.300] GetProcessHeap () returned 0xfd0000 [0163.300] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.300] GetProcessHeap () returned 0xfd0000 [0163.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.301] GetProcessHeap () returned 0xfd0000 [0163.301] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.301] GetProcessHeap () returned 0xfd0000 [0163.301] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.301] GetProcessHeap () returned 0xfd0000 [0163.301] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.303] GetProcessHeap () returned 0xfd0000 [0163.303] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.303] GetProcessHeap () returned 0xfd0000 [0163.303] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.304] GetProcessHeap () returned 0xfd0000 [0163.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.304] GetProcessHeap () returned 0xfd0000 [0163.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.304] GetProcessHeap () returned 0xfd0000 [0163.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.304] GetProcessHeap () returned 0xfd0000 [0163.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.305] GetProcessHeap () returned 0xfd0000 [0163.305] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.305] GetProcessHeap () returned 0xfd0000 [0163.305] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.306] GetProcessHeap () returned 0xfd0000 [0163.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.306] GetProcessHeap () returned 0xfd0000 [0163.306] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.307] GetProcessHeap () returned 0xfd0000 [0163.307] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.307] GetProcessHeap () returned 0xfd0000 [0163.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.307] GetProcessHeap () returned 0xfd0000 [0163.307] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.307] GetProcessHeap () returned 0xfd0000 [0163.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.308] GetProcessHeap () returned 0xfd0000 [0163.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.308] GetProcessHeap () returned 0xfd0000 [0163.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.309] GetProcessHeap () returned 0xfd0000 [0163.309] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.309] GetProcessHeap () returned 0xfd0000 [0163.309] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.309] GetProcessHeap () returned 0xfd0000 [0163.309] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.309] GetProcessHeap () returned 0xfd0000 [0163.309] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.310] GetProcessHeap () returned 0xfd0000 [0163.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.310] GetProcessHeap () returned 0xfd0000 [0163.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.310] GetProcessHeap () returned 0xfd0000 [0163.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.310] GetProcessHeap () returned 0xfd0000 [0163.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.311] GetProcessHeap () returned 0xfd0000 [0163.311] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.311] GetProcessHeap () returned 0xfd0000 [0163.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.314] GetProcessHeap () returned 0xfd0000 [0163.314] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.314] GetProcessHeap () returned 0xfd0000 [0163.314] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.315] GetProcessHeap () returned 0xfd0000 [0163.315] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.315] GetProcessHeap () returned 0xfd0000 [0163.315] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0163.316] GetProcessHeap () returned 0xfd0000 [0163.316] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.316] GetProcessHeap () returned 0xfd0000 [0163.316] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.316] GetProcessHeap () returned 0xfd0000 [0163.316] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.316] GetProcessHeap () returned 0xfd0000 [0163.316] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\editpdf\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0163.317] GetProcessHeap () returned 0xfd0000 [0163.317] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.317] GetProcessHeap () returned 0xfd0000 [0163.317] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.317] GetProcessHeap () returned 0xfd0000 [0163.317] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.318] GetProcessHeap () returned 0xfd0000 [0163.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.319] GetProcessHeap () returned 0xfd0000 [0163.319] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.322] GetProcessHeap () returned 0xfd0000 [0163.323] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.323] GetProcessHeap () returned 0xfd0000 [0163.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.323] GetProcessHeap () returned 0xfd0000 [0163.323] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.325] GetProcessHeap () returned 0xfd0000 [0163.325] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.326] GetProcessHeap () returned 0xfd0000 [0163.326] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.328] GetProcessHeap () returned 0xfd0000 [0163.328] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.328] GetProcessHeap () returned 0xfd0000 [0163.328] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.329] GetProcessHeap () returned 0xfd0000 [0163.329] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.329] GetProcessHeap () returned 0xfd0000 [0163.329] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.331] GetProcessHeap () returned 0xfd0000 [0163.331] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.333] GetProcessHeap () returned 0xfd0000 [0163.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.648] GetProcessHeap () returned 0xfd0000 [0163.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.648] GetProcessHeap () returned 0xfd0000 [0163.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.649] GetProcessHeap () returned 0xfd0000 [0163.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.649] GetProcessHeap () returned 0xfd0000 [0163.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.650] GetProcessHeap () returned 0xfd0000 [0163.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.650] GetProcessHeap () returned 0xfd0000 [0163.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0163.651] GetProcessHeap () returned 0xfd0000 [0163.651] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.651] GetProcessHeap () returned 0xfd0000 [0163.651] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.652] GetProcessHeap () returned 0xfd0000 [0163.652] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.652] GetProcessHeap () returned 0xfd0000 [0163.652] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.653] GetProcessHeap () returned 0xfd0000 [0163.653] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.653] GetProcessHeap () returned 0xfd0000 [0163.653] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.653] GetProcessHeap () returned 0xfd0000 [0163.653] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.653] GetProcessHeap () returned 0xfd0000 [0163.653] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0163.654] GetProcessHeap () returned 0xfd0000 [0163.654] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.654] GetProcessHeap () returned 0xfd0000 [0163.654] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.654] GetProcessHeap () returned 0xfd0000 [0163.654] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.654] GetProcessHeap () returned 0xfd0000 [0163.654] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.655] GetProcessHeap () returned 0xfd0000 [0163.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.655] GetProcessHeap () returned 0xfd0000 [0163.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.655] GetProcessHeap () returned 0xfd0000 [0163.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.656] GetProcessHeap () returned 0xfd0000 [0163.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.656] GetProcessHeap () returned 0xfd0000 [0163.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.656] GetProcessHeap () returned 0xfd0000 [0163.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.657] GetProcessHeap () returned 0xfd0000 [0163.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.657] GetProcessHeap () returned 0xfd0000 [0163.657] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.657] GetProcessHeap () returned 0xfd0000 [0163.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.657] GetProcessHeap () returned 0xfd0000 [0163.657] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.658] GetProcessHeap () returned 0xfd0000 [0163.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.658] GetProcessHeap () returned 0xfd0000 [0163.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.659] GetProcessHeap () returned 0xfd0000 [0163.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.659] GetProcessHeap () returned 0xfd0000 [0163.659] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.660] GetProcessHeap () returned 0xfd0000 [0163.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.660] GetProcessHeap () returned 0xfd0000 [0163.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.660] GetProcessHeap () returned 0xfd0000 [0163.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.660] GetProcessHeap () returned 0xfd0000 [0163.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.661] GetProcessHeap () returned 0xfd0000 [0163.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.661] GetProcessHeap () returned 0xfd0000 [0163.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.662] GetProcessHeap () returned 0xfd0000 [0163.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.662] GetProcessHeap () returned 0xfd0000 [0163.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.662] GetProcessHeap () returned 0xfd0000 [0163.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.662] GetProcessHeap () returned 0xfd0000 [0163.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.663] GetProcessHeap () returned 0xfd0000 [0163.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.663] GetProcessHeap () returned 0xfd0000 [0163.663] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.664] GetProcessHeap () returned 0xfd0000 [0163.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.664] GetProcessHeap () returned 0xfd0000 [0163.664] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.665] GetProcessHeap () returned 0xfd0000 [0163.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.665] GetProcessHeap () returned 0xfd0000 [0163.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.665] GetProcessHeap () returned 0xfd0000 [0163.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.665] GetProcessHeap () returned 0xfd0000 [0163.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.666] GetProcessHeap () returned 0xfd0000 [0163.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.666] GetProcessHeap () returned 0xfd0000 [0163.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.667] GetProcessHeap () returned 0xfd0000 [0163.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.667] GetProcessHeap () returned 0xfd0000 [0163.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.667] GetProcessHeap () returned 0xfd0000 [0163.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.668] GetProcessHeap () returned 0xfd0000 [0163.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.668] GetProcessHeap () returned 0xfd0000 [0163.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.668] GetProcessHeap () returned 0xfd0000 [0163.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.669] GetProcessHeap () returned 0xfd0000 [0163.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.669] GetProcessHeap () returned 0xfd0000 [0163.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.669] GetProcessHeap () returned 0xfd0000 [0163.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.669] GetProcessHeap () returned 0xfd0000 [0163.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.670] GetProcessHeap () returned 0xfd0000 [0163.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.670] GetProcessHeap () returned 0xfd0000 [0163.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.671] GetProcessHeap () returned 0xfd0000 [0163.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.671] GetProcessHeap () returned 0xfd0000 [0163.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.671] GetProcessHeap () returned 0xfd0000 [0163.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.671] GetProcessHeap () returned 0xfd0000 [0163.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.671] GetProcessHeap () returned 0xfd0000 [0163.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.672] GetProcessHeap () returned 0xfd0000 [0163.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\exportpdfupsell-app\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.672] GetProcessHeap () returned 0xfd0000 [0163.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.672] GetProcessHeap () returned 0xfd0000 [0163.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.673] GetProcessHeap () returned 0xfd0000 [0163.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.678] GetProcessHeap () returned 0xfd0000 [0163.678] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.679] GetProcessHeap () returned 0xfd0000 [0163.679] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x335390b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.680] GetProcessHeap () returned 0xfd0000 [0163.680] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x335390b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x335390b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x335390b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.682] GetProcessHeap () returned 0xfd0000 [0163.682] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.682] GetProcessHeap () returned 0xfd0000 [0163.682] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x250574b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x250574b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.686] GetProcessHeap () returned 0xfd0000 [0163.686] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.687] GetProcessHeap () returned 0xfd0000 [0163.687] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.691] GetProcessHeap () returned 0xfd0000 [0163.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.691] GetProcessHeap () returned 0xfd0000 [0163.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.692] GetProcessHeap () returned 0xfd0000 [0163.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0163.699] GetProcessHeap () returned 0xfd0000 [0163.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2767d0d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2767d0d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.709] GetProcessHeap () returned 0xfd0000 [0163.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0163.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.710] GetProcessHeap () returned 0xfd0000 [0163.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0163.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\@1x\\themes\\dark\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.731] GetProcessHeap () returned 0xfd0000 [0163.731] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0163.731] GetProcessHeap () returned 0xfd0000 [0163.731] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0163.731] GetProcessHeap () returned 0xfd0000 [0163.731] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.732] GetProcessHeap () returned 0xfd0000 [0163.732] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0163.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x26f5618, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.733] GetProcessHeap () returned 0xfd0000 [0163.733] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0163.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\img\\tools\\themes\\dark\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2767d0d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.741] GetProcessHeap () returned 0xfd0000 [0163.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0163.741] GetProcessHeap () returned 0xfd0000 [0163.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0163.741] GetProcessHeap () returned 0xfd0000 [0163.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.743] GetProcessHeap () returned 0xfd0000 [0163.743] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.743] GetProcessHeap () returned 0xfd0000 [0163.743] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0163.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0163.748] GetProcessHeap () returned 0xfd0000 [0163.748] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.762] GetProcessHeap () returned 0xfd0000 [0163.762] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.772] GetProcessHeap () returned 0xfd0000 [0163.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.772] GetProcessHeap () returned 0xfd0000 [0163.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.774] GetProcessHeap () returned 0xfd0000 [0163.774] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.774] GetProcessHeap () returned 0xfd0000 [0163.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.775] GetProcessHeap () returned 0xfd0000 [0163.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.775] GetProcessHeap () returned 0xfd0000 [0163.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.776] GetProcessHeap () returned 0xfd0000 [0163.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.776] GetProcessHeap () returned 0xfd0000 [0163.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.782] GetProcessHeap () returned 0xfd0000 [0163.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.783] GetProcessHeap () returned 0xfd0000 [0163.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.788] GetProcessHeap () returned 0xfd0000 [0163.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.788] GetProcessHeap () returned 0xfd0000 [0163.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.789] GetProcessHeap () returned 0xfd0000 [0163.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.789] GetProcessHeap () returned 0xfd0000 [0163.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.790] GetProcessHeap () returned 0xfd0000 [0163.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.790] GetProcessHeap () returned 0xfd0000 [0163.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.790] GetProcessHeap () returned 0xfd0000 [0163.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.790] GetProcessHeap () returned 0xfd0000 [0163.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.791] GetProcessHeap () returned 0xfd0000 [0163.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.791] GetProcessHeap () returned 0xfd0000 [0163.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.792] GetProcessHeap () returned 0xfd0000 [0163.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.792] GetProcessHeap () returned 0xfd0000 [0163.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.792] GetProcessHeap () returned 0xfd0000 [0163.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.792] GetProcessHeap () returned 0xfd0000 [0163.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.792] GetProcessHeap () returned 0xfd0000 [0163.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.793] GetProcessHeap () returned 0xfd0000 [0163.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.793] GetProcessHeap () returned 0xfd0000 [0163.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.793] GetProcessHeap () returned 0xfd0000 [0163.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.793] GetProcessHeap () returned 0xfd0000 [0163.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.793] GetProcessHeap () returned 0xfd0000 [0163.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.794] GetProcessHeap () returned 0xfd0000 [0163.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.794] GetProcessHeap () returned 0xfd0000 [0163.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.795] GetProcessHeap () returned 0xfd0000 [0163.795] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.795] GetProcessHeap () returned 0xfd0000 [0163.795] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.796] GetProcessHeap () returned 0xfd0000 [0163.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.796] GetProcessHeap () returned 0xfd0000 [0163.796] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.797] GetProcessHeap () returned 0xfd0000 [0163.797] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.797] GetProcessHeap () returned 0xfd0000 [0163.797] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.798] GetProcessHeap () returned 0xfd0000 [0163.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.798] GetProcessHeap () returned 0xfd0000 [0163.798] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.798] GetProcessHeap () returned 0xfd0000 [0163.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.798] GetProcessHeap () returned 0xfd0000 [0163.798] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.799] GetProcessHeap () returned 0xfd0000 [0163.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.799] GetProcessHeap () returned 0xfd0000 [0163.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.799] GetProcessHeap () returned 0xfd0000 [0163.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.799] GetProcessHeap () returned 0xfd0000 [0163.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.800] GetProcessHeap () returned 0xfd0000 [0163.800] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.800] GetProcessHeap () returned 0xfd0000 [0163.800] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.801] GetProcessHeap () returned 0xfd0000 [0163.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.801] GetProcessHeap () returned 0xfd0000 [0163.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.801] GetProcessHeap () returned 0xfd0000 [0163.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.801] GetProcessHeap () returned 0xfd0000 [0163.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.802] GetProcessHeap () returned 0xfd0000 [0163.802] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.802] GetProcessHeap () returned 0xfd0000 [0163.802] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0163.802] GetProcessHeap () returned 0xfd0000 [0163.802] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.802] GetProcessHeap () returned 0xfd0000 [0163.802] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.803] GetProcessHeap () returned 0xfd0000 [0163.803] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.803] GetProcessHeap () returned 0xfd0000 [0163.803] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.803] GetProcessHeap () returned 0xfd0000 [0163.803] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.803] GetProcessHeap () returned 0xfd0000 [0163.803] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0163.803] GetProcessHeap () returned 0xfd0000 [0163.804] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.804] GetProcessHeap () returned 0xfd0000 [0163.804] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.804] GetProcessHeap () returned 0xfd0000 [0163.804] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.804] GetProcessHeap () returned 0xfd0000 [0163.804] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0163.805] GetProcessHeap () returned 0xfd0000 [0163.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.805] GetProcessHeap () returned 0xfd0000 [0163.805] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\fss\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.805] GetProcessHeap () returned 0xfd0000 [0163.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0163.805] GetProcessHeap () returned 0xfd0000 [0163.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0163.805] GetProcessHeap () returned 0xfd0000 [0163.805] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0163.807] GetProcessHeap () returned 0xfd0000 [0163.807] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.808] GetProcessHeap () returned 0xfd0000 [0163.808] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0163.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0163.919] GetProcessHeap () returned 0xfd0000 [0163.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0163.920] GetProcessHeap () returned 0xfd0000 [0163.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0163.920] GetProcessHeap () returned 0xfd0000 [0163.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0163.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0163.924] GetProcessHeap () returned 0xfd0000 [0163.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0163.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0163.925] GetProcessHeap () returned 0xfd0000 [0163.925] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0163.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.023] GetProcessHeap () returned 0xfd0000 [0164.023] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.024] GetProcessHeap () returned 0xfd0000 [0164.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.024] GetProcessHeap () returned 0xfd0000 [0164.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.026] GetProcessHeap () returned 0xfd0000 [0164.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0164.036] GetProcessHeap () returned 0xfd0000 [0164.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.056] GetProcessHeap () returned 0xfd0000 [0164.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.058] GetProcessHeap () returned 0xfd0000 [0164.058] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.058] GetProcessHeap () returned 0xfd0000 [0164.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.059] GetProcessHeap () returned 0xfd0000 [0164.059] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.059] GetProcessHeap () returned 0xfd0000 [0164.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.065] GetProcessHeap () returned 0xfd0000 [0164.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.065] GetProcessHeap () returned 0xfd0000 [0164.065] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.066] GetProcessHeap () returned 0xfd0000 [0164.066] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.066] GetProcessHeap () returned 0xfd0000 [0164.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.071] GetProcessHeap () returned 0xfd0000 [0164.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.071] GetProcessHeap () returned 0xfd0000 [0164.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0164.073] GetProcessHeap () returned 0xfd0000 [0164.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.073] GetProcessHeap () returned 0xfd0000 [0164.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0164.074] GetProcessHeap () returned 0xfd0000 [0164.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.074] GetProcessHeap () returned 0xfd0000 [0164.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.074] GetProcessHeap () returned 0xfd0000 [0164.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.074] GetProcessHeap () returned 0xfd0000 [0164.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.075] GetProcessHeap () returned 0xfd0000 [0164.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.075] GetProcessHeap () returned 0xfd0000 [0164.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.075] GetProcessHeap () returned 0xfd0000 [0164.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.075] GetProcessHeap () returned 0xfd0000 [0164.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.075] GetProcessHeap () returned 0xfd0000 [0164.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.075] GetProcessHeap () returned 0xfd0000 [0164.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.076] GetProcessHeap () returned 0xfd0000 [0164.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.076] GetProcessHeap () returned 0xfd0000 [0164.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.077] GetProcessHeap () returned 0xfd0000 [0164.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.077] GetProcessHeap () returned 0xfd0000 [0164.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.077] GetProcessHeap () returned 0xfd0000 [0164.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.078] GetProcessHeap () returned 0xfd0000 [0164.078] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\generic-rhp-app\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.078] GetProcessHeap () returned 0xfd0000 [0164.078] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.078] GetProcessHeap () returned 0xfd0000 [0164.078] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.078] GetProcessHeap () returned 0xfd0000 [0164.078] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.079] GetProcessHeap () returned 0xfd0000 [0164.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0164.080] GetProcessHeap () returned 0xfd0000 [0164.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0164.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.080] GetProcessHeap () returned 0xfd0000 [0164.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.082] GetProcessHeap () returned 0xfd0000 [0164.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.082] GetProcessHeap () returned 0xfd0000 [0164.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.089] GetProcessHeap () returned 0xfd0000 [0164.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.089] GetProcessHeap () returned 0xfd0000 [0164.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.154] GetProcessHeap () returned 0xfd0000 [0164.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.154] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0164.154] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.154] GetProcessHeap () returned 0xfd0000 [0164.155] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0164.155] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.155] GetProcessHeap () returned 0xfd0000 [0164.155] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.156] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0164.156] GetProcessHeap () returned 0xfd0000 [0164.156] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.158] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.158] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0164.158] GetProcessHeap () returned 0xfd0000 [0164.158] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.160] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.160] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0164.160] GetProcessHeap () returned 0xfd0000 [0164.160] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.161] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.161] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.161] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.161] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.161] GetProcessHeap () returned 0xfd0000 [0164.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.161] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0164.162] GetProcessHeap () returned 0xfd0000 [0164.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.162] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.163] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.163] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.163] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.163] GetProcessHeap () returned 0xfd0000 [0164.163] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.163] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0164.163] GetProcessHeap () returned 0xfd0000 [0164.163] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.164] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.164] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.164] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.164] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.164] GetProcessHeap () returned 0xfd0000 [0164.164] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.164] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0164.164] GetProcessHeap () returned 0xfd0000 [0164.164] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.169] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.169] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.170] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.170] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.170] GetProcessHeap () returned 0xfd0000 [0164.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.170] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0164.170] GetProcessHeap () returned 0xfd0000 [0164.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.171] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.171] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.171] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.171] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.171] GetProcessHeap () returned 0xfd0000 [0164.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.171] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0164.171] GetProcessHeap () returned 0xfd0000 [0164.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.175] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.175] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.175] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.175] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.175] GetProcessHeap () returned 0xfd0000 [0164.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.175] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0164.175] GetProcessHeap () returned 0xfd0000 [0164.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.176] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.176] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.176] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.176] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.176] GetProcessHeap () returned 0xfd0000 [0164.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.176] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0164.176] GetProcessHeap () returned 0xfd0000 [0164.176] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.177] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.177] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.177] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.177] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.177] GetProcessHeap () returned 0xfd0000 [0164.177] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.177] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0164.177] GetProcessHeap () returned 0xfd0000 [0164.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.178] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.178] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.178] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.178] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.178] GetProcessHeap () returned 0xfd0000 [0164.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.178] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0164.178] GetProcessHeap () returned 0xfd0000 [0164.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.179] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.179] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.179] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.179] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.179] GetProcessHeap () returned 0xfd0000 [0164.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0164.179] GetProcessHeap () returned 0xfd0000 [0164.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0164.187] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.187] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.187] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.187] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0164.187] GetProcessHeap () returned 0xfd0000 [0164.187] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.187] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0164.187] GetProcessHeap () returned 0xfd0000 [0164.187] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.188] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.188] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.188] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.188] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.188] GetProcessHeap () returned 0xfd0000 [0164.188] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.188] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0164.188] GetProcessHeap () returned 0xfd0000 [0164.188] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0164.188] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.188] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.189] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.189] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0164.189] GetProcessHeap () returned 0xfd0000 [0164.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.189] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.189] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.189] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.189] GetProcessHeap () returned 0xfd0000 [0164.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.189] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x373f, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0164.189] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x16d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0164.189] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x16d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0164.189] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.189] GetProcessHeap () returned 0xfd0000 [0164.190] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.191] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0164.191] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.191] GetProcessHeap () returned 0xfd0000 [0164.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0164.191] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="my-computer", cAlternateFileName="MY-COM~2")) returned 1 [0164.191] GetProcessHeap () returned 0xfd0000 [0164.191] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0164.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.193] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.193] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0164.193] GetProcessHeap () returned 0xfd0000 [0164.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.195] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.195] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0164.195] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0164.195] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0164.195] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.195] GetProcessHeap () returned 0xfd0000 [0164.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.195] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0164.195] GetProcessHeap () returned 0xfd0000 [0164.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="file_icons.png", cAlternateFileName="FILE_I~1.PNG")) returned 1 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons.png", cAlternateFileName="")) returned 1 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0164.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0164.201] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0164.201] GetProcessHeap () returned 0xfd0000 [0164.201] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0164.205] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.206] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0164.206] GetProcessHeap () returned 0xfd0000 [0164.206] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf011b8fe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf011b8fe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf011b8fe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf011b8fe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6004, dwReserved0=0x0, dwReserved1=0x0, cFileName="file_icons.png", cAlternateFileName="FILE_I~1.PNG")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons.png", cAlternateFileName="")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf011b8fe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf011b8fe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf011b8fe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0164.214] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf011b8fe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf011b8fe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf011b8fe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf011b8fe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf011b8fe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf011b8fe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0164.215] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf011b8fe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf011b8fe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf011b8fe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 0 [0164.215] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0164.215] GetProcessHeap () returned 0xfd0000 [0164.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0164.216] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0164.216] GetProcessHeap () returned 0xfd0000 [0164.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.216] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0164.216] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.216] GetProcessHeap () returned 0xfd0000 [0164.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.349] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0164.349] GetProcessHeap () returned 0xfd0000 [0164.349] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.357] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.357] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0164.357] GetProcessHeap () returned 0xfd0000 [0164.357] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.359] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.359] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0164.359] GetProcessHeap () returned 0xfd0000 [0164.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.360] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.360] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.361] GetProcessHeap () returned 0xfd0000 [0164.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0164.361] GetProcessHeap () returned 0xfd0000 [0164.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.362] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.362] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.362] GetProcessHeap () returned 0xfd0000 [0164.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.362] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0164.362] GetProcessHeap () returned 0xfd0000 [0164.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.365] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.365] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.365] GetProcessHeap () returned 0xfd0000 [0164.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0164.365] GetProcessHeap () returned 0xfd0000 [0164.365] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.365] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.365] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.366] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.366] GetProcessHeap () returned 0xfd0000 [0164.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.366] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0164.366] GetProcessHeap () returned 0xfd0000 [0164.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.367] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.367] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.367] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.367] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.367] GetProcessHeap () returned 0xfd0000 [0164.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.367] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0164.367] GetProcessHeap () returned 0xfd0000 [0164.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.368] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.368] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.368] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.369] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.372] GetProcessHeap () returned 0xfd0000 [0164.372] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.373] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0164.373] GetProcessHeap () returned 0xfd0000 [0164.373] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.373] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.373] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.374] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.374] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.374] GetProcessHeap () returned 0xfd0000 [0164.374] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.374] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0164.374] GetProcessHeap () returned 0xfd0000 [0164.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.375] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.375] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.375] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.375] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.375] GetProcessHeap () returned 0xfd0000 [0164.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.375] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0164.375] GetProcessHeap () returned 0xfd0000 [0164.375] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.376] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.376] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.376] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.376] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.376] GetProcessHeap () returned 0xfd0000 [0164.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.376] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0164.376] GetProcessHeap () returned 0xfd0000 [0164.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.377] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.377] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.377] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.377] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.377] GetProcessHeap () returned 0xfd0000 [0164.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.377] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0164.377] GetProcessHeap () returned 0xfd0000 [0164.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.378] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.378] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.378] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.378] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.379] GetProcessHeap () returned 0xfd0000 [0164.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.379] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0164.379] GetProcessHeap () returned 0xfd0000 [0164.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.379] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.380] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.380] GetProcessHeap () returned 0xfd0000 [0164.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.380] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0164.380] GetProcessHeap () returned 0xfd0000 [0164.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.380] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.381] GetProcessHeap () returned 0xfd0000 [0164.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.381] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0164.381] GetProcessHeap () returned 0xfd0000 [0164.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.382] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.382] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.382] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.382] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.382] GetProcessHeap () returned 0xfd0000 [0164.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.382] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0164.382] GetProcessHeap () returned 0xfd0000 [0164.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.383] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.383] GetProcessHeap () returned 0xfd0000 [0164.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.383] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0164.384] GetProcessHeap () returned 0xfd0000 [0164.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.384] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.384] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.384] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.385] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.385] GetProcessHeap () returned 0xfd0000 [0164.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.385] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0164.385] GetProcessHeap () returned 0xfd0000 [0164.385] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.385] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.385] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.385] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.386] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.386] GetProcessHeap () returned 0xfd0000 [0164.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.386] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0164.386] GetProcessHeap () returned 0xfd0000 [0164.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0164.386] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.386] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.386] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.386] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0164.387] GetProcessHeap () returned 0xfd0000 [0164.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.387] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0164.387] GetProcessHeap () returned 0xfd0000 [0164.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.388] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.388] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.388] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.388] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.388] GetProcessHeap () returned 0xfd0000 [0164.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.388] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0164.388] GetProcessHeap () returned 0xfd0000 [0164.388] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.389] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.389] GetProcessHeap () returned 0xfd0000 [0164.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.389] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0164.389] GetProcessHeap () returned 0xfd0000 [0164.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.390] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.390] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.390] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.390] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.390] GetProcessHeap () returned 0xfd0000 [0164.390] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.390] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0164.390] GetProcessHeap () returned 0xfd0000 [0164.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.391] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.391] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.391] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.391] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.391] GetProcessHeap () returned 0xfd0000 [0164.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.391] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0164.391] GetProcessHeap () returned 0xfd0000 [0164.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.392] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.392] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.392] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x55b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.392] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.392] GetProcessHeap () returned 0xfd0000 [0164.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0164.392] GetProcessHeap () returned 0xfd0000 [0164.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0164.393] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.393] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.393] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.393] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0164.393] GetProcessHeap () returned 0xfd0000 [0164.393] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.393] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0164.394] GetProcessHeap () returned 0xfd0000 [0164.394] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.394] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.394] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.394] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.394] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.394] GetProcessHeap () returned 0xfd0000 [0164.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.394] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0164.394] GetProcessHeap () returned 0xfd0000 [0164.394] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.395] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.395] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x642, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.395] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x642, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.395] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.395] GetProcessHeap () returned 0xfd0000 [0164.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.395] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0164.395] GetProcessHeap () returned 0xfd0000 [0164.395] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.396] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.396] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.396] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.396] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.396] GetProcessHeap () returned 0xfd0000 [0164.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.397] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0164.397] GetProcessHeap () returned 0xfd0000 [0164.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0164.397] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.397] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.397] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.397] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0164.397] GetProcessHeap () returned 0xfd0000 [0164.398] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.398] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0164.398] GetProcessHeap () returned 0xfd0000 [0164.398] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.590] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.590] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.590] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.590] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.591] GetProcessHeap () returned 0xfd0000 [0164.591] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.591] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0164.591] GetProcessHeap () returned 0xfd0000 [0164.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.591] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.591] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.591] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.592] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.592] GetProcessHeap () returned 0xfd0000 [0164.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.592] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0164.592] GetProcessHeap () returned 0xfd0000 [0164.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.592] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.592] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.592] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.593] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.593] GetProcessHeap () returned 0xfd0000 [0164.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.593] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.593] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0164.593] GetProcessHeap () returned 0xfd0000 [0164.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.593] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.593] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x661, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.593] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x661, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.593] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.594] GetProcessHeap () returned 0xfd0000 [0164.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.594] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0164.594] GetProcessHeap () returned 0xfd0000 [0164.594] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.594] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.594] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.594] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.594] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.594] GetProcessHeap () returned 0xfd0000 [0164.594] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.594] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0164.595] GetProcessHeap () returned 0xfd0000 [0164.595] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.595] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.595] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.595] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.595] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.595] GetProcessHeap () returned 0xfd0000 [0164.595] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.595] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0164.595] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.596] GetProcessHeap () returned 0xfd0000 [0164.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.596] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0164.596] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0164.596] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0164.596] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.596] GetProcessHeap () returned 0xfd0000 [0164.596] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.597] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0164.597] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.597] GetProcessHeap () returned 0xfd0000 [0164.597] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0164.598] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="my-computer-select", cAlternateFileName="MY-COM~1")) returned 1 [0164.598] GetProcessHeap () returned 0xfd0000 [0164.598] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0164.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.598] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.598] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0164.599] GetProcessHeap () returned 0xfd0000 [0164.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.601] GetProcessHeap () returned 0xfd0000 [0164.601] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.601] GetProcessHeap () returned 0xfd0000 [0164.601] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.601] GetProcessHeap () returned 0xfd0000 [0164.601] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.603] GetProcessHeap () returned 0xfd0000 [0164.603] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.604] GetProcessHeap () returned 0xfd0000 [0164.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.604] GetProcessHeap () returned 0xfd0000 [0164.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.605] GetProcessHeap () returned 0xfd0000 [0164.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.605] GetProcessHeap () returned 0xfd0000 [0164.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.606] GetProcessHeap () returned 0xfd0000 [0164.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.606] GetProcessHeap () returned 0xfd0000 [0164.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.606] GetProcessHeap () returned 0xfd0000 [0164.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.606] GetProcessHeap () returned 0xfd0000 [0164.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.607] GetProcessHeap () returned 0xfd0000 [0164.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.607] GetProcessHeap () returned 0xfd0000 [0164.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.608] GetProcessHeap () returned 0xfd0000 [0164.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.608] GetProcessHeap () returned 0xfd0000 [0164.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.609] GetProcessHeap () returned 0xfd0000 [0164.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.609] GetProcessHeap () returned 0xfd0000 [0164.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.610] GetProcessHeap () returned 0xfd0000 [0164.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.610] GetProcessHeap () returned 0xfd0000 [0164.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.611] GetProcessHeap () returned 0xfd0000 [0164.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.611] GetProcessHeap () returned 0xfd0000 [0164.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.611] GetProcessHeap () returned 0xfd0000 [0164.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.611] GetProcessHeap () returned 0xfd0000 [0164.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.612] GetProcessHeap () returned 0xfd0000 [0164.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.612] GetProcessHeap () returned 0xfd0000 [0164.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.613] GetProcessHeap () returned 0xfd0000 [0164.613] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.613] GetProcessHeap () returned 0xfd0000 [0164.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.614] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.614] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.614] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.614] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.615] GetProcessHeap () returned 0xfd0000 [0164.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.615] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0164.615] GetProcessHeap () returned 0xfd0000 [0164.615] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.616] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.616] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0164.616] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.616] GetProcessHeap () returned 0xfd0000 [0164.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.616] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0164.616] GetProcessHeap () returned 0xfd0000 [0164.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.616] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.616] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.617] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.617] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.617] GetProcessHeap () returned 0xfd0000 [0164.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.617] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0164.617] GetProcessHeap () returned 0xfd0000 [0164.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.618] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.618] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.618] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.618] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.620] GetProcessHeap () returned 0xfd0000 [0164.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.620] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0164.620] GetProcessHeap () returned 0xfd0000 [0164.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.620] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.620] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.620] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.620] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.621] GetProcessHeap () returned 0xfd0000 [0164.621] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.621] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0164.621] GetProcessHeap () returned 0xfd0000 [0164.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.621] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.621] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.621] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.621] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.621] GetProcessHeap () returned 0xfd0000 [0164.621] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.621] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0164.621] GetProcessHeap () returned 0xfd0000 [0164.622] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.622] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.622] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.622] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.623] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.623] GetProcessHeap () returned 0xfd0000 [0164.623] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.623] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0164.623] GetProcessHeap () returned 0xfd0000 [0164.623] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0164.623] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.623] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.623] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.623] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0164.623] GetProcessHeap () returned 0xfd0000 [0164.624] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.624] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0164.624] GetProcessHeap () returned 0xfd0000 [0164.624] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.624] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.624] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.624] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.624] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.624] GetProcessHeap () returned 0xfd0000 [0164.624] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.624] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0164.624] GetProcessHeap () returned 0xfd0000 [0164.624] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.625] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.625] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x351, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.625] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x351, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.625] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.625] GetProcessHeap () returned 0xfd0000 [0164.625] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.625] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0164.625] GetProcessHeap () returned 0xfd0000 [0164.625] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.626] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.626] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.626] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.626] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.626] GetProcessHeap () returned 0xfd0000 [0164.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.626] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0164.626] GetProcessHeap () returned 0xfd0000 [0164.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.627] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.627] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.627] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.627] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.627] GetProcessHeap () returned 0xfd0000 [0164.627] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.628] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0164.628] GetProcessHeap () returned 0xfd0000 [0164.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.628] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.628] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.628] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.628] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.628] GetProcessHeap () returned 0xfd0000 [0164.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.628] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0164.628] GetProcessHeap () returned 0xfd0000 [0164.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.747] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.747] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.747] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.747] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0164.748] GetProcessHeap () returned 0xfd0000 [0164.748] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.748] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0164.748] GetProcessHeap () returned 0xfd0000 [0164.748] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.749] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.749] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.749] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.749] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.749] GetProcessHeap () returned 0xfd0000 [0164.749] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.749] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0164.749] GetProcessHeap () returned 0xfd0000 [0164.749] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.749] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.749] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.750] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.750] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.750] GetProcessHeap () returned 0xfd0000 [0164.750] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.750] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0164.750] GetProcessHeap () returned 0xfd0000 [0164.750] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.750] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.750] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0164.750] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.751] GetProcessHeap () returned 0xfd0000 [0164.751] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.751] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0164.751] GetProcessHeap () returned 0xfd0000 [0164.751] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.751] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.751] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.751] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.751] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.752] GetProcessHeap () returned 0xfd0000 [0164.752] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.752] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0164.752] GetProcessHeap () returned 0xfd0000 [0164.752] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.752] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.752] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.752] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.752] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.752] GetProcessHeap () returned 0xfd0000 [0164.752] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.752] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.753] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0164.753] GetProcessHeap () returned 0xfd0000 [0164.753] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.753] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.753] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.753] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.753] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.753] GetProcessHeap () returned 0xfd0000 [0164.753] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.753] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0164.754] GetProcessHeap () returned 0xfd0000 [0164.754] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.754] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.754] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.754] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.754] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.754] GetProcessHeap () returned 0xfd0000 [0164.754] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.754] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0164.754] GetProcessHeap () returned 0xfd0000 [0164.754] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer-select\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.755] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.755] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.755] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.755] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0164.755] GetProcessHeap () returned 0xfd0000 [0164.755] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.755] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0164.755] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.755] GetProcessHeap () returned 0xfd0000 [0164.755] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.755] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e36, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0164.756] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xf97, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0164.756] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xf97, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0164.756] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.756] GetProcessHeap () returned 0xfd0000 [0164.756] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.758] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0164.758] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0164.758] GetProcessHeap () returned 0xfd0000 [0164.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0164.758] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="my-files", cAlternateFileName="")) returned 1 [0164.758] GetProcessHeap () returned 0xfd0000 [0164.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0164.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.760] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.760] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0164.760] GetProcessHeap () returned 0xfd0000 [0164.760] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.762] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.762] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0164.762] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0164.762] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0164.762] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.762] GetProcessHeap () returned 0xfd0000 [0164.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.762] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0164.763] GetProcessHeap () returned 0xfd0000 [0164.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.764] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.764] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0164.764] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons.png", cAlternateFileName="")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0164.765] GetProcessHeap () returned 0xfd0000 [0164.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.766] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.766] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0164.766] GetProcessHeap () returned 0xfd0000 [0164.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.768] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.768] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_patterns_header.png", cAlternateFileName="BG_PAT~2.PNG")) returned 1 [0164.768] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_pattern_RHP.png", cAlternateFileName="BG_PAT~1.PNG")) returned 1 [0164.768] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons.png", cAlternateFileName="")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_ie8.gif", cAlternateFileName="ICONS_~1.GIF")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="icons_retina.png", cAlternateFileName="ICONS_~1.PNG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x225a, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons.png", cAlternateFileName="NEW_IC~2.PNG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d074e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0d074e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x456c, dwReserved0=0x0, dwReserved1=0x0, cFileName="new_icons_retina.png", cAlternateFileName="NEW_IC~1.PNG")) returned 0 [0164.769] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.770] GetProcessHeap () returned 0xfd0000 [0164.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.770] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0164.770] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.770] GetProcessHeap () returned 0xfd0000 [0164.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.770] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0164.770] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.770] GetProcessHeap () returned 0xfd0000 [0164.771] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0164.772] GetProcessHeap () returned 0xfd0000 [0164.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0164.774] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0164.774] GetProcessHeap () returned 0xfd0000 [0164.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.776] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0164.776] GetProcessHeap () returned 0xfd0000 [0164.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.777] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.777] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0164.777] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.777] GetProcessHeap () returned 0xfd0000 [0164.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.778] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0164.778] GetProcessHeap () returned 0xfd0000 [0164.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.778] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.778] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.778] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.779] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.779] GetProcessHeap () returned 0xfd0000 [0164.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.779] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0164.779] GetProcessHeap () returned 0xfd0000 [0164.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.779] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.779] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.779] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.779] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.780] GetProcessHeap () returned 0xfd0000 [0164.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.780] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0164.780] GetProcessHeap () returned 0xfd0000 [0164.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.780] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.780] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.781] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.781] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.781] GetProcessHeap () returned 0xfd0000 [0164.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.781] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0164.781] GetProcessHeap () returned 0xfd0000 [0164.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.781] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.781] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.781] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.782] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.782] GetProcessHeap () returned 0xfd0000 [0164.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.782] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0164.782] GetProcessHeap () returned 0xfd0000 [0164.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0164.783] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.783] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.783] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.783] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0164.783] GetProcessHeap () returned 0xfd0000 [0164.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.783] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0164.783] GetProcessHeap () returned 0xfd0000 [0164.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.784] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.784] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.784] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.784] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.784] GetProcessHeap () returned 0xfd0000 [0164.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.784] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0164.784] GetProcessHeap () returned 0xfd0000 [0164.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.785] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.785] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.785] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.785] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.785] GetProcessHeap () returned 0xfd0000 [0164.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.902] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0164.902] GetProcessHeap () returned 0xfd0000 [0164.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.902] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.903] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.903] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.903] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.903] GetProcessHeap () returned 0xfd0000 [0164.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.903] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0164.903] GetProcessHeap () returned 0xfd0000 [0164.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.904] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.904] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.904] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.904] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.904] GetProcessHeap () returned 0xfd0000 [0164.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.904] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0164.905] GetProcessHeap () returned 0xfd0000 [0164.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.905] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.905] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.906] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.906] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.906] GetProcessHeap () returned 0xfd0000 [0164.906] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.906] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0164.906] GetProcessHeap () returned 0xfd0000 [0164.906] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0164.907] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.907] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.907] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.907] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0164.907] GetProcessHeap () returned 0xfd0000 [0164.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.907] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0164.907] GetProcessHeap () returned 0xfd0000 [0164.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.908] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.908] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.908] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.908] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.908] GetProcessHeap () returned 0xfd0000 [0164.908] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.908] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0164.908] GetProcessHeap () returned 0xfd0000 [0164.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.909] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.909] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0164.909] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.909] GetProcessHeap () returned 0xfd0000 [0164.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.909] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0164.909] GetProcessHeap () returned 0xfd0000 [0164.909] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.910] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.910] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.910] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.910] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.910] GetProcessHeap () returned 0xfd0000 [0164.910] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.910] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0164.910] GetProcessHeap () returned 0xfd0000 [0164.910] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.911] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.911] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.911] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.912] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.912] GetProcessHeap () returned 0xfd0000 [0164.912] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.912] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0164.912] GetProcessHeap () returned 0xfd0000 [0164.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.913] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.913] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.913] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.913] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.913] GetProcessHeap () returned 0xfd0000 [0164.913] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0164.913] GetProcessHeap () returned 0xfd0000 [0164.913] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.914] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.914] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.914] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.914] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.915] GetProcessHeap () returned 0xfd0000 [0164.915] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0164.915] GetProcessHeap () returned 0xfd0000 [0164.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.916] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.916] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.916] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.916] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0164.916] GetProcessHeap () returned 0xfd0000 [0164.916] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.916] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0164.916] GetProcessHeap () returned 0xfd0000 [0164.916] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.917] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.917] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.917] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.917] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.917] GetProcessHeap () returned 0xfd0000 [0164.917] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.917] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0164.917] GetProcessHeap () returned 0xfd0000 [0164.917] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.918] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.918] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.918] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.918] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.918] GetProcessHeap () returned 0xfd0000 [0164.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.919] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0164.919] GetProcessHeap () returned 0xfd0000 [0164.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.919] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.920] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.920] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.920] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.920] GetProcessHeap () returned 0xfd0000 [0164.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.920] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0164.920] GetProcessHeap () returned 0xfd0000 [0164.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.921] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.921] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x426, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.921] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x426, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.921] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.922] GetProcessHeap () returned 0xfd0000 [0164.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.922] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0164.922] GetProcessHeap () returned 0xfd0000 [0164.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.923] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.923] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.923] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.923] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.923] GetProcessHeap () returned 0xfd0000 [0164.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.923] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0164.923] GetProcessHeap () returned 0xfd0000 [0164.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.924] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.924] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.924] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.924] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.924] GetProcessHeap () returned 0xfd0000 [0164.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.924] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0164.924] GetProcessHeap () returned 0xfd0000 [0164.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.925] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.925] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.925] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.925] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.925] GetProcessHeap () returned 0xfd0000 [0164.925] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.925] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0164.925] GetProcessHeap () returned 0xfd0000 [0164.925] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0164.926] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.926] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.926] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.926] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0164.927] GetProcessHeap () returned 0xfd0000 [0164.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.927] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0164.927] GetProcessHeap () returned 0xfd0000 [0164.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0164.928] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.928] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.928] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.928] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0164.928] GetProcessHeap () returned 0xfd0000 [0164.928] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.928] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0164.928] GetProcessHeap () returned 0xfd0000 [0164.928] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.929] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.929] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0164.929] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0164.929] GetProcessHeap () returned 0xfd0000 [0164.929] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.929] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0164.929] GetProcessHeap () returned 0xfd0000 [0164.929] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0164.930] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.930] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.930] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0164.930] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0164.930] GetProcessHeap () returned 0xfd0000 [0164.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.930] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0164.930] GetProcessHeap () returned 0xfd0000 [0164.930] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.931] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.931] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0164.931] GetProcessHeap () returned 0xfd0000 [0164.931] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.931] GetProcessHeap () returned 0xfd0000 [0164.931] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.932] GetProcessHeap () returned 0xfd0000 [0164.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.932] GetProcessHeap () returned 0xfd0000 [0164.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.932] GetProcessHeap () returned 0xfd0000 [0164.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.932] GetProcessHeap () returned 0xfd0000 [0164.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0164.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0164.933] GetProcessHeap () returned 0xfd0000 [0164.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0164.933] GetProcessHeap () returned 0xfd0000 [0164.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0164.933] GetProcessHeap () returned 0xfd0000 [0164.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.934] GetProcessHeap () returned 0xfd0000 [0164.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0164.935] GetProcessHeap () returned 0xfd0000 [0164.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0164.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.936] GetProcessHeap () returned 0xfd0000 [0164.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.938] GetProcessHeap () returned 0xfd0000 [0164.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.938] GetProcessHeap () returned 0xfd0000 [0164.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0164.939] GetProcessHeap () returned 0xfd0000 [0164.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.939] GetProcessHeap () returned 0xfd0000 [0164.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0164.939] GetProcessHeap () returned 0xfd0000 [0164.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0164.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0164.940] GetProcessHeap () returned 0xfd0000 [0164.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0164.940] GetProcessHeap () returned 0xfd0000 [0164.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0164.940] GetProcessHeap () returned 0xfd0000 [0164.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0164.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0164.941] GetProcessHeap () returned 0xfd0000 [0164.941] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0164.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0165.052] GetProcessHeap () returned 0xfd0000 [0165.052] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.053] GetProcessHeap () returned 0xfd0000 [0165.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.054] GetProcessHeap () returned 0xfd0000 [0165.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.054] GetProcessHeap () returned 0xfd0000 [0165.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.054] GetProcessHeap () returned 0xfd0000 [0165.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.055] GetProcessHeap () returned 0xfd0000 [0165.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.055] GetProcessHeap () returned 0xfd0000 [0165.055] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.056] GetProcessHeap () returned 0xfd0000 [0165.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.056] GetProcessHeap () returned 0xfd0000 [0165.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.057] GetProcessHeap () returned 0xfd0000 [0165.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.057] GetProcessHeap () returned 0xfd0000 [0165.057] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.057] GetProcessHeap () returned 0xfd0000 [0165.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.058] GetProcessHeap () returned 0xfd0000 [0165.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.058] GetProcessHeap () returned 0xfd0000 [0165.058] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.058] GetProcessHeap () returned 0xfd0000 [0165.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.059] GetProcessHeap () returned 0xfd0000 [0165.059] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.059] GetProcessHeap () returned 0xfd0000 [0165.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.060] GetProcessHeap () returned 0xfd0000 [0165.060] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.060] GetProcessHeap () returned 0xfd0000 [0165.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.060] GetProcessHeap () returned 0xfd0000 [0165.060] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.061] GetProcessHeap () returned 0xfd0000 [0165.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.061] GetProcessHeap () returned 0xfd0000 [0165.061] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.061] GetProcessHeap () returned 0xfd0000 [0165.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.062] GetProcessHeap () returned 0xfd0000 [0165.062] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.062] GetProcessHeap () returned 0xfd0000 [0165.062] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.063] GetProcessHeap () returned 0xfd0000 [0165.063] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.063] GetProcessHeap () returned 0xfd0000 [0165.063] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.064] GetProcessHeap () returned 0xfd0000 [0165.064] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.064] GetProcessHeap () returned 0xfd0000 [0165.064] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.065] GetProcessHeap () returned 0xfd0000 [0165.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.065] GetProcessHeap () returned 0xfd0000 [0165.065] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.066] GetProcessHeap () returned 0xfd0000 [0165.066] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.066] GetProcessHeap () returned 0xfd0000 [0165.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.067] GetProcessHeap () returned 0xfd0000 [0165.067] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.067] GetProcessHeap () returned 0xfd0000 [0165.067] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.068] GetProcessHeap () returned 0xfd0000 [0165.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.068] GetProcessHeap () returned 0xfd0000 [0165.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.069] GetProcessHeap () returned 0xfd0000 [0165.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.069] GetProcessHeap () returned 0xfd0000 [0165.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.070] GetProcessHeap () returned 0xfd0000 [0165.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.070] GetProcessHeap () returned 0xfd0000 [0165.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.070] GetProcessHeap () returned 0xfd0000 [0165.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.070] GetProcessHeap () returned 0xfd0000 [0165.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.071] GetProcessHeap () returned 0xfd0000 [0165.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.071] GetProcessHeap () returned 0xfd0000 [0165.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.071] GetProcessHeap () returned 0xfd0000 [0165.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.071] GetProcessHeap () returned 0xfd0000 [0165.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.071] GetProcessHeap () returned 0xfd0000 [0165.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.072] GetProcessHeap () returned 0xfd0000 [0165.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.072] GetProcessHeap () returned 0xfd0000 [0165.072] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.072] GetProcessHeap () returned 0xfd0000 [0165.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.072] GetProcessHeap () returned 0xfd0000 [0165.072] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.072] GetProcessHeap () returned 0xfd0000 [0165.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.073] GetProcessHeap () returned 0xfd0000 [0165.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.074] GetProcessHeap () returned 0xfd0000 [0165.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.075] GetProcessHeap () returned 0xfd0000 [0165.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.075] GetProcessHeap () returned 0xfd0000 [0165.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.076] GetProcessHeap () returned 0xfd0000 [0165.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.076] GetProcessHeap () returned 0xfd0000 [0165.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.077] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.077] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.077] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.077] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0165.077] GetProcessHeap () returned 0xfd0000 [0165.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.077] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0165.077] GetProcessHeap () returned 0xfd0000 [0165.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.078] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.078] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.078] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.078] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0165.078] GetProcessHeap () returned 0xfd0000 [0165.078] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.078] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.078] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0165.079] GetProcessHeap () returned 0xfd0000 [0165.079] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.079] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.079] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.079] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.079] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.079] GetProcessHeap () returned 0xfd0000 [0165.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.079] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0165.079] GetProcessHeap () returned 0xfd0000 [0165.079] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.080] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.080] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.080] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.080] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.080] GetProcessHeap () returned 0xfd0000 [0165.080] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.080] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0165.080] GetProcessHeap () returned 0xfd0000 [0165.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.080] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.081] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0165.081] GetProcessHeap () returned 0xfd0000 [0165.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.081] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0165.081] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0165.081] GetProcessHeap () returned 0xfd0000 [0165.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.081] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7044, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0165.081] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1754, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0165.081] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1754, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0165.081] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.081] GetProcessHeap () returned 0xfd0000 [0165.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.083] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0165.083] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.083] GetProcessHeap () returned 0xfd0000 [0165.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0165.084] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="my-recent-files-select", cAlternateFileName="MY-REC~1")) returned 1 [0165.084] GetProcessHeap () returned 0xfd0000 [0165.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0165.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files-select\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.084] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.084] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0165.085] GetProcessHeap () returned 0xfd0000 [0165.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files-select\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.086] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.087] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.087] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.087] GetProcessHeap () returned 0xfd0000 [0165.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.087] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0165.087] GetProcessHeap () returned 0xfd0000 [0165.087] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-recent-files-select\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.087] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.087] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x76d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0165.087] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x76d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 0 [0165.087] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.088] GetProcessHeap () returned 0xfd0000 [0165.088] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.088] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0165.088] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.088] GetProcessHeap () returned 0xfd0000 [0165.088] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0165.088] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ob-preview", cAlternateFileName="OB-PRE~1")) returned 1 [0165.088] GetProcessHeap () returned 0xfd0000 [0165.088] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0165.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.089] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.089] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0165.089] GetProcessHeap () returned 0xfd0000 [0165.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.090] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.090] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0165.090] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1982, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0165.090] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1982, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0165.090] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.090] GetProcessHeap () returned 0xfd0000 [0165.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.090] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0165.090] GetProcessHeap () returned 0xfd0000 [0165.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.092] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.213] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="combine_poster.jpg", cAlternateFileName="COMBIN~1.JPG")) returned 1 [0165.213] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbc62, dwReserved0=0x0, dwReserved1=0x0, cFileName="combine_poster2x.jpg", cAlternateFileName="COMBIN~2.JPG")) returned 1 [0165.213] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="compare_poster.jpg", cAlternateFileName="COMPAR~1.JPG")) returned 1 [0165.213] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x13b23, dwReserved0=0x0, dwReserved1=0x0, cFileName="compare_poster2x.jpg", cAlternateFileName="COMPAR~2.JPG")) returned 1 [0165.213] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="edit_pdf_poster.jpg", cAlternateFileName="EDIT_P~1.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12163, dwReserved0=0x0, dwReserved1=0x0, cFileName="edit_pdf_poster2x.jpg", cAlternateFileName="EDIT_P~2.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="optimize_poster.jpg", cAlternateFileName="OPTIMI~2.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10552, dwReserved0=0x0, dwReserved1=0x0, cFileName="optimize_poster2x.jpg", cAlternateFileName="OPTIMI~1.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10e5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="organize_poster.jpg", cAlternateFileName="ORGANI~3.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10e5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="organize_poster2x-dark.jpg", cAlternateFileName="ORGANI~1.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10e5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="organize_poster2x.jpg", cAlternateFileName="ORGANI~2.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b34, dwReserved0=0x0, dwReserved1=0x0, cFileName="protect_poster.jpg", cAlternateFileName="PROTEC~2.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="protect_poster2x.jpg", cAlternateFileName="PROTEC~1.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="redact_poster.jpg", cAlternateFileName="REDACT~2.JPG")) returned 1 [0165.214] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x111e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="redact_poster2x.jpg", cAlternateFileName="REDACT~1.JPG")) returned 1 [0165.215] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8f7ad6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8f7ad6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8f7ad6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7689, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_poster.jpg", cAlternateFileName="SCAN_P~1.JPG")) returned 1 [0165.215] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x149e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_poster2x.jpg", cAlternateFileName="SCAN_P~2.JPG")) returned 1 [0165.215] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0165.215] GetProcessHeap () returned 0xfd0000 [0165.215] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.216] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.216] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0165.216] GetProcessHeap () returned 0xfd0000 [0165.216] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.218] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="combine_poster.jpg", cAlternateFileName="COMBIN~1.JPG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbc62, dwReserved0=0x0, dwReserved1=0x0, cFileName="combine_poster2x.jpg", cAlternateFileName="COMBIN~2.JPG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="compare_poster.jpg", cAlternateFileName="COMPAR~1.JPG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x13b23, dwReserved0=0x0, dwReserved1=0x0, cFileName="compare_poster2x.jpg", cAlternateFileName="COMPAR~2.JPG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x73a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="edit_pdf_poster.jpg", cAlternateFileName="EDIT_P~1.JPG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12163, dwReserved0=0x0, dwReserved1=0x0, cFileName="edit_pdf_poster2x.jpg", cAlternateFileName="EDIT_P~2.JPG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons.png", cAlternateFileName="EXAMPL~2.PNG")) returned 1 [0165.219] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="example_icons2x.png", cAlternateFileName="EXAMPL~1.PNG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="optimize_poster.jpg", cAlternateFileName="OPTIMI~2.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10552, dwReserved0=0x0, dwReserved1=0x0, cFileName="optimize_poster2x.jpg", cAlternateFileName="OPTIMI~1.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x642a, dwReserved0=0x0, dwReserved1=0x0, cFileName="organize_poster.jpg", cAlternateFileName="ORGANI~2.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10e5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="organize_poster2x.jpg", cAlternateFileName="ORGANI~1.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b34, dwReserved0=0x0, dwReserved1=0x0, cFileName="protect_poster.jpg", cAlternateFileName="PROTEC~2.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="protect_poster2x.jpg", cAlternateFileName="PROTEC~1.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="redact_poster.jpg", cAlternateFileName="REDACT~2.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x111e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="redact_poster2x.jpg", cAlternateFileName="REDACT~1.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7689, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_poster.jpg", cAlternateFileName="SCAN_P~1.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x149e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_poster2x.jpg", cAlternateFileName="SCAN_P~2.JPG")) returned 1 [0165.220] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x149e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_poster2x.jpg", cAlternateFileName="SCAN_P~2.JPG")) returned 0 [0165.221] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.221] GetProcessHeap () returned 0xfd0000 [0165.221] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.221] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0165.222] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.222] GetProcessHeap () returned 0xfd0000 [0165.222] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.222] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0165.222] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.222] GetProcessHeap () returned 0xfd0000 [0165.222] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.241] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0165.241] GetProcessHeap () returned 0xfd0000 [0165.241] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.243] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.243] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0165.243] GetProcessHeap () returned 0xfd0000 [0165.243] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.245] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.245] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0165.245] GetProcessHeap () returned 0xfd0000 [0165.245] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.246] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.246] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.246] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.246] GetProcessHeap () returned 0xfd0000 [0165.246] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.246] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0165.246] GetProcessHeap () returned 0xfd0000 [0165.246] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.247] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.247] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x119b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.247] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x119b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.247] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.247] GetProcessHeap () returned 0xfd0000 [0165.247] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.247] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0165.248] GetProcessHeap () returned 0xfd0000 [0165.248] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.248] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.248] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.248] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.248] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.249] GetProcessHeap () returned 0xfd0000 [0165.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.249] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0165.249] GetProcessHeap () returned 0xfd0000 [0165.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.249] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.249] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.249] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.249] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.249] GetProcessHeap () returned 0xfd0000 [0165.249] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.250] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0165.250] GetProcessHeap () returned 0xfd0000 [0165.250] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.250] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.250] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.251] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.251] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.251] GetProcessHeap () returned 0xfd0000 [0165.251] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.251] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0165.251] GetProcessHeap () returned 0xfd0000 [0165.251] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.252] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.252] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.252] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.252] GetProcessHeap () returned 0xfd0000 [0165.252] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.252] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0165.253] GetProcessHeap () returned 0xfd0000 [0165.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.253] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.253] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.253] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.253] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.253] GetProcessHeap () returned 0xfd0000 [0165.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.253] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0165.253] GetProcessHeap () returned 0xfd0000 [0165.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.254] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.254] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.254] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.254] GetProcessHeap () returned 0xfd0000 [0165.254] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.254] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0165.255] GetProcessHeap () returned 0xfd0000 [0165.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.255] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.255] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.255] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.255] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.255] GetProcessHeap () returned 0xfd0000 [0165.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.255] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0165.255] GetProcessHeap () returned 0xfd0000 [0165.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.256] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.256] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.256] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.256] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.256] GetProcessHeap () returned 0xfd0000 [0165.256] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.256] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0165.256] GetProcessHeap () returned 0xfd0000 [0165.256] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.257] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.257] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1143, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.257] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1143, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.257] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.257] GetProcessHeap () returned 0xfd0000 [0165.257] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.257] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0165.257] GetProcessHeap () returned 0xfd0000 [0165.258] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.258] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.258] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x127c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.258] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x127c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.258] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.259] GetProcessHeap () returned 0xfd0000 [0165.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.259] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0165.259] GetProcessHeap () returned 0xfd0000 [0165.259] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.259] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.259] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x127c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.260] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x127c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.260] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.260] GetProcessHeap () returned 0xfd0000 [0165.260] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.260] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0165.260] GetProcessHeap () returned 0xfd0000 [0165.260] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.261] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.261] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.261] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.261] GetProcessHeap () returned 0xfd0000 [0165.261] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.261] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0165.261] GetProcessHeap () returned 0xfd0000 [0165.261] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.262] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.262] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.262] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.262] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.262] GetProcessHeap () returned 0xfd0000 [0165.262] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.262] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0165.262] GetProcessHeap () returned 0xfd0000 [0165.262] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.264] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.264] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1245, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.264] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1245, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.264] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.265] GetProcessHeap () returned 0xfd0000 [0165.265] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.265] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0165.265] GetProcessHeap () returned 0xfd0000 [0165.265] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.265] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.266] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x119c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.266] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x119c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.266] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.266] GetProcessHeap () returned 0xfd0000 [0165.266] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.266] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0165.266] GetProcessHeap () returned 0xfd0000 [0165.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.266] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.266] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x130d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.266] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x130d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.267] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.267] GetProcessHeap () returned 0xfd0000 [0165.267] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.267] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0165.267] GetProcessHeap () returned 0xfd0000 [0165.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.268] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.268] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1359, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.268] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1359, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.268] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.268] GetProcessHeap () returned 0xfd0000 [0165.268] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.268] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0165.268] GetProcessHeap () returned 0xfd0000 [0165.268] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.269] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.269] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.269] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.269] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.269] GetProcessHeap () returned 0xfd0000 [0165.269] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.269] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0165.269] GetProcessHeap () returned 0xfd0000 [0165.269] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.269] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.269] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.270] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.270] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.368] GetProcessHeap () returned 0xfd0000 [0165.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.368] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0165.368] GetProcessHeap () returned 0xfd0000 [0165.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.369] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.369] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1165, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.370] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1165, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.370] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.370] GetProcessHeap () returned 0xfd0000 [0165.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.370] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0165.370] GetProcessHeap () returned 0xfd0000 [0165.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.371] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.371] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x111e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.371] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x111e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.371] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.371] GetProcessHeap () returned 0xfd0000 [0165.371] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.371] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0165.371] GetProcessHeap () returned 0xfd0000 [0165.371] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.372] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.372] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1237, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.372] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1237, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.372] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.372] GetProcessHeap () returned 0xfd0000 [0165.373] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.373] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0165.373] GetProcessHeap () returned 0xfd0000 [0165.373] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.373] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.373] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xfd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.373] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xfd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.373] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.373] GetProcessHeap () returned 0xfd0000 [0165.373] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.373] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0165.374] GetProcessHeap () returned 0xfd0000 [0165.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.374] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.374] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x17ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.374] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x17ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.374] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.374] GetProcessHeap () returned 0xfd0000 [0165.374] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.374] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0165.374] GetProcessHeap () returned 0xfd0000 [0165.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.375] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.375] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x120b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.375] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x120b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.375] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.375] GetProcessHeap () returned 0xfd0000 [0165.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.375] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0165.376] GetProcessHeap () returned 0xfd0000 [0165.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.376] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.376] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1143, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.376] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1143, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.376] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.377] GetProcessHeap () returned 0xfd0000 [0165.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.377] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0165.377] GetProcessHeap () returned 0xfd0000 [0165.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.377] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.377] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.377] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.377] GetProcessHeap () returned 0xfd0000 [0165.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.377] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0165.378] GetProcessHeap () returned 0xfd0000 [0165.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.378] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.378] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.378] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.378] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.378] GetProcessHeap () returned 0xfd0000 [0165.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.378] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0165.378] GetProcessHeap () returned 0xfd0000 [0165.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.379] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.379] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.379] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.379] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.379] GetProcessHeap () returned 0xfd0000 [0165.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.379] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.379] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0165.379] GetProcessHeap () returned 0xfd0000 [0165.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.380] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.380] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1713, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.380] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1713, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.380] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.380] GetProcessHeap () returned 0xfd0000 [0165.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.380] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0165.380] GetProcessHeap () returned 0xfd0000 [0165.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.381] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.381] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.381] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x11b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.381] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.381] GetProcessHeap () returned 0xfd0000 [0165.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.381] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0165.381] GetProcessHeap () returned 0xfd0000 [0165.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\ob-preview\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1213, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1213, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.382] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.382] GetProcessHeap () returned 0xfd0000 [0165.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.382] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0165.382] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0165.382] GetProcessHeap () returned 0xfd0000 [0165.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.382] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6b57, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0165.382] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0165.382] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0165.383] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0165.383] GetProcessHeap () returned 0xfd0000 [0165.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.384] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0165.384] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0165.389] GetProcessHeap () returned 0xfd0000 [0165.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0165.389] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="on-boarding", cAlternateFileName="ON-BOA~1")) returned 1 [0165.389] GetProcessHeap () returned 0xfd0000 [0165.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0165.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.391] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.391] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0165.391] GetProcessHeap () returned 0xfd0000 [0165.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.397] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.397] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0165.397] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb94e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0165.397] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb94e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0165.397] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.397] GetProcessHeap () returned 0xfd0000 [0165.397] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.397] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0165.397] GetProcessHeap () returned 0xfd0000 [0165.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.398] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.398] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 1 [0165.399] GetProcessHeap () returned 0xfd0000 [0165.399] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.401] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.402] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee2ed3e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee2ed3e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee2ed3e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd46, dwReserved0=0x0, dwReserved1=0x0, cFileName="a12-pdf.svg", cAlternateFileName="")) returned 1 [0165.402] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee2ed3e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee2ed3e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee2ed3e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="activate-more-tools-2x.png", cAlternateFileName="ACTIVA~2.PNG")) returned 1 [0165.402] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee08adc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee08adc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee08adc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x57b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="activate-more-tools.png", cAlternateFileName="ACTIVA~1.PNG")) returned 1 [0165.402] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee54f97, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee54f97, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee54f97, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add-comment-2x.png", cAlternateFileName="ADD-CO~1.PNG")) returned 1 [0165.403] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8c3495, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xef8c3495, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xef8c3495, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x42a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="add-comment.png", cAlternateFileName="ADD-CO~2.PNG")) returned 1 [0165.403] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6f9869, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xef6f9869, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xef76c0ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x52a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="beta-dynamic-pdf-2x.png", cAlternateFileName="BETA-D~2.PNG")) returned 1 [0165.403] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef52fc96, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xef52fc96, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xef52fc96, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x29ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="beta-dynamic-pdf.png", cAlternateFileName="BETA-D~1.PNG")) returned 1 [0165.403] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8c3495, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xef8c3495, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xef8c3495, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xae41, dwReserved0=0x0, dwReserved1=0x0, cFileName="beta-feedback-2x.png", cAlternateFileName="BETA-F~2.PNG")) returned 1 [0165.403] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee08adc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee08adc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee08adc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6836, dwReserved0=0x0, dwReserved1=0x0, cFileName="beta-feedback.png", cAlternateFileName="BETA-F~1.PNG")) returned 1 [0165.405] GetProcessHeap () returned 0xfd0000 [0165.405] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.407] GetProcessHeap () returned 0xfd0000 [0165.407] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\cs-cz\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.408] GetProcessHeap () returned 0xfd0000 [0165.408] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.408] GetProcessHeap () returned 0xfd0000 [0165.408] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\da-dk\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.408] GetProcessHeap () returned 0xfd0000 [0165.409] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.409] GetProcessHeap () returned 0xfd0000 [0165.409] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\de-de\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.409] GetProcessHeap () returned 0xfd0000 [0165.409] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.410] GetProcessHeap () returned 0xfd0000 [0165.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\en-us\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.410] GetProcessHeap () returned 0xfd0000 [0165.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.411] GetProcessHeap () returned 0xfd0000 [0165.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\es-es\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.411] GetProcessHeap () returned 0xfd0000 [0165.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.411] GetProcessHeap () returned 0xfd0000 [0165.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\fi-fi\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.412] GetProcessHeap () returned 0xfd0000 [0165.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.412] GetProcessHeap () returned 0xfd0000 [0165.413] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\fr-fr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.519] GetProcessHeap () returned 0xfd0000 [0165.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.525] GetProcessHeap () returned 0xfd0000 [0165.526] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\it-it\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.530] GetProcessHeap () returned 0xfd0000 [0165.530] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.530] GetProcessHeap () returned 0xfd0000 [0165.530] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\ja-jp\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0165.531] GetProcessHeap () returned 0xfd0000 [0165.531] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.531] GetProcessHeap () returned 0xfd0000 [0165.531] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\ko-kr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.532] GetProcessHeap () returned 0xfd0000 [0165.532] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.532] GetProcessHeap () returned 0xfd0000 [0165.532] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\nb-no\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.533] GetProcessHeap () returned 0xfd0000 [0165.533] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.533] GetProcessHeap () returned 0xfd0000 [0165.533] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\pl-pl\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.534] GetProcessHeap () returned 0xfd0000 [0165.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.534] GetProcessHeap () returned 0xfd0000 [0165.534] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\pt-br\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.535] GetProcessHeap () returned 0xfd0000 [0165.535] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.535] GetProcessHeap () returned 0xfd0000 [0165.535] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\ru-ru\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.536] GetProcessHeap () returned 0xfd0000 [0165.536] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.536] GetProcessHeap () returned 0xfd0000 [0165.536] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\sv-se\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.536] GetProcessHeap () returned 0xfd0000 [0165.536] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.536] GetProcessHeap () returned 0xfd0000 [0165.536] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\tr-tr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.537] GetProcessHeap () returned 0xfd0000 [0165.537] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.537] GetProcessHeap () returned 0xfd0000 [0165.537] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\zh-cn\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.538] GetProcessHeap () returned 0xfd0000 [0165.538] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.538] GetProcessHeap () returned 0xfd0000 [0165.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0165.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\images\\themeless\\Localized_images\\zh-tw\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.539] GetProcessHeap () returned 0xfd0000 [0165.539] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0165.539] GetProcessHeap () returned 0xfd0000 [0165.539] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.540] GetProcessHeap () returned 0xfd0000 [0165.540] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.541] GetProcessHeap () returned 0xfd0000 [0165.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.542] GetProcessHeap () returned 0xfd0000 [0165.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.543] GetProcessHeap () returned 0xfd0000 [0165.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.545] GetProcessHeap () returned 0xfd0000 [0165.545] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.546] GetProcessHeap () returned 0xfd0000 [0165.546] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.546] GetProcessHeap () returned 0xfd0000 [0165.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.547] GetProcessHeap () returned 0xfd0000 [0165.547] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.547] GetProcessHeap () returned 0xfd0000 [0165.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.549] GetProcessHeap () returned 0xfd0000 [0165.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.549] GetProcessHeap () returned 0xfd0000 [0165.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.549] GetProcessHeap () returned 0xfd0000 [0165.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.549] GetProcessHeap () returned 0xfd0000 [0165.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.550] GetProcessHeap () returned 0xfd0000 [0165.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.550] GetProcessHeap () returned 0xfd0000 [0165.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.551] GetProcessHeap () returned 0xfd0000 [0165.551] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.551] GetProcessHeap () returned 0xfd0000 [0165.551] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.552] GetProcessHeap () returned 0xfd0000 [0165.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.552] GetProcessHeap () returned 0xfd0000 [0165.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0165.553] GetProcessHeap () returned 0xfd0000 [0165.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.553] GetProcessHeap () returned 0xfd0000 [0165.553] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.553] GetProcessHeap () returned 0xfd0000 [0165.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.553] GetProcessHeap () returned 0xfd0000 [0165.553] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.554] GetProcessHeap () returned 0xfd0000 [0165.554] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.554] GetProcessHeap () returned 0xfd0000 [0165.554] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.555] GetProcessHeap () returned 0xfd0000 [0165.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.555] GetProcessHeap () returned 0xfd0000 [0165.555] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.556] GetProcessHeap () returned 0xfd0000 [0165.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.556] GetProcessHeap () returned 0xfd0000 [0165.556] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.556] GetProcessHeap () returned 0xfd0000 [0165.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.556] GetProcessHeap () returned 0xfd0000 [0165.556] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.557] GetProcessHeap () returned 0xfd0000 [0165.557] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.557] GetProcessHeap () returned 0xfd0000 [0165.557] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.558] GetProcessHeap () returned 0xfd0000 [0165.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.558] GetProcessHeap () returned 0xfd0000 [0165.558] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.559] GetProcessHeap () returned 0xfd0000 [0165.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.559] GetProcessHeap () returned 0xfd0000 [0165.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.560] GetProcessHeap () returned 0xfd0000 [0165.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.560] GetProcessHeap () returned 0xfd0000 [0165.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.560] GetProcessHeap () returned 0xfd0000 [0165.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.560] GetProcessHeap () returned 0xfd0000 [0165.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.561] GetProcessHeap () returned 0xfd0000 [0165.561] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.561] GetProcessHeap () returned 0xfd0000 [0165.561] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.562] GetProcessHeap () returned 0xfd0000 [0165.562] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.562] GetProcessHeap () returned 0xfd0000 [0165.562] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.563] GetProcessHeap () returned 0xfd0000 [0165.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.563] GetProcessHeap () returned 0xfd0000 [0165.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.564] GetProcessHeap () returned 0xfd0000 [0165.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.564] GetProcessHeap () returned 0xfd0000 [0165.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.564] GetProcessHeap () returned 0xfd0000 [0165.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.565] GetProcessHeap () returned 0xfd0000 [0165.565] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.565] GetProcessHeap () returned 0xfd0000 [0165.565] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.566] GetProcessHeap () returned 0xfd0000 [0165.566] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.566] GetProcessHeap () returned 0xfd0000 [0165.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.566] GetProcessHeap () returned 0xfd0000 [0165.566] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.567] GetProcessHeap () returned 0xfd0000 [0165.567] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.567] GetProcessHeap () returned 0xfd0000 [0165.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.569] GetProcessHeap () returned 0xfd0000 [0165.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.569] GetProcessHeap () returned 0xfd0000 [0165.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0165.569] GetProcessHeap () returned 0xfd0000 [0165.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.569] GetProcessHeap () returned 0xfd0000 [0165.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.570] GetProcessHeap () returned 0xfd0000 [0165.570] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.570] GetProcessHeap () returned 0xfd0000 [0165.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.570] GetProcessHeap () returned 0xfd0000 [0165.570] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.570] GetProcessHeap () returned 0xfd0000 [0165.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.690] GetProcessHeap () returned 0xfd0000 [0165.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.690] GetProcessHeap () returned 0xfd0000 [0165.690] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.724] GetProcessHeap () returned 0xfd0000 [0165.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.724] GetProcessHeap () returned 0xfd0000 [0165.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.726] GetProcessHeap () returned 0xfd0000 [0165.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.726] GetProcessHeap () returned 0xfd0000 [0165.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\on-boarding\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0165.726] GetProcessHeap () returned 0xfd0000 [0165.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.726] GetProcessHeap () returned 0xfd0000 [0165.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.726] GetProcessHeap () returned 0xfd0000 [0165.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.727] GetProcessHeap () returned 0xfd0000 [0165.727] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0165.728] GetProcessHeap () returned 0xfd0000 [0165.728] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0165.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.729] GetProcessHeap () returned 0xfd0000 [0165.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.731] GetProcessHeap () returned 0xfd0000 [0165.731] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.731] GetProcessHeap () returned 0xfd0000 [0165.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.733] GetProcessHeap () returned 0xfd0000 [0165.733] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.734] GetProcessHeap () returned 0xfd0000 [0165.734] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.737] GetProcessHeap () returned 0xfd0000 [0165.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.737] GetProcessHeap () returned 0xfd0000 [0165.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.737] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0165.737] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.737] GetProcessHeap () returned 0xfd0000 [0165.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.739] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0165.739] GetProcessHeap () returned 0xfd0000 [0165.739] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.741] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.741] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0165.741] GetProcessHeap () returned 0xfd0000 [0165.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.743] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.743] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0165.744] GetProcessHeap () returned 0xfd0000 [0165.744] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.744] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.744] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.745] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.745] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.745] GetProcessHeap () returned 0xfd0000 [0165.745] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.745] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0165.745] GetProcessHeap () returned 0xfd0000 [0165.745] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.746] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.746] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.746] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.746] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.746] GetProcessHeap () returned 0xfd0000 [0165.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.746] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0165.746] GetProcessHeap () returned 0xfd0000 [0165.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.747] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.747] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.747] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.747] GetProcessHeap () returned 0xfd0000 [0165.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.747] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0165.747] GetProcessHeap () returned 0xfd0000 [0165.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.748] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.748] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.748] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.748] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.748] GetProcessHeap () returned 0xfd0000 [0165.748] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.748] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0165.748] GetProcessHeap () returned 0xfd0000 [0165.748] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0165.749] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.749] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.749] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.749] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0165.749] GetProcessHeap () returned 0xfd0000 [0165.749] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.749] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0165.749] GetProcessHeap () returned 0xfd0000 [0165.750] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.750] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.750] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.750] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.751] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.751] GetProcessHeap () returned 0xfd0000 [0165.751] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.751] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0165.751] GetProcessHeap () returned 0xfd0000 [0165.751] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.751] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.751] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.751] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.751] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.752] GetProcessHeap () returned 0xfd0000 [0165.752] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.752] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0165.752] GetProcessHeap () returned 0xfd0000 [0165.752] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.753] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.753] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.753] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.753] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.753] GetProcessHeap () returned 0xfd0000 [0165.753] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.753] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0165.753] GetProcessHeap () returned 0xfd0000 [0165.753] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.754] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.754] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.754] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.754] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.754] GetProcessHeap () returned 0xfd0000 [0165.754] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.754] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0165.754] GetProcessHeap () returned 0xfd0000 [0165.754] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.755] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.755] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.755] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.755] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.755] GetProcessHeap () returned 0xfd0000 [0165.755] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.755] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0165.755] GetProcessHeap () returned 0xfd0000 [0165.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.756] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.756] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.756] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.756] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.756] GetProcessHeap () returned 0xfd0000 [0165.756] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.757] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0165.757] GetProcessHeap () returned 0xfd0000 [0165.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.757] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.757] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.757] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.757] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.757] GetProcessHeap () returned 0xfd0000 [0165.757] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.757] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0165.757] GetProcessHeap () returned 0xfd0000 [0165.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.758] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.758] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.758] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.758] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.758] GetProcessHeap () returned 0xfd0000 [0165.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.758] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.758] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.758] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0165.758] GetProcessHeap () returned 0xfd0000 [0165.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.759] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0165.759] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0165.759] GetProcessHeap () returned 0xfd0000 [0165.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.759] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.759] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0165.760] GetProcessHeap () returned 0xfd0000 [0165.760] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\pages-app\\js\\plugins\\rhp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.760] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.760] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="pages-app-selector.js", cAlternateFileName="PAGES-~1.JS")) returned 1 [0165.760] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="pages-app-tool-view.js", cAlternateFileName="PAGES-~2.JS")) returned 1 [0165.760] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="pages-app-tool-view.js", cAlternateFileName="PAGES-~2.JS")) returned 0 [0165.760] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.760] GetProcessHeap () returned 0xfd0000 [0165.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.760] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0165.760] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.761] GetProcessHeap () returned 0xfd0000 [0165.761] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.761] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0165.761] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.761] GetProcessHeap () returned 0xfd0000 [0165.761] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0165.889] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0165.894] GetProcessHeap () returned 0xfd0000 [0165.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0165.900] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sample-files", cAlternateFileName="SAMPLE~1")) returned 1 [0165.900] GetProcessHeap () returned 0xfd0000 [0165.900] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0165.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0165.902] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.902] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assets", cAlternateFileName="")) returned 1 [0165.902] GetProcessHeap () returned 0xfd0000 [0165.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.904] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Files", cAlternateFileName="SAMPLE~1")) returned 1 [0165.904] GetProcessHeap () returned 0xfd0000 [0165.904] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\assets\\Sample Files\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.906] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.906] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x44a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Sign White Paper.pdf", cAlternateFileName="ADOBES~1.PDF")) returned 1 [0165.906] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Cloud for Government.pdf", cAlternateFileName="DOCUME~1.PDF")) returned 1 [0165.906] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x136db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travelocity.pdf", cAlternateFileName="TRAVEL~1.PDF")) returned 1 [0165.906] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x136db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travelocity.pdf", cAlternateFileName="TRAVEL~1.PDF")) returned 0 [0165.906] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0165.907] GetProcessHeap () returned 0xfd0000 [0165.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Files", cAlternateFileName="SAMPLE~1")) returned 0 [0165.907] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.907] GetProcessHeap () returned 0xfd0000 [0165.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0165.907] GetProcessHeap () returned 0xfd0000 [0165.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.908] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0165.908] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0165.909] GetProcessHeap () returned 0xfd0000 [0165.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0165.909] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0165.909] GetProcessHeap () returned 0xfd0000 [0165.909] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0165.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0165.909] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.909] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0165.909] GetProcessHeap () returned 0xfd0000 [0165.909] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0165.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0165.911] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.911] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0165.911] GetProcessHeap () returned 0xfd0000 [0165.911] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.912] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.912] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.912] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.912] GetProcessHeap () returned 0xfd0000 [0165.912] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.912] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0165.913] GetProcessHeap () returned 0xfd0000 [0165.913] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.914] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.914] GetProcessHeap () returned 0xfd0000 [0165.914] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.914] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0165.914] GetProcessHeap () returned 0xfd0000 [0165.914] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.914] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.915] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.915] GetProcessHeap () returned 0xfd0000 [0165.915] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.915] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0165.915] GetProcessHeap () returned 0xfd0000 [0165.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.916] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.916] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.916] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.916] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.916] GetProcessHeap () returned 0xfd0000 [0165.916] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.916] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0165.916] GetProcessHeap () returned 0xfd0000 [0165.917] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.917] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.917] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.917] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.917] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.919] GetProcessHeap () returned 0xfd0000 [0165.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.920] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0165.920] GetProcessHeap () returned 0xfd0000 [0165.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.920] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.920] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.921] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.921] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.921] GetProcessHeap () returned 0xfd0000 [0165.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.921] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0165.921] GetProcessHeap () returned 0xfd0000 [0165.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.921] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.921] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.921] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.921] GetProcessHeap () returned 0xfd0000 [0165.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.922] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0165.922] GetProcessHeap () returned 0xfd0000 [0165.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.922] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.922] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.923] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.923] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.923] GetProcessHeap () returned 0xfd0000 [0165.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.923] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0165.923] GetProcessHeap () returned 0xfd0000 [0165.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.923] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.923] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.923] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.923] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.924] GetProcessHeap () returned 0xfd0000 [0165.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.924] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0165.924] GetProcessHeap () returned 0xfd0000 [0165.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.924] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.924] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.924] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.924] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.924] GetProcessHeap () returned 0xfd0000 [0165.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.924] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0165.924] GetProcessHeap () returned 0xfd0000 [0165.925] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.925] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.925] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.925] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.925] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.926] GetProcessHeap () returned 0xfd0000 [0165.926] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.926] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0165.926] GetProcessHeap () returned 0xfd0000 [0165.926] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.927] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.927] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.927] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.927] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.927] GetProcessHeap () returned 0xfd0000 [0165.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.927] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0165.927] GetProcessHeap () returned 0xfd0000 [0165.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.928] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.928] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.928] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.928] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.928] GetProcessHeap () returned 0xfd0000 [0165.928] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.928] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0165.928] GetProcessHeap () returned 0xfd0000 [0165.928] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.929] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.929] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.929] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.929] GetProcessHeap () returned 0xfd0000 [0165.929] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.929] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0165.929] GetProcessHeap () returned 0xfd0000 [0165.929] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0165.930] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.930] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.930] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.930] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0165.930] GetProcessHeap () returned 0xfd0000 [0165.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.930] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0165.930] GetProcessHeap () returned 0xfd0000 [0165.930] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.931] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.931] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.931] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.931] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.931] GetProcessHeap () returned 0xfd0000 [0165.931] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.931] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0165.931] GetProcessHeap () returned 0xfd0000 [0165.931] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.933] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.933] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.933] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.933] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.933] GetProcessHeap () returned 0xfd0000 [0165.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.933] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0165.933] GetProcessHeap () returned 0xfd0000 [0165.933] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.934] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.934] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.934] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.934] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.934] GetProcessHeap () returned 0xfd0000 [0165.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.934] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0165.935] GetProcessHeap () returned 0xfd0000 [0165.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0165.935] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.936] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.936] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.936] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0165.936] GetProcessHeap () returned 0xfd0000 [0165.936] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.936] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0165.936] GetProcessHeap () returned 0xfd0000 [0165.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0165.937] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.937] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.937] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.937] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0165.937] GetProcessHeap () returned 0xfd0000 [0165.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.937] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0165.937] GetProcessHeap () returned 0xfd0000 [0165.937] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.938] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.938] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.938] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.938] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.938] GetProcessHeap () returned 0xfd0000 [0165.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.938] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0165.938] GetProcessHeap () returned 0xfd0000 [0165.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0165.939] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.939] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.939] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.939] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0165.939] GetProcessHeap () returned 0xfd0000 [0165.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.939] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0165.939] GetProcessHeap () returned 0xfd0000 [0165.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0165.940] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.940] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.940] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.940] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0165.940] GetProcessHeap () returned 0xfd0000 [0165.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.940] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0165.940] GetProcessHeap () returned 0xfd0000 [0165.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0165.941] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.941] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0165.941] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0165.941] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0165.941] GetProcessHeap () returned 0xfd0000 [0165.941] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0165.941] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0165.941] GetProcessHeap () returned 0xfd0000 [0165.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0165.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.093] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.093] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.093] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.093] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0166.093] GetProcessHeap () returned 0xfd0000 [0166.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.093] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0166.093] GetProcessHeap () returned 0xfd0000 [0166.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.093] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.094] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.094] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.094] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.094] GetProcessHeap () returned 0xfd0000 [0166.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.094] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0166.094] GetProcessHeap () returned 0xfd0000 [0166.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.095] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.095] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.095] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.095] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.095] GetProcessHeap () returned 0xfd0000 [0166.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.095] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0166.095] GetProcessHeap () returned 0xfd0000 [0166.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.096] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.096] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.096] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.096] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.096] GetProcessHeap () returned 0xfd0000 [0166.096] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.096] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0166.096] GetProcessHeap () returned 0xfd0000 [0166.096] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.097] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.097] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.097] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0166.097] GetProcessHeap () returned 0xfd0000 [0166.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.097] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0166.097] GetProcessHeap () returned 0xfd0000 [0166.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.098] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.098] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.098] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.098] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0166.098] GetProcessHeap () returned 0xfd0000 [0166.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.098] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0166.098] GetProcessHeap () returned 0xfd0000 [0166.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0166.099] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.099] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x385, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.099] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x385, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.099] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0166.099] GetProcessHeap () returned 0xfd0000 [0166.099] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.099] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.099] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0166.099] GetProcessHeap () returned 0xfd0000 [0166.099] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.100] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.100] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.100] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.100] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0166.100] GetProcessHeap () returned 0xfd0000 [0166.100] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.100] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0166.101] GetProcessHeap () returned 0xfd0000 [0166.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.101] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.101] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.101] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.101] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.101] GetProcessHeap () returned 0xfd0000 [0166.101] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.101] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0166.101] GetProcessHeap () returned 0xfd0000 [0166.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\sample-files\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.102] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.102] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.102] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.102] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.102] GetProcessHeap () returned 0xfd0000 [0166.102] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.102] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0166.102] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.103] GetProcessHeap () returned 0xfd0000 [0166.103] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.103] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0166.103] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb56, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0166.103] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb56, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0166.111] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0166.112] GetProcessHeap () returned 0xfd0000 [0166.112] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.113] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0166.113] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.113] GetProcessHeap () returned 0xfd0000 [0166.113] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0166.114] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan-files", cAlternateFileName="SCAN-F~1")) returned 1 [0166.114] GetProcessHeap () returned 0xfd0000 [0166.114] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0166.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.119] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.119] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0166.120] GetProcessHeap () returned 0xfd0000 [0166.120] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.121] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.121] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0166.121] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x74f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0166.121] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x74f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0166.121] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.122] GetProcessHeap () returned 0xfd0000 [0166.122] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.122] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0166.122] GetProcessHeap () returned 0xfd0000 [0166.122] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.122] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.122] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 1 [0166.122] GetProcessHeap () returned 0xfd0000 [0166.122] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.124] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.125] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb5a07c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb5a07c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb5a07c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appstore", cAlternateFileName="")) returned 1 [0166.125] GetProcessHeap () returned 0xfd0000 [0166.125] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\Appstore\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb5a07c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb5a07c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.127] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb5a07c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb5a07c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb5a07c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb5a07c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb5a07c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_cs_135x40.svg", cAlternateFileName="DO859B~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_da_135x40.svg", cAlternateFileName="DO6927~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x461d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_de_135x40.svg", cAlternateFileName="DO8184~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_en_135x40.svg", cAlternateFileName="DO3870~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5db2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_es_135x40.svg", cAlternateFileName="DO4020~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb5a07c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb5a07c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb5a07c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_fi_135x40.svg", cAlternateFileName="DOWNLO~3.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6838, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_fr_135x40.svg", cAlternateFileName="DOA8E2~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_it_135x40.svg", cAlternateFileName="DO92D8~1.SVG")) returned 1 [0166.128] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x452e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download_on_the_App_Store_Badge_ja_135x40.svg", cAlternateFileName="DO7114~1.SVG")) returned 1 [0166.129] GetProcessHeap () returned 0xfd0000 [0166.129] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.129] GetProcessHeap () returned 0xfd0000 [0166.129] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\images\\themeless\\Playstore\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb5a07c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.133] GetProcessHeap () returned 0xfd0000 [0166.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.133] GetProcessHeap () returned 0xfd0000 [0166.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.133] GetProcessHeap () returned 0xfd0000 [0166.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.135] GetProcessHeap () returned 0xfd0000 [0166.135] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.137] GetProcessHeap () returned 0xfd0000 [0166.137] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.347] GetProcessHeap () returned 0xfd0000 [0166.347] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.348] GetProcessHeap () returned 0xfd0000 [0166.348] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.348] GetProcessHeap () returned 0xfd0000 [0166.348] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.349] GetProcessHeap () returned 0xfd0000 [0166.349] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.349] GetProcessHeap () returned 0xfd0000 [0166.349] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.350] GetProcessHeap () returned 0xfd0000 [0166.350] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.350] GetProcessHeap () returned 0xfd0000 [0166.350] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.351] GetProcessHeap () returned 0xfd0000 [0166.351] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.351] GetProcessHeap () returned 0xfd0000 [0166.351] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.352] GetProcessHeap () returned 0xfd0000 [0166.352] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.352] GetProcessHeap () returned 0xfd0000 [0166.352] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0166.353] GetProcessHeap () returned 0xfd0000 [0166.353] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.353] GetProcessHeap () returned 0xfd0000 [0166.353] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.353] GetProcessHeap () returned 0xfd0000 [0166.353] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.353] GetProcessHeap () returned 0xfd0000 [0166.353] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.354] GetProcessHeap () returned 0xfd0000 [0166.354] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.354] GetProcessHeap () returned 0xfd0000 [0166.354] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0166.355] GetProcessHeap () returned 0xfd0000 [0166.355] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.355] GetProcessHeap () returned 0xfd0000 [0166.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.356] GetProcessHeap () returned 0xfd0000 [0166.356] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.356] GetProcessHeap () returned 0xfd0000 [0166.356] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.357] GetProcessHeap () returned 0xfd0000 [0166.357] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.357] GetProcessHeap () returned 0xfd0000 [0166.357] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.358] GetProcessHeap () returned 0xfd0000 [0166.358] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.358] GetProcessHeap () returned 0xfd0000 [0166.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.358] GetProcessHeap () returned 0xfd0000 [0166.358] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.359] GetProcessHeap () returned 0xfd0000 [0166.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.359] GetProcessHeap () returned 0xfd0000 [0166.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.359] GetProcessHeap () returned 0xfd0000 [0166.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.362] GetProcessHeap () returned 0xfd0000 [0166.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.362] GetProcessHeap () returned 0xfd0000 [0166.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.363] GetProcessHeap () returned 0xfd0000 [0166.363] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.363] GetProcessHeap () returned 0xfd0000 [0166.363] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.363] GetProcessHeap () returned 0xfd0000 [0166.363] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.363] GetProcessHeap () returned 0xfd0000 [0166.363] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.365] GetProcessHeap () returned 0xfd0000 [0166.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.365] GetProcessHeap () returned 0xfd0000 [0166.365] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.366] GetProcessHeap () returned 0xfd0000 [0166.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.366] GetProcessHeap () returned 0xfd0000 [0166.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.367] GetProcessHeap () returned 0xfd0000 [0166.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.367] GetProcessHeap () returned 0xfd0000 [0166.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.367] GetProcessHeap () returned 0xfd0000 [0166.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.367] GetProcessHeap () returned 0xfd0000 [0166.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.368] GetProcessHeap () returned 0xfd0000 [0166.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.368] GetProcessHeap () returned 0xfd0000 [0166.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.369] GetProcessHeap () returned 0xfd0000 [0166.369] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.369] GetProcessHeap () returned 0xfd0000 [0166.369] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.370] GetProcessHeap () returned 0xfd0000 [0166.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.370] GetProcessHeap () returned 0xfd0000 [0166.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.370] GetProcessHeap () returned 0xfd0000 [0166.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.370] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0166.370] GetProcessHeap () returned 0xfd0000 [0166.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0166.371] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.371] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.371] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.371] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0166.371] GetProcessHeap () returned 0xfd0000 [0166.371] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.371] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0166.372] GetProcessHeap () returned 0xfd0000 [0166.372] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.372] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.372] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.372] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.372] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.373] GetProcessHeap () returned 0xfd0000 [0166.373] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.373] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0166.373] GetProcessHeap () returned 0xfd0000 [0166.373] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.373] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.373] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.373] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.374] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0166.374] GetProcessHeap () returned 0xfd0000 [0166.374] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.374] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0166.374] GetProcessHeap () returned 0xfd0000 [0166.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.376] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.376] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.376] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0166.376] GetProcessHeap () returned 0xfd0000 [0166.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.376] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0166.376] GetProcessHeap () returned 0xfd0000 [0166.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.377] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.377] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.377] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.377] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0166.377] GetProcessHeap () returned 0xfd0000 [0166.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.377] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0166.377] GetProcessHeap () returned 0xfd0000 [0166.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.378] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.378] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.378] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.378] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.378] GetProcessHeap () returned 0xfd0000 [0166.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.378] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.378] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0166.378] GetProcessHeap () returned 0xfd0000 [0166.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.379] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.379] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.379] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.379] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.379] GetProcessHeap () returned 0xfd0000 [0166.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.379] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0166.379] GetProcessHeap () returned 0xfd0000 [0166.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.380] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.380] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0166.380] GetProcessHeap () returned 0xfd0000 [0166.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.380] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0166.380] GetProcessHeap () returned 0xfd0000 [0166.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.380] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.380] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.381] GetProcessHeap () returned 0xfd0000 [0166.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.381] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0166.381] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.381] GetProcessHeap () returned 0xfd0000 [0166.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.381] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x49d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0166.381] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0166.381] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0166.381] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.381] GetProcessHeap () returned 0xfd0000 [0166.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.382] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0166.382] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.383] GetProcessHeap () returned 0xfd0000 [0166.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0166.383] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="send-for-sign", cAlternateFileName="SEND-F~1")) returned 1 [0166.383] GetProcessHeap () returned 0xfd0000 [0166.383] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0166.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0166.384] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.384] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0166.384] GetProcessHeap () returned 0xfd0000 [0166.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0166.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x62aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0166.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x62aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0166.386] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0166.386] GetProcessHeap () returned 0xfd0000 [0166.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.386] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0166.386] GetProcessHeap () returned 0xfd0000 [0166.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.558] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.558] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_secured.png", cAlternateFileName="CLOUD_~2.PNG")) returned 1 [0166.558] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_secured_lg.png", cAlternateFileName="CLOUD_~1.PNG")) returned 1 [0166.558] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x239e, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_icons.png", cAlternateFileName="CORE_I~1.PNG")) returned 1 [0166.558] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1880, dwReserved0=0x0, dwReserved1=0x0, cFileName="faf_icons.png", cAlternateFileName="FAF_IC~1.PNG")) returned 1 [0166.558] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="progress.gif", cAlternateFileName="")) returned 1 [0166.559] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0166.559] GetProcessHeap () returned 0xfd0000 [0166.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.561] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.561] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0166.561] GetProcessHeap () returned 0xfd0000 [0166.562] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.564] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.564] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_secured.png", cAlternateFileName="CLOUD_~2.PNG")) returned 1 [0166.564] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_secured_lg.png", cAlternateFileName="CLOUD_~1.PNG")) returned 1 [0166.564] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x239e, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_icons.png", cAlternateFileName="CORE_I~1.PNG")) returned 1 [0166.564] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1880, dwReserved0=0x0, dwReserved1=0x0, cFileName="faf_icons.png", cAlternateFileName="FAF_IC~1.PNG")) returned 1 [0166.565] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="progress.gif", cAlternateFileName="")) returned 1 [0166.565] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="progress.gif", cAlternateFileName="")) returned 0 [0166.565] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0166.565] GetProcessHeap () returned 0xfd0000 [0166.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.566] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0166.566] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.566] GetProcessHeap () returned 0xfd0000 [0166.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.566] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0166.566] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.566] GetProcessHeap () returned 0xfd0000 [0166.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.567] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0166.567] GetProcessHeap () returned 0xfd0000 [0166.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0166.569] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.569] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0166.569] GetProcessHeap () returned 0xfd0000 [0166.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.572] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.572] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0166.572] GetProcessHeap () returned 0xfd0000 [0166.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ar-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.573] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.573] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.573] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.573] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.573] GetProcessHeap () returned 0xfd0000 [0166.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.573] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0166.573] GetProcessHeap () returned 0xfd0000 [0166.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ca-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.574] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.574] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.574] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.575] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.575] GetProcessHeap () returned 0xfd0000 [0166.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.575] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0166.575] GetProcessHeap () returned 0xfd0000 [0166.575] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\cs-cz\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.575] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.575] GetProcessHeap () returned 0xfd0000 [0166.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.575] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0166.575] GetProcessHeap () returned 0xfd0000 [0166.576] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.576] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.576] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1931, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.576] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1931, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.576] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.577] GetProcessHeap () returned 0xfd0000 [0166.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.577] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0166.577] GetProcessHeap () returned 0xfd0000 [0166.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.578] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.578] GetProcessHeap () returned 0xfd0000 [0166.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.578] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0166.578] GetProcessHeap () returned 0xfd0000 [0166.578] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-ae\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.579] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.579] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.579] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.579] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.579] GetProcessHeap () returned 0xfd0000 [0166.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.579] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0166.579] GetProcessHeap () returned 0xfd0000 [0166.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.580] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.580] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.580] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.580] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.580] GetProcessHeap () returned 0xfd0000 [0166.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.580] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0166.581] GetProcessHeap () returned 0xfd0000 [0166.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\en-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.581] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.581] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.581] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.582] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.582] GetProcessHeap () returned 0xfd0000 [0166.582] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0166.582] GetProcessHeap () returned 0xfd0000 [0166.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.582] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.582] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.582] GetProcessHeap () returned 0xfd0000 [0166.582] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0166.583] GetProcessHeap () returned 0xfd0000 [0166.583] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\eu-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.583] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.583] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.583] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.584] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.584] GetProcessHeap () returned 0xfd0000 [0166.584] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.584] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0166.584] GetProcessHeap () returned 0xfd0000 [0166.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.584] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.584] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.584] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.584] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.584] GetProcessHeap () returned 0xfd0000 [0166.584] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.585] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0166.585] GetProcessHeap () returned 0xfd0000 [0166.585] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.585] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.585] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.585] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.585] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.586] GetProcessHeap () returned 0xfd0000 [0166.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.586] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0166.586] GetProcessHeap () returned 0xfd0000 [0166.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\fr-ma\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.586] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.586] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.586] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.586] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.586] GetProcessHeap () returned 0xfd0000 [0166.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.586] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0166.586] GetProcessHeap () returned 0xfd0000 [0166.587] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\he-il\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.587] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.587] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.587] GetProcessHeap () returned 0xfd0000 [0166.587] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0166.587] GetProcessHeap () returned 0xfd0000 [0166.587] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hr-hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.588] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.588] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.588] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.588] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.588] GetProcessHeap () returned 0xfd0000 [0166.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.588] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0166.588] GetProcessHeap () returned 0xfd0000 [0166.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\hu-hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.589] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.589] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c19, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.589] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1c19, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.589] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.589] GetProcessHeap () returned 0xfd0000 [0166.589] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.589] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0166.590] GetProcessHeap () returned 0xfd0000 [0166.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.590] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.590] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.590] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.590] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.590] GetProcessHeap () returned 0xfd0000 [0166.590] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.590] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0166.590] GetProcessHeap () returned 0xfd0000 [0166.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.591] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.591] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.591] GetProcessHeap () returned 0xfd0000 [0166.591] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0166.591] GetProcessHeap () returned 0xfd0000 [0166.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ko-kr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.592] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.592] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.592] GetProcessHeap () returned 0xfd0000 [0166.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0166.592] GetProcessHeap () returned 0xfd0000 [0166.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.593] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.593] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1926, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.593] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1926, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.594] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.595] GetProcessHeap () returned 0xfd0000 [0166.595] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0166.595] GetProcessHeap () returned 0xfd0000 [0166.595] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.595] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.595] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.595] GetProcessHeap () returned 0xfd0000 [0166.595] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0166.596] GetProcessHeap () returned 0xfd0000 [0166.596] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pl-pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.596] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ab6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ab6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.596] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.597] GetProcessHeap () returned 0xfd0000 [0166.597] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.597] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0166.597] GetProcessHeap () returned 0xfd0000 [0166.597] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0166.597] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.597] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.598] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.598] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0166.598] GetProcessHeap () returned 0xfd0000 [0166.598] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.598] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0166.598] GetProcessHeap () returned 0xfd0000 [0166.598] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ro-ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.782] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.782] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.782] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1ba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.782] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.782] GetProcessHeap () returned 0xfd0000 [0166.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.782] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0166.783] GetProcessHeap () returned 0xfd0000 [0166.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.783] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.783] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x185a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.783] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x185a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.783] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0166.783] GetProcessHeap () returned 0xfd0000 [0166.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.783] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0166.783] GetProcessHeap () returned 0xfd0000 [0166.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\ru-ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.784] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.784] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2508, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.784] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2508, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.784] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.784] GetProcessHeap () returned 0xfd0000 [0166.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.784] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0166.784] GetProcessHeap () returned 0xfd0000 [0166.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sk-sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.785] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.785] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.785] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.785] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.786] GetProcessHeap () returned 0xfd0000 [0166.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.786] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0166.786] GetProcessHeap () returned 0xfd0000 [0166.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.786] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.786] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.786] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.786] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.786] GetProcessHeap () returned 0xfd0000 [0166.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.786] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0166.786] GetProcessHeap () returned 0xfd0000 [0166.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sl-sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.787] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.787] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.787] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.787] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.787] GetProcessHeap () returned 0xfd0000 [0166.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.787] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0166.787] GetProcessHeap () returned 0xfd0000 [0166.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.788] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.788] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.788] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.788] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0166.788] GetProcessHeap () returned 0xfd0000 [0166.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0166.789] GetProcessHeap () returned 0xfd0000 [0166.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\tr-tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.789] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.789] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.789] GetProcessHeap () returned 0xfd0000 [0166.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0166.789] GetProcessHeap () returned 0xfd0000 [0166.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\uk-ua\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.790] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.790] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2558, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.790] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2558, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.790] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.790] GetProcessHeap () returned 0xfd0000 [0166.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.790] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0166.790] GetProcessHeap () returned 0xfd0000 [0166.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-cn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.790] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.790] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x182c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.791] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x182c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.791] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.791] GetProcessHeap () returned 0xfd0000 [0166.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.791] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0166.791] GetProcessHeap () returned 0xfd0000 [0166.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\send-for-sign\\js\\nls\\zh-tw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.791] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.791] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1840, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0166.791] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1840, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0166.791] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.791] GetProcessHeap () returned 0xfd0000 [0166.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.791] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0166.791] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0166.792] GetProcessHeap () returned 0xfd0000 [0166.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.792] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3506b, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0166.792] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x203d, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0166.792] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x203d, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0166.792] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0166.792] GetProcessHeap () returned 0xfd0000 [0166.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.793] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0166.793] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0166.793] GetProcessHeap () returned 0xfd0000 [0166.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0166.793] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 1 [0166.793] GetProcessHeap () returned 0xfd0000 [0166.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0166.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0166.794] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.794] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0166.795] GetProcessHeap () returned 0xfd0000 [0166.795] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.796] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.796] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.796] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.796] GetProcessHeap () returned 0xfd0000 [0166.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.796] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0166.797] GetProcessHeap () returned 0xfd0000 [0166.797] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="adc_logo.png", cAlternateFileName="")) returned 1 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0416745, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0416745, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf043c9a8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe_spinner.gif", cAlternateFileName="ADOBE_~1.GIF")) returned 1 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7394, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_icons.png", cAlternateFileName="CORE_I~2.PNG")) returned 1 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0416745, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0416745, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x104ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_icons_retina.png", cAlternateFileName="CORE_I~1.PNG")) returned 1 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf062c878, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf062c878, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="download-btn.png", cAlternateFileName="DOWNLO~1.PNG")) returned 1 [0166.808] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="email", cAlternateFileName="")) returned 1 [0166.808] GetProcessHeap () returned 0xfd0000 [0166.808] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="adc_logo.png", cAlternateFileName="")) returned 1 [0166.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe_logo.png", cAlternateFileName="ADOBE_~1.PNG")) returned 1 [0166.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x101c, dwReserved0=0x0, dwReserved1=0x0, cFileName="dc_logo.png", cAlternateFileName="")) returned 1 [0166.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dummy", cAlternateFileName="")) returned 1 [0166.821] GetProcessHeap () returned 0xfd0000 [0166.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\dummy\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8bd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe-old-logo.jpg", cAlternateFileName="ADOBE-~1.JPG")) returned 1 [0166.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="fake_logo.png", cAlternateFileName="FAKE_L~1.PNG")) returned 1 [0166.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="fake_logo.png", cAlternateFileName="FAKE_L~1.PNG")) returned 0 [0166.822] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.822] GetProcessHeap () returned 0xfd0000 [0166.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.822] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="empty.png", cAlternateFileName="")) returned 1 [0166.822] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0166.822] GetProcessHeap () returned 0xfd0000 [0166.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.825] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.825] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0166.825] GetProcessHeap () returned 0xfd0000 [0166.825] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0166.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\email\\themes\\dark\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0166.826] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.826] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="adc_logo.png", cAlternateFileName="")) returned 1 [0166.826] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe_logo.png", cAlternateFileName="ADOBE_~1.PNG")) returned 1 [0166.826] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobe_logo.png", cAlternateFileName="ADOBE_~1.PNG")) returned 0 [0166.826] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0166.826] GetProcessHeap () returned 0xfd0000 [0166.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0166.826] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0166.826] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0166.826] GetProcessHeap () returned 0xfd0000 [0166.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.826] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0166.826] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0166.826] GetProcessHeap () returned 0xfd0000 [0166.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.828] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="file_info.png", cAlternateFileName="FILE_I~1.PNG")) returned 1 [0166.828] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf062c878, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf062c878, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="file_info2x.png", cAlternateFileName="FILE_I~2.PNG")) returned 1 [0166.828] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf062c878, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf062c878, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd43, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0166.828] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf043c9a8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf043c9a8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations_retina.png", cAlternateFileName="ILLUST~1.PNG")) returned 1 [0166.828] GetProcessHeap () returned 0xfd0000 [0166.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.833] GetProcessHeap () returned 0xfd0000 [0166.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0166.839] GetProcessHeap () returned 0xfd0000 [0166.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0166.839] GetProcessHeap () returned 0xfd0000 [0166.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0166.839] GetProcessHeap () returned 0xfd0000 [0166.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0166.840] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0166.840] GetProcessHeap () returned 0xfd0000 [0166.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0166.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0166.848] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.848] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0166.848] GetProcessHeap () returned 0xfd0000 [0166.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0166.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0166.855] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.855] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 1 [0166.855] GetProcessHeap () returned 0xfd0000 [0166.855] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0166.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0166.860] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.860] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0166.860] GetProcessHeap () returned 0xfd0000 [0166.860] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0166.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0166.865] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.866] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop-tool-view.css", cAlternateFileName="DESKTO~1.CSS")) returned 1 [0166.866] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="home-selector.css", cAlternateFileName="HOME-S~1.CSS")) returned 1 [0166.866] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x494f, dwReserved0=0x0, dwReserved1=0x0, cFileName="home-view.css", cAlternateFileName="HOME-V~1.CSS")) returned 1 [0166.866] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool-selector.css", cAlternateFileName="TOOL-S~1.CSS")) returned 1 [0166.866] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x602a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool-view.css", cAlternateFileName="TOOL-V~1.CSS")) returned 1 [0166.866] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x602a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool-view.css", cAlternateFileName="TOOL-V~1.CSS")) returned 0 [0166.866] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0166.867] GetProcessHeap () returned 0xfd0000 [0166.867] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0166.867] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0166.867] GetProcessHeap () returned 0xfd0000 [0166.867] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0166.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bun.png", cAlternateFileName="")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cstm_brand_preview.png", cAlternateFileName="CSTM_B~1.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1233, dwReserved0=0x0, dwReserved1=0x0, cFileName="cstm_brand_preview2x.png", cAlternateFileName="CSTM_B~2.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="dd_arrow_small.png", cAlternateFileName="DD_ARR~2.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="dd_arrow_small2x.png", cAlternateFileName="DD_ARR~1.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="nub.png", cAlternateFileName="")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sat_logo.png", cAlternateFileName="")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x622, dwReserved0=0x0, dwReserved1=0x0, cFileName="sat_logo_2x.png", cAlternateFileName="SAT_LO~1.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="share_icons.png", cAlternateFileName="SHARE_~1.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="share_icons2x.png", cAlternateFileName="SHARE_~2.PNG")) returned 1 [0167.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0167.148] GetProcessHeap () returned 0xfd0000 [0167.148] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.148] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.148] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0167.149] GetProcessHeap () returned 0xfd0000 [0167.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0167.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\images\\themes\\dark\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.152] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.152] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bun.png", cAlternateFileName="")) returned 1 [0167.152] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cstm_brand_preview.png", cAlternateFileName="CSTM_B~1.PNG")) returned 1 [0167.152] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1233, dwReserved0=0x0, dwReserved1=0x0, cFileName="cstm_brand_preview2x.png", cAlternateFileName="CSTM_B~2.PNG")) returned 1 [0167.152] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="dd_arrow_small.png", cAlternateFileName="DD_ARR~2.PNG")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="dd_arrow_small2x.png", cAlternateFileName="DD_ARR~1.PNG")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="nub.png", cAlternateFileName="")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sat_logo.png", cAlternateFileName="")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x622, dwReserved0=0x0, dwReserved1=0x0, cFileName="sat_logo_2x.png", cAlternateFileName="SAT_LO~1.PNG")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="share_icons.png", cAlternateFileName="SHARE_~1.PNG")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="share_icons2x.png", cAlternateFileName="SHARE_~2.PNG")) returned 1 [0167.153] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a58b2c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a58b2c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="share_icons2x.png", cAlternateFileName="SHARE_~2.PNG")) returned 0 [0167.153] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.154] GetProcessHeap () returned 0xfd0000 [0167.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0167.154] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0167.154] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.154] GetProcessHeap () returned 0xfd0000 [0167.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.154] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08b505c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0167.154] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.154] GetProcessHeap () returned 0xfd0000 [0167.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0167.155] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0167.155] GetProcessHeap () returned 0xfd0000 [0167.155] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0167.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.162] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.162] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="home-view", cAlternateFileName="HOME-V~1")) returned 1 [0167.162] GetProcessHeap () returned 0xfd0000 [0167.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0167.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.163] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.163] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2d159, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0167.163] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4645, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0167.163] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4645, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0167.163] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.163] GetProcessHeap () returned 0xfd0000 [0167.164] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0167.164] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0167.164] GetProcessHeap () returned 0xfd0000 [0167.164] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0167.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.166] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.166] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0167.166] GetProcessHeap () returned 0xfd0000 [0167.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ar-ae\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.167] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.167] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.167] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.167] GetProcessHeap () returned 0xfd0000 [0167.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.167] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0167.167] GetProcessHeap () returned 0xfd0000 [0167.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ca-es\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.168] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.168] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.168] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.168] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.168] GetProcessHeap () returned 0xfd0000 [0167.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.168] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0167.168] GetProcessHeap () returned 0xfd0000 [0167.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\cs-cz\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.169] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.169] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.169] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.169] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.169] GetProcessHeap () returned 0xfd0000 [0167.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.169] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0167.169] GetProcessHeap () returned 0xfd0000 [0167.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\da-dk\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.170] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.170] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x340d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.170] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x340d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.170] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.170] GetProcessHeap () returned 0xfd0000 [0167.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.170] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0167.170] GetProcessHeap () returned 0xfd0000 [0167.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\de-de\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0167.171] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.171] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.171] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.171] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0167.172] GetProcessHeap () returned 0xfd0000 [0167.172] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.172] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0167.173] GetProcessHeap () returned 0xfd0000 [0167.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-ae\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.173] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.173] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x31cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.173] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x31cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.174] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.175] GetProcessHeap () returned 0xfd0000 [0167.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.175] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0167.175] GetProcessHeap () returned 0xfd0000 [0167.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-gb\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.175] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.175] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2888, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.175] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2888, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.175] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.175] GetProcessHeap () returned 0xfd0000 [0167.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.175] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0167.175] GetProcessHeap () returned 0xfd0000 [0167.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\en-il\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.177] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.177] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x31cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.177] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x31cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.177] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.177] GetProcessHeap () returned 0xfd0000 [0167.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.178] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0167.178] GetProcessHeap () returned 0xfd0000 [0167.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\es-es\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.178] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.178] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.178] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.178] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.178] GetProcessHeap () returned 0xfd0000 [0167.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.178] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0167.178] GetProcessHeap () returned 0xfd0000 [0167.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\eu-es\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.179] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.179] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x397b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.179] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x397b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.179] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.179] GetProcessHeap () returned 0xfd0000 [0167.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.179] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0167.179] GetProcessHeap () returned 0xfd0000 [0167.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fi-fi\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.180] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.180] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x377d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.180] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x377d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.180] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.180] GetProcessHeap () returned 0xfd0000 [0167.180] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.180] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0167.180] GetProcessHeap () returned 0xfd0000 [0167.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-fr\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.181] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.181] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.181] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.181] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0167.181] GetProcessHeap () returned 0xfd0000 [0167.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.181] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0167.181] GetProcessHeap () returned 0xfd0000 [0167.181] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\fr-ma\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.182] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.182] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.182] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.182] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.182] GetProcessHeap () returned 0xfd0000 [0167.182] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.182] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0167.182] GetProcessHeap () returned 0xfd0000 [0167.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\he-il\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.183] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.183] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.183] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.183] GetProcessHeap () returned 0xfd0000 [0167.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.183] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0167.183] GetProcessHeap () returned 0xfd0000 [0167.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hr-hr\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.184] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.184] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3701, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.184] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3701, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.184] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.184] GetProcessHeap () returned 0xfd0000 [0167.184] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.184] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0167.184] GetProcessHeap () returned 0xfd0000 [0167.184] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\hu-hu\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.185] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.185] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.185] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.185] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.185] GetProcessHeap () returned 0xfd0000 [0167.185] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.185] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0167.185] GetProcessHeap () returned 0xfd0000 [0167.185] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\it-it\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.367] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.367] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.367] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.367] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.367] GetProcessHeap () returned 0xfd0000 [0167.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.367] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0167.367] GetProcessHeap () returned 0xfd0000 [0167.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ja-jp\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.368] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.368] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4271, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.368] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4271, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.368] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.368] GetProcessHeap () returned 0xfd0000 [0167.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.368] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0167.368] GetProcessHeap () returned 0xfd0000 [0167.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ko-kr\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.369] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.369] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.369] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.369] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.369] GetProcessHeap () returned 0xfd0000 [0167.369] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0167.369] GetProcessHeap () returned 0xfd0000 [0167.369] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nb-no\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.370] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.370] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x32f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.370] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x32f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.370] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.370] GetProcessHeap () returned 0xfd0000 [0167.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.370] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0167.371] GetProcessHeap () returned 0xfd0000 [0167.371] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\nl-nl\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0167.371] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.371] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.371] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.371] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0167.371] GetProcessHeap () returned 0xfd0000 [0167.371] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.371] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0167.371] GetProcessHeap () returned 0xfd0000 [0167.371] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pl-pl\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.372] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.372] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3847, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.372] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3847, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.372] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.372] GetProcessHeap () returned 0xfd0000 [0167.372] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.372] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0167.373] GetProcessHeap () returned 0xfd0000 [0167.373] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\pt-br\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.373] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.384] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3820, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.384] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3820, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.384] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.384] GetProcessHeap () returned 0xfd0000 [0167.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.384] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0167.384] GetProcessHeap () returned 0xfd0000 [0167.385] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ro-ro\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.385] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.385] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.386] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x39d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.386] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0167.386] GetProcessHeap () returned 0xfd0000 [0167.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.386] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0167.386] GetProcessHeap () returned 0xfd0000 [0167.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\root\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3292, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.386] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3292, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.386] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.386] GetProcessHeap () returned 0xfd0000 [0167.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.386] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0167.387] GetProcessHeap () returned 0xfd0000 [0167.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\ru-ru\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.387] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.387] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5122, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.387] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5122, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.387] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.387] GetProcessHeap () returned 0xfd0000 [0167.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.387] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0167.387] GetProcessHeap () returned 0xfd0000 [0167.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sk-sk\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.388] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.388] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3aa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.388] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3aa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.388] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.388] GetProcessHeap () returned 0xfd0000 [0167.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.388] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0167.388] GetProcessHeap () returned 0xfd0000 [0167.388] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sl-si\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3640, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3640, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.389] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.389] GetProcessHeap () returned 0xfd0000 [0167.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.389] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0167.389] GetProcessHeap () returned 0xfd0000 [0167.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sl-sl\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.390] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.390] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.390] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.390] GetProcessHeap () returned 0xfd0000 [0167.390] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.390] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0167.390] GetProcessHeap () returned 0xfd0000 [0167.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\sv-se\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0167.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x34db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x34db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.391] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0167.391] GetProcessHeap () returned 0xfd0000 [0167.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.391] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0167.391] GetProcessHeap () returned 0xfd0000 [0167.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\tr-tr\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.391] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.391] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x393d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.391] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x393d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.391] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.391] GetProcessHeap () returned 0xfd0000 [0167.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0167.392] GetProcessHeap () returned 0xfd0000 [0167.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\uk-ua\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.392] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.392] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5104, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.392] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5104, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.392] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.392] GetProcessHeap () returned 0xfd0000 [0167.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0167.393] GetProcessHeap () returned 0xfd0000 [0167.393] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-cn\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.393] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.393] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x336b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.393] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x336b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.393] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.393] GetProcessHeap () returned 0xfd0000 [0167.393] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.393] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0167.393] GetProcessHeap () returned 0xfd0000 [0167.393] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0167.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\nls\\zh-tw\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.394] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.394] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3248, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.394] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3248, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.394] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.394] GetProcessHeap () returned 0xfd0000 [0167.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0167.394] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0167.394] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.394] GetProcessHeap () returned 0xfd0000 [0167.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0167.394] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 1 [0167.394] GetProcessHeap () returned 0xfd0000 [0167.394] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0167.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\tool\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.395] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.395] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x357f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0167.395] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0167.395] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0167.395] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.395] GetProcessHeap () returned 0xfd0000 [0167.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0167.395] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 0 [0167.395] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.395] GetProcessHeap () returned 0xfd0000 [0167.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0167.396] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0167.396] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.396] GetProcessHeap () returned 0xfd0000 [0167.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.397] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf088edfc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 0 [0167.397] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0167.397] GetProcessHeap () returned 0xfd0000 [0167.397] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.397] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewer", cAlternateFileName="")) returned 1 [0167.397] GetProcessHeap () returned 0xfd0000 [0167.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0167.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.398] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.398] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0167.398] GetProcessHeap () returned 0xfd0000 [0167.398] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0167.400] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.400] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0167.400] GetProcessHeap () returned 0xfd0000 [0167.400] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ar-ae\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.401] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.401] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.401] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.401] GetProcessHeap () returned 0xfd0000 [0167.401] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.401] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0167.401] GetProcessHeap () returned 0xfd0000 [0167.401] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ca-es\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.402] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.402] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.402] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.402] GetProcessHeap () returned 0xfd0000 [0167.402] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.402] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0167.402] GetProcessHeap () returned 0xfd0000 [0167.402] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\cs-cz\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.403] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.403] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.403] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.403] GetProcessHeap () returned 0xfd0000 [0167.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.403] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0167.403] GetProcessHeap () returned 0xfd0000 [0167.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\da-dk\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.404] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.404] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.404] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.404] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.408] GetProcessHeap () returned 0xfd0000 [0167.408] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.408] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0167.408] GetProcessHeap () returned 0xfd0000 [0167.408] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\de-de\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.409] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.409] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.409] GetProcessHeap () returned 0xfd0000 [0167.409] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0167.409] GetProcessHeap () returned 0xfd0000 [0167.409] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-ae\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.410] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.410] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.410] GetProcessHeap () returned 0xfd0000 [0167.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0167.410] GetProcessHeap () returned 0xfd0000 [0167.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-gb\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.411] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.411] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.411] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.411] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.411] GetProcessHeap () returned 0xfd0000 [0167.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.411] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0167.411] GetProcessHeap () returned 0xfd0000 [0167.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\en-il\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.413] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.413] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.413] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.413] GetProcessHeap () returned 0xfd0000 [0167.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.413] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0167.414] GetProcessHeap () returned 0xfd0000 [0167.414] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\es-es\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.414] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.414] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.414] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.415] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.416] GetProcessHeap () returned 0xfd0000 [0167.416] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.416] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0167.416] GetProcessHeap () returned 0xfd0000 [0167.416] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\eu-es\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.417] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.417] GetProcessHeap () returned 0xfd0000 [0167.417] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.417] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0167.417] GetProcessHeap () returned 0xfd0000 [0167.417] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fi-fi\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.417] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.417] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.417] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.418] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.418] GetProcessHeap () returned 0xfd0000 [0167.418] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.418] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0167.418] GetProcessHeap () returned 0xfd0000 [0167.418] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fr-fr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.418] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.418] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.418] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.418] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.418] GetProcessHeap () returned 0xfd0000 [0167.419] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.419] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0167.419] GetProcessHeap () returned 0xfd0000 [0167.419] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\fr-ma\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.419] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.419] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.419] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.419] GetProcessHeap () returned 0xfd0000 [0167.419] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.419] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0167.420] GetProcessHeap () returned 0xfd0000 [0167.420] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\he-il\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.618] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.618] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.618] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.626] GetProcessHeap () returned 0xfd0000 [0167.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.633] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0167.646] GetProcessHeap () returned 0xfd0000 [0167.646] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\hr-hr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.647] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.648] GetProcessHeap () returned 0xfd0000 [0167.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.648] GetProcessHeap () returned 0xfd0000 [0167.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\hu-hu\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.648] GetProcessHeap () returned 0xfd0000 [0167.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.648] GetProcessHeap () returned 0xfd0000 [0167.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\it-it\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.649] GetProcessHeap () returned 0xfd0000 [0167.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.649] GetProcessHeap () returned 0xfd0000 [0167.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ja-jp\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.650] GetProcessHeap () returned 0xfd0000 [0167.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.650] GetProcessHeap () returned 0xfd0000 [0167.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ko-kr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.650] GetProcessHeap () returned 0xfd0000 [0167.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.650] GetProcessHeap () returned 0xfd0000 [0167.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nb-no\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.651] GetProcessHeap () returned 0xfd0000 [0167.651] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.651] GetProcessHeap () returned 0xfd0000 [0167.651] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\nl-nl\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.652] GetProcessHeap () returned 0xfd0000 [0167.652] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.652] GetProcessHeap () returned 0xfd0000 [0167.652] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\pl-pl\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.652] GetProcessHeap () returned 0xfd0000 [0167.652] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.652] GetProcessHeap () returned 0xfd0000 [0167.652] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\pt-br\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.654] GetProcessHeap () returned 0xfd0000 [0167.654] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.654] GetProcessHeap () returned 0xfd0000 [0167.654] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ro-ro\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.655] GetProcessHeap () returned 0xfd0000 [0167.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.655] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0167.655] GetProcessHeap () returned 0xfd0000 [0167.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\root\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.655] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.655] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.655] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.655] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.655] GetProcessHeap () returned 0xfd0000 [0167.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.656] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0167.656] GetProcessHeap () returned 0xfd0000 [0167.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\ru-ru\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.656] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.656] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.656] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.656] GetProcessHeap () returned 0xfd0000 [0167.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.656] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0167.656] GetProcessHeap () returned 0xfd0000 [0167.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sk-sk\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.657] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.657] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.657] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.657] GetProcessHeap () returned 0xfd0000 [0167.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.657] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0167.657] GetProcessHeap () returned 0xfd0000 [0167.657] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sl-si\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.657] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.657] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.657] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.658] GetProcessHeap () returned 0xfd0000 [0167.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0167.658] GetProcessHeap () returned 0xfd0000 [0167.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sl-sl\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.658] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.658] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.658] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.658] GetProcessHeap () returned 0xfd0000 [0167.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0167.658] GetProcessHeap () returned 0xfd0000 [0167.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\sv-se\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0167.659] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.659] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.659] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.659] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0167.659] GetProcessHeap () returned 0xfd0000 [0167.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.659] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0167.659] GetProcessHeap () returned 0xfd0000 [0167.659] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\tr-tr\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.660] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.660] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.660] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.660] GetProcessHeap () returned 0xfd0000 [0167.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.660] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.660] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-ua", cAlternateFileName="")) returned 1 [0167.660] GetProcessHeap () returned 0xfd0000 [0167.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\uk-ua\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.660] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.661] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.661] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.661] GetProcessHeap () returned 0xfd0000 [0167.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.661] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0167.661] GetProcessHeap () returned 0xfd0000 [0167.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\zh-cn\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0167.662] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.662] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.662] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0167.662] GetProcessHeap () returned 0xfd0000 [0167.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.662] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0167.662] GetProcessHeap () returned 0xfd0000 [0167.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0167.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\viewer\\nls\\zh-tw\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0167.662] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.662] GetProcessHeap () returned 0xfd0000 [0167.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0167.662] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0167.662] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0167.663] GetProcessHeap () returned 0xfd0000 [0167.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.663] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0167.663] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.663] GetProcessHeap () returned 0xfd0000 [0167.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0167.664] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewer", cAlternateFileName="")) returned 0 [0167.664] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0167.664] GetProcessHeap () returned 0xfd0000 [0167.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0167.665] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0167.665] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.665] GetProcessHeap () returned 0xfd0000 [0167.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0167.666] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 1 [0167.666] GetProcessHeap () returned 0xfd0000 [0167.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0167.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0167.666] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.667] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0167.667] GetProcessHeap () returned 0xfd0000 [0167.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0167.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\css\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0167.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-selector.css", cAlternateFileName="MAIN-S~1.CSS")) returned 1 [0167.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2023, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0167.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2023, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 0 [0167.668] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0167.668] GetProcessHeap () returned 0xfd0000 [0167.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0167.668] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0167.668] GetProcessHeap () returned 0xfd0000 [0167.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0167.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0167.670] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.670] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark-2x.png", cAlternateFileName="CHECKM~2.PNG")) returned 1 [0167.670] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26a, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark.png", cAlternateFileName="CHECKM~1.PNG")) returned 1 [0167.671] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="close.svg", cAlternateFileName="")) returned 1 [0167.671] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="help.svg", cAlternateFileName="")) returned 1 [0167.671] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 1 [0167.671] GetProcessHeap () returned 0xfd0000 [0167.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0167.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themeless\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.673] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.673] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="close.svg", cAlternateFileName="")) returned 1 [0167.673] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="close.svg", cAlternateFileName="")) returned 0 [0167.673] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.673] GetProcessHeap () returned 0xfd0000 [0167.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0167.673] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 1 [0167.673] GetProcessHeap () returned 0xfd0000 [0167.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0167.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.674] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.674] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 1 [0167.674] GetProcessHeap () returned 0xfd0000 [0167.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\images\\themes\\dark\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark-2x.png", cAlternateFileName="CHECKM~2.PNG")) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26a, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark.png", cAlternateFileName="CHECKM~1.PNG")) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="close.svg", cAlternateFileName="")) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="help.svg", cAlternateFileName="")) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="help.svg", cAlternateFileName="")) returned 0 [0167.675] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.675] GetProcessHeap () returned 0xfd0000 [0167.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0167.675] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.675] GetProcessHeap () returned 0xfd0000 [0167.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0167.675] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0167.675] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.676] GetProcessHeap () returned 0xfd0000 [0167.676] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0167.677] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0167.677] GetProcessHeap () returned 0xfd0000 [0167.677] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0167.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0167.679] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.679] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0167.679] GetProcessHeap () returned 0xfd0000 [0167.679] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0167.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.681] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.682] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0167.682] GetProcessHeap () returned 0xfd0000 [0167.682] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\da-dk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.682] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.682] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.683] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.683] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.683] GetProcessHeap () returned 0xfd0000 [0167.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.683] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0167.683] GetProcessHeap () returned 0xfd0000 [0167.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\de-de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0167.685] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.685] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.685] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.685] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.685] GetProcessHeap () returned 0xfd0000 [0167.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.685] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0167.685] GetProcessHeap () returned 0xfd0000 [0167.685] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\en-gb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.686] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.686] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.686] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.686] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0167.686] GetProcessHeap () returned 0xfd0000 [0167.686] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.686] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0167.686] GetProcessHeap () returned 0xfd0000 [0167.686] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\es-es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.687] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.687] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.687] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.687] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0167.687] GetProcessHeap () returned 0xfd0000 [0167.687] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.687] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0167.687] GetProcessHeap () returned 0xfd0000 [0167.687] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fi-fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0167.881] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.881] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.886] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.886] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0167.886] GetProcessHeap () returned 0xfd0000 [0167.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.886] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0167.886] GetProcessHeap () returned 0xfd0000 [0167.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\fr-fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0167.887] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.887] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.887] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xb1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.887] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.887] GetProcessHeap () returned 0xfd0000 [0167.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.887] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0167.887] GetProcessHeap () returned 0xfd0000 [0167.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\it-it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0167.888] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.888] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.888] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.888] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.888] GetProcessHeap () returned 0xfd0000 [0167.888] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0167.888] GetProcessHeap () returned 0xfd0000 [0167.888] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\ja-jp\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.889] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.889] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.889] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.889] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.889] GetProcessHeap () returned 0xfd0000 [0167.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0167.889] GetProcessHeap () returned 0xfd0000 [0167.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nb-no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.890] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.890] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.890] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.890] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0167.890] GetProcessHeap () returned 0xfd0000 [0167.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0167.890] GetProcessHeap () returned 0xfd0000 [0167.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\nl-nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.890] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.890] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xabb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.890] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xabb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.891] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0167.891] GetProcessHeap () returned 0xfd0000 [0167.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0167.891] GetProcessHeap () returned 0xfd0000 [0167.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\pt-br\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0167.891] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.891] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xade, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.891] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xade, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.891] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.891] GetProcessHeap () returned 0xfd0000 [0167.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0167.891] GetProcessHeap () returned 0xfd0000 [0167.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\root\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0167.892] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.892] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x954, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.892] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x954, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.892] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0167.892] GetProcessHeap () returned 0xfd0000 [0167.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.892] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0167.893] GetProcessHeap () returned 0xfd0000 [0167.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0167.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\walk-through\\js\\nls\\sv-se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.893] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.893] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xaa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.893] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xaa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.893] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0167.893] GetProcessHeap () returned 0xfd0000 [0167.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0167.893] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0167.893] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0167.893] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0167.893] GetProcessHeap () returned 0xfd0000 [0167.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0167.893] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0167.893] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa53, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 1 [0167.894] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa53, dwReserved0=0x0, dwReserved1=0x0, cFileName="selector.js", cAlternateFileName="")) returned 0 [0167.894] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0167.894] GetProcessHeap () returned 0xfd0000 [0167.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0167.895] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0167.895] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0167.895] GetProcessHeap () returned 0xfd0000 [0167.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0167.896] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 0 [0167.896] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0167.896] GetProcessHeap () returned 0xfd0000 [0167.896] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0167.897] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15fa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rna-main.js", cAlternateFileName="")) returned 1 [0167.897] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 1 [0167.897] GetProcessHeap () returned 0xfd0000 [0167.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0167.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\versions\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0167.897] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.897] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="framework-dev.js", cAlternateFileName="FRAMEW~1.JS")) returned 1 [0167.897] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="framework-dev.js", cAlternateFileName="FRAMEW~1.JS")) returned 0 [0167.897] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0167.898] GetProcessHeap () returned 0xfd0000 [0167.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0167.898] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 0 [0167.898] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0167.898] GetProcessHeap () returned 0xfd0000 [0167.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0167.900] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0167.900] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0167.900] GetProcessHeap () returned 0xfd0000 [0167.900] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0167.900] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="variant.js", cAlternateFileName="")) returned 1 [0167.900] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x55d, dwReserved0=0x0, dwReserved1=0x0, cFileName="version.js", cAlternateFileName="")) returned 1 [0167.900] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x55d, dwReserved0=0x0, dwReserved1=0x0, cFileName="version.js", cAlternateFileName="")) returned 0 [0167.900] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0167.900] GetProcessHeap () returned 0xfd0000 [0167.900] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0167.900] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 0 [0167.901] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0167.901] GetProcessHeap () returned 0xfd0000 [0167.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0167.902] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x12eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.pdf", cAlternateFileName="")) returned 1 [0167.902] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7cc16f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0167.902] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7cc16f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 0 [0167.902] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0167.902] GetProcessHeap () returned 0xfd0000 [0167.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0167.902] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x40f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0167.902] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0167.902] GetProcessHeap () returned 0xfd0000 [0167.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0167.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0167.903] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.903] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x360cac05, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb242eca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x360cac05, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMap", cAlternateFileName="")) returned 1 [0167.903] GetProcessHeap () returned 0xfd0000 [0167.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0167.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\CMap\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x360cac05, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb242eca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x360cac05, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0167.904] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x360cac05, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb242eca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x360cac05, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.904] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x360cac05, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-H", cAlternateFileName="IDENTI~1")) returned 1 [0167.904] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x360cac05, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 1 [0167.904] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x360cac05, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 0 [0167.904] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0167.904] GetProcessHeap () returned 0xfd0000 [0167.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0167.904] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3892d384, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0167.904] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x360f0e5b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x36222164, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0167.905] GetProcessHeap () returned 0xfd0000 [0167.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0167.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\Font\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x360f0e5b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x36222164, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x360f0e5b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x36222164, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x360f0e5b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x169ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePiStd.otf", cAlternateFileName="ADOBEP~1.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x360f0e5b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x9294, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Bold.otf", cAlternateFileName="COURIE~2.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3616356f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x9848, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-BoldOblique.otf", cAlternateFileName="COURIE~3.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3616356f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x99a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Oblique.otf", cAlternateFileName="COURIE~4.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x360f0e5b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x93e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd.otf", cAlternateFileName="COURIE~1.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361897f7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x35404, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Bold.otf", cAlternateFileName="MINION~1.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361897f7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3f39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-BoldIt.otf", cAlternateFileName="MINION~2.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361afa1f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3f764, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-It.otf", cAlternateFileName="MINION~3.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361afa1f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x35610, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Regular.otf", cAlternateFileName="MINION~4.OTF")) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361afa1f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Bold.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0167.908] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361d5cba, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x183e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-BoldIt.otf", cAlternateFileName="MYRIAD~2.OTF")) returned 1 [0167.908] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361d5cba, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-It.otf", cAlternateFileName="MYRIAD~3.OTF")) returned 1 [0167.908] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361d5cba, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x17b30, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Regular.otf", cAlternateFileName="MYRIAD~4.OTF")) returned 1 [0167.908] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36222164, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x36222164, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFM", cAlternateFileName="")) returned 1 [0167.908] GetProcessHeap () returned 0xfd0000 [0167.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0167.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\Font\\PFM\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36222164, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x36222164, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0167.909] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36222164, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x36222164, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.909] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFM", cAlternateFileName="")) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="zx______.pfm", cAlternateFileName="")) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x36222164, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 0 [0167.910] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0167.910] GetProcessHeap () returned 0xfd0000 [0167.910] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x12735, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZX______.PFB", cAlternateFileName="")) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 0 [0167.910] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0167.910] GetProcessHeap () returned 0xfd0000 [0167.910] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0167.910] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0167.910] GetProcessHeap () returned 0xfd0000 [0167.910] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0167.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\SaslPrep\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0167.911] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.911] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 1 [0167.911] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 0 [0167.911] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0167.911] GetProcessHeap () returned 0xfd0000 [0167.911] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0167.911] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0167.911] GetProcessHeap () returned 0xfd0000 [0167.911] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0167.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0167.912] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.912] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 1 [0167.912] GetProcessHeap () returned 0xfd0000 [0167.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0167.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0167.912] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.912] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICU", cAlternateFileName="")) returned 1 [0167.912] GetProcessHeap () returned 0xfd0000 [0167.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0167.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0167.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x345f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt26l.dat", cAlternateFileName="")) returned 1 [0167.913] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x345f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt26l.dat", cAlternateFileName="")) returned 0 [0167.913] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0167.913] GetProcessHeap () returned 0xfd0000 [0167.913] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0167.913] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0167.913] GetProcessHeap () returned 0xfd0000 [0167.913] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0167.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0167.914] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.914] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdea4e7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdea4e7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0167.914] GetProcessHeap () returned 0xfd0000 [0167.914] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0167.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdea4e7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdea4e7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0167.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdea4e7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdea4e7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea2858f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x29f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbol.txt", cAlternateFileName="")) returned 1 [0167.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea4e7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3008, dwReserved0=0x0, dwReserved1=0x0, cFileName="zdingbat.txt", cAlternateFileName="")) returned 1 [0167.915] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea4e7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3008, dwReserved0=0x0, dwReserved1=0x0, cFileName="zdingbat.txt", cAlternateFileName="")) returned 0 [0167.915] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0167.915] GetProcessHeap () returned 0xfd0000 [0167.915] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0167.915] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdeb7fa81, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mac", cAlternateFileName="")) returned 1 [0167.915] GetProcessHeap () returned 0xfd0000 [0167.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0167.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdeb7fa81, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0167.917] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdeb7fa81, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.917] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea74a4e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3277, dwReserved0=0x0, dwReserved1=0x0, cFileName="CENTEURO.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea9ac96, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x49eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CORPCHAR.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdea9ac96, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x34d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CROATIAN.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeac0ed3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x345b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CYRILLIC.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeae7122, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x340e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREEK.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb0d38c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICELAND.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb0d38c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x383a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROMAN.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb335c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x39ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROMANIAN.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb335c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x3d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYMBOL.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb59829, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x31fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURKISH.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x11fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKRAINE.TXT", cAlternateFileName="")) returned 1 [0167.918] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x11fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKRAINE.TXT", cAlternateFileName="")) returned 0 [0167.918] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0167.919] GetProcessHeap () returned 0xfd0000 [0167.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0167.919] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 1 [0167.919] GetProcessHeap () returned 0xfd0000 [0167.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0167.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0167.921] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.921] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2647, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1250.TXT", cAlternateFileName="")) returned 1 [0167.921] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeba5cd3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2502, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1251.TXT", cAlternateFileName="")) returned 1 [0167.921] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdeba5cd3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2598, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1252.TXT", cAlternateFileName="")) returned 1 [0167.922] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdebcbf36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x23f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1253.TXT", cAlternateFileName="")) returned 1 [0167.922] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdebcbf36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x258f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1254.TXT", cAlternateFileName="")) returned 1 [0167.922] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x250f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1257.TXT", cAlternateFileName="")) returned 1 [0167.922] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2505, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1258.TXT", cAlternateFileName="")) returned 1 [0167.922] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2505, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1258.TXT", cAlternateFileName="")) returned 0 [0167.922] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0168.046] GetProcessHeap () returned 0xfd0000 [0168.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0168.046] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 0 [0168.046] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0168.047] GetProcessHeap () returned 0xfd0000 [0168.047] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0168.047] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0 [0168.047] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0168.047] GetProcessHeap () returned 0xfd0000 [0168.047] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.048] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 0 [0168.048] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0168.048] GetProcessHeap () returned 0xfd0000 [0168.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.048] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0168.048] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.048] GetProcessHeap () returned 0xfd0000 [0168.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.048] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0168.048] GetProcessHeap () returned 0xfd0000 [0168.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0168.049] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.049] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", cAlternateFileName="{AC76B~1")) returned 1 [0168.049] GetProcessHeap () returned 0xfd0000 [0168.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.049] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.049] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xe3667780, ftCreationTime.dwHighDateTime=0x1d16599, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe3667780, ftLastWriteTime.dwHighDateTime=0x1d16599, nFileSizeHigh=0x0, nFileSizeLow=0x3c1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRdrDC1500720033_en_US.msi", cAlternateFileName="ACRORD~1.MSI")) returned 1 [0168.049] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xe3667780, ftCreationTime.dwHighDateTime=0x1d16599, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe3667780, ftLastWriteTime.dwHighDateTime=0x1d16599, nFileSizeHigh=0x0, nFileSizeLow=0x3c1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRdrDC1500720033_en_US.msi", cAlternateFileName="ACRORD~1.MSI")) returned 0 [0168.049] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.050] GetProcessHeap () returned 0xfd0000 [0168.050] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.050] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", cAlternateFileName="{AC76B~1")) returned 0 [0168.050] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0168.050] GetProcessHeap () returned 0xfd0000 [0168.050] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.050] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 0 [0168.050] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0168.050] GetProcessHeap () returned 0xfd0000 [0168.050] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0168.051] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee8cac0, ftCreationTime.dwHighDateTime=0x1d5974c, ftLastAccessTime.dwLowDateTime=0xa67676a0, ftLastAccessTime.dwHighDateTime=0x1d568d2, ftLastWriteTime.dwLowDateTime=0xa67676a0, ftLastWriteTime.dwHighDateTime=0x1d568d2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0168.051] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee8cac0, ftCreationTime.dwHighDateTime=0x1d5974c, ftLastAccessTime.dwLowDateTime=0xa67676a0, ftLastAccessTime.dwHighDateTime=0x1d568d2, ftLastWriteTime.dwLowDateTime=0xa67676a0, ftLastWriteTime.dwHighDateTime=0x1d568d2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 0 [0168.051] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0168.051] GetProcessHeap () returned 0xfd0000 [0168.051] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0168.051] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0168.051] GetProcessHeap () returned 0xfd0000 [0168.051] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0168.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0168.052] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.052] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb39c720, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0168.052] GetProcessHeap () returned 0xfd0000 [0168.052] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0168.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb39c720, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0168.053] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb39c720, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.053] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33bf1c6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33bf1c6c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0168.053] GetProcessHeap () returned 0xfd0000 [0168.053] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33bf1c6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33bf1c6c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0168.054] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33bf1c6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33bf1c6c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.054] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0168.054] GetProcessHeap () returned 0xfd0000 [0168.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.057] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.057] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde812478, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x751f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.dll", cAlternateFileName="")) returned 1 [0168.057] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde8f7271, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x7e1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF64.dll", cAlternateFileName="ACROPD~3.DLL")) returned 1 [0168.058] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde85e91b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xafdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDFImpl.dll", cAlternateFileName="ACROPD~1.DLL")) returned 1 [0168.058] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde884b66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1097f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDFImpl64.dll", cAlternateFileName="ACROPD~2.DLL")) returned 1 [0168.058] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xde884b66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x1097f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDFImpl64.dll", cAlternateFileName="ACROPD~2.DLL")) returned 0 [0168.058] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.059] GetProcessHeap () returned 0xfd0000 [0168.059] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.059] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0168.059] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0168.059] GetProcessHeap () returned 0xfd0000 [0168.059] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.059] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0168.059] GetProcessHeap () returned 0xfd0000 [0168.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0168.060] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.060] GetProcessHeap () returned 0xfd0000 [0168.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.063] GetProcessHeap () returned 0xfd0000 [0168.063] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.065] GetProcessHeap () returned 0xfd0000 [0168.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.065] GetProcessHeap () returned 0xfd0000 [0168.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.065] GetProcessHeap () returned 0xfd0000 [0168.065] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.066] GetProcessHeap () returned 0xfd0000 [0168.067] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0168.068] GetProcessHeap () returned 0xfd0000 [0168.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.068] GetProcessHeap () returned 0xfd0000 [0168.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.068] GetProcessHeap () returned 0xfd0000 [0168.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.068] GetProcessHeap () returned 0xfd0000 [0168.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0168.069] GetProcessHeap () returned 0xfd0000 [0168.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.070] GetProcessHeap () returned 0xfd0000 [0168.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0168.071] GetProcessHeap () returned 0xfd0000 [0168.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0168.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\LanguageNames2\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f3911d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.073] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f3911d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.073] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8164, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_CA.txt", cAlternateFileName="DISPLA~2.TXT")) returned 1 [0168.074] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8164, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_GB.txt", cAlternateFileName="DISPLA~3.TXT")) returned 1 [0168.074] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8164, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_GB_EURO.txt", cAlternateFileName="DISPLA~4.TXT")) returned 1 [0168.074] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8164, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_US.txt", cAlternateFileName="DISPLA~1.TXT")) returned 1 [0168.074] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8164, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_US_POSIX.txt", cAlternateFileName="DIA6FD~1.TXT")) returned 1 [0168.074] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8164, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_US_POSIX.txt", cAlternateFileName="DIA6FD~1.TXT")) returned 0 [0168.074] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.075] GetProcessHeap () returned 0xfd0000 [0168.075] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0168.075] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0168.075] GetProcessHeap () returned 0xfd0000 [0168.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0168.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.075] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.075] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f3911d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0168.075] GetProcessHeap () returned 0xfd0000 [0168.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0168.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Adobe\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f3911d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.077] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f3911d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.077] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Products.txt", cAlternateFileName="")) returned 1 [0168.077] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Products.txt", cAlternateFileName="")) returned 0 [0168.077] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.077] GetProcessHeap () returned 0xfd0000 [0168.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0168.077] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Plugins2", cAlternateFileName="")) returned 1 [0168.077] GetProcessHeap () returned 0xfd0000 [0168.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0168.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0168.077] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.077] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHunspellPlugin", cAlternateFileName="ADOBEH~1")) returned 1 [0168.078] GetProcessHeap () returned 0xfd0000 [0168.078] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0168.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0168.080] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.080] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Abbreviations", cAlternateFileName="ABBREV~1")) returned 1 [0168.080] GetProcessHeap () returned 0xfd0000 [0168.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0168.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0168.082] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.082] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_CA", cAlternateFileName="")) returned 1 [0168.082] GetProcessHeap () returned 0xfd0000 [0168.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_CA\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.083] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.083] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.txt", cAlternateFileName="")) returned 1 [0168.083] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.txt", cAlternateFileName="")) returned 0 [0168.083] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.084] GetProcessHeap () returned 0xfd0000 [0168.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.084] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0168.084] GetProcessHeap () returned 0xfd0000 [0168.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_GB\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0168.084] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.084] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.txt", cAlternateFileName="")) returned 1 [0168.084] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.txt", cAlternateFileName="")) returned 0 [0168.084] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0168.084] GetProcessHeap () returned 0xfd0000 [0168.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.084] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0168.084] GetProcessHeap () returned 0xfd0000 [0168.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Abbreviations\\en_US\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0168.085] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.085] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.txt", cAlternateFileName="")) returned 1 [0168.085] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="List.txt", cAlternateFileName="")) returned 0 [0168.085] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0168.085] GetProcessHeap () returned 0xfd0000 [0168.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.291] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0168.291] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0168.291] GetProcessHeap () returned 0xfd0000 [0168.291] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0168.291] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ec69cf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1e00a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHunspellPlugin.dll", cAlternateFileName="ADOBEH~1.DLL")) returned 1 [0168.291] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ec69cf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="comdll.X.manifest", cAlternateFileName="COMDLL~1.MAN")) returned 1 [0168.291] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0168.291] GetProcessHeap () returned 0xfd0000 [0168.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0168.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0168.292] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.292] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f855c1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_CA", cAlternateFileName="")) returned 1 [0168.292] GetProcessHeap () returned 0xfd0000 [0168.292] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_CA\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f855c1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0168.316] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f855c1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.316] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x773, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_CA.aff", cAlternateFileName="")) returned 1 [0168.317] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xb9dc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_CA.dic", cAlternateFileName="")) returned 1 [0168.317] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x44571, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyph_en_CA.dic", cAlternateFileName="HYPH_E~1.DIC")) returned 1 [0168.317] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x0, cFileName="README_en_CA.txt", cAlternateFileName="README~1.TXT")) returned 1 [0168.317] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="README_th_en_CA_v2.txt", cAlternateFileName="README~2.TXT")) returned 1 [0168.317] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="README_th_en_CA_v2.txt", cAlternateFileName="README~2.TXT")) returned 0 [0168.317] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0168.318] GetProcessHeap () returned 0xfd0000 [0168.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.318] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f855c1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0168.318] GetProcessHeap () returned 0xfd0000 [0168.318] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_GB\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f855c1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f855c1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f855c1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="affDescription.txt", cAlternateFileName="AFFDES~1.TXT")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fab82a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xc01, dwReserved0=0x0, dwReserved1=0x0, cFileName="changelog.txt", cAlternateFileName="CHANGE~1.TXT")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fab82a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1304f, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB.aff", cAlternateFileName="")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fab82a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xb9189, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB.dic", cAlternateFileName="")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fab82a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x2a4f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyph_en_GB.dic", cAlternateFileName="HYPH_E~1.DIC")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x3c2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.txt", cAlternateFileName="")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="README_en_GB.txt", cAlternateFileName="README~1.TXT")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x678, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordNet_license.txt", cAlternateFileName="WORDNE~1.TXT")) returned 1 [0168.329] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x678, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordNet_license.txt", cAlternateFileName="WORDNE~1.TXT")) returned 0 [0168.329] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0168.330] GetProcessHeap () returned 0xfd0000 [0168.330] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.330] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0168.330] GetProcessHeap () returned 0xfd0000 [0168.330] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Dictionaries\\en_US\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0168.331] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.331] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US.aff", cAlternateFileName="")) returned 1 [0168.331] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xb91eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US.dic", cAlternateFileName="")) returned 1 [0168.331] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x32487, dwReserved0=0x0, dwReserved1=0x0, cFileName="hyph_en_US.dic", cAlternateFileName="HYPH_E~1.DIC")) returned 1 [0168.331] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="README_en_US.txt", cAlternateFileName="README~1.TXT")) returned 1 [0168.332] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="README_en_US.txt", cAlternateFileName="README~1.TXT")) returned 0 [0168.332] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0168.332] GetProcessHeap () returned 0xfd0000 [0168.332] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.332] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0168.332] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0168.333] GetProcessHeap () returned 0xfd0000 [0168.333] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0168.333] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f12e85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dummy.aff", cAlternateFileName="")) returned 1 [0168.333] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f12e85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dummy.dic", cAlternateFileName="")) returned 1 [0168.333] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x14a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Info.plist", cAlternateFileName="INFO~1.PLI")) returned 1 [0168.333] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x21c, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.X.manifest", cAlternateFileName="PLUGIN~1.MAN")) returned 1 [0168.333] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SupplementalDictionaries", cAlternateFileName="SUPPLE~1")) returned 1 [0168.333] GetProcessHeap () returned 0xfd0000 [0168.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0168.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.340] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.340] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_CA", cAlternateFileName="")) returned 1 [0168.340] GetProcessHeap () returned 0xfd0000 [0168.340] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_CA\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0168.340] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.340] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x6fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="added.txt", cAlternateFileName="")) returned 1 [0168.341] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="excluded.txt", cAlternateFileName="")) returned 1 [0168.341] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="excluded.txt", cAlternateFileName="")) returned 0 [0168.341] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0168.341] GetProcessHeap () returned 0xfd0000 [0168.341] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.341] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0168.341] GetProcessHeap () returned 0xfd0000 [0168.341] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_GB\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0168.342] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.342] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="added.txt", cAlternateFileName="")) returned 1 [0168.342] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="excluded.txt", cAlternateFileName="")) returned 1 [0168.342] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="excluded.txt", cAlternateFileName="")) returned 0 [0168.342] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0168.342] GetProcessHeap () returned 0xfd0000 [0168.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.342] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0168.342] GetProcessHeap () returned 0xfd0000 [0168.342] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0168.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\SupplementalDictionaries\\en_US\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0168.343] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.343] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x84f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Added.txt", cAlternateFileName="")) returned 1 [0168.343] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excluded.txt", cAlternateFileName="")) returned 1 [0168.343] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excluded.txt", cAlternateFileName="")) returned 0 [0168.343] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0168.343] GetProcessHeap () returned 0xfd0000 [0168.343] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0168.343] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0168.343] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.343] GetProcessHeap () returned 0xfd0000 [0168.343] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0168.343] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SupplementalDictionaries", cAlternateFileName="SUPPLE~1")) returned 0 [0168.343] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0168.344] GetProcessHeap () returned 0xfd0000 [0168.344] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0168.345] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHunspellPlugin", cAlternateFileName="ADOBEH~1")) returned 0 [0168.345] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0168.346] GetProcessHeap () returned 0xfd0000 [0168.346] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0168.346] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Plugins2", cAlternateFileName="")) returned 0 [0168.346] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.346] GetProcessHeap () returned 0xfd0000 [0168.346] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0168.346] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0168.346] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0168.346] GetProcessHeap () returned 0xfd0000 [0168.346] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.348] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0168.348] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0168.348] GetProcessHeap () returned 0xfd0000 [0168.348] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.348] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0168.348] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0168.348] GetProcessHeap () returned 0xfd0000 [0168.348] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.348] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 0 [0168.348] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0168.348] GetProcessHeap () returned 0xfd0000 [0168.348] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0168.349] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0168.349] GetProcessHeap () returned 0xfd0000 [0168.349] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0168.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0168.350] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.350] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0168.351] GetProcessHeap () returned 0xfd0000 [0168.351] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0168.351] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.351] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eeb0b00, ftCreationTime.dwHighDateTime=0x1d30266, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x9eeb0b00, ftLastWriteTime.dwHighDateTime=0x1d30266, nFileSizeHigh=0x0, nFileSizeLow=0x68a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0168.351] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909cef00, ftCreationTime.dwHighDateTime=0x1d30266, ftLastAccessTime.dwLowDateTime=0xb300c058, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x909cef00, ftLastWriteTime.dwHighDateTime=0x1d30266, nFileSizeHigh=0x0, nFileSizeLow=0xe2218, dwReserved0=0x0, dwReserved1=0x0, cFileName="jucheck.exe", cAlternateFileName="")) returned 1 [0168.351] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f52a00, ftCreationTime.dwHighDateTime=0x1d30266, ftLastAccessTime.dwLowDateTime=0xb300c058, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x98f52a00, ftLastWriteTime.dwHighDateTime=0x1d30266, nFileSizeHigh=0x0, nFileSizeLow=0x8f618, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 1 [0168.351] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f52a00, ftCreationTime.dwHighDateTime=0x1d30266, ftLastAccessTime.dwLowDateTime=0xb300c058, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x98f52a00, ftLastWriteTime.dwHighDateTime=0x1d30266, nFileSizeHigh=0x0, nFileSizeLow=0x8f618, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 0 [0168.352] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0168.352] GetProcessHeap () returned 0xfd0000 [0168.352] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.352] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0168.352] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0168.352] GetProcessHeap () returned 0xfd0000 [0168.352] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0168.352] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0168.352] GetProcessHeap () returned 0xfd0000 [0168.352] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0168.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0168.355] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.355] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb68755a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6754cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAO", cAlternateFileName="")) returned 1 [0168.355] GetProcessHeap () returned 0xfd0000 [0168.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb68755a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6754cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.356] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb68755a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6754cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.356] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0ae615, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d0ae615, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d0ae615, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 1 [0168.356] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0ae615, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d0ae615, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d0ae615, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 0 [0168.356] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0168.356] GetProcessHeap () returned 0xfd0000 [0168.356] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.356] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ink", cAlternateFileName="")) returned 1 [0168.356] GetProcessHeap () returned 0xfd0000 [0168.356] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Ink\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0168.358] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.358] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f7e1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0168.358] GetProcessHeap () returned 0xfd0000 [0168.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Ink\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f7e1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f7e1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a091a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7eebc800, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a5565b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7eebc800, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41865796, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x814e2200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a091a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7eebc800, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7dba9b00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip32.exe.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0168.360] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0168.360] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.361] GetProcessHeap () returned 0xfd0000 [0168.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.361] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0168.361] GetProcessHeap () returned 0xfd0000 [0168.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Ink\\HWRCustomization\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.362] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.362] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0168.362] GetProcessHeap () returned 0xfd0000 [0168.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c391299, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c391299, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c391299, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c391299, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c391299, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c391299, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff8b9e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdd7871bf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdd7871bf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x169c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41982330, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x2a329cb7, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x41982330, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff8b9e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd266c889, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd266c889, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x608600, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c344dca, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c344dca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c344dca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe06a81ac, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe06a81ac, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xcf800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c31eb63, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c31eb63, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c31eb63, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="penchs.dll", cAlternateFileName="")) returned 1 [0168.362] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c31eb63, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c31eb63, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c31eb63, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="pencht.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c31eb63, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c31eb63, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c31eb63, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="penjpn.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c31eb63, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c31eb63, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c31eb63, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="penkor.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2f8900, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2f8900, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2f8900, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="penusa.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2f8900, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2f8900, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2f8900, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipanel.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2f8900, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2f8900, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2f8900, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipanel.exe", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2f8900, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2f8900, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2f8900, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipres.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c391299, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c391299, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c391299, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c31eb63, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c31eb63, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c31eb63, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="skchobj.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2f8900, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c2f8900, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c2f8900, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="skchui.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff8b9e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe4dac572, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe4dac572, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5320, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip32.exe", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x7dfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c36b032, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c36b032, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c36b032, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0168.363] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c36b032, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c36b032, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c36b032, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 0 [0168.363] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0168.364] GetProcessHeap () returned 0xfd0000 [0168.364] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.364] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0168.364] GetProcessHeap () returned 0xfd0000 [0168.364] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSEnv\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0168.477] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.477] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0168.477] GetProcessHeap () returned 0xfd0000 [0168.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSEnv\\PublicAssemblies\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0168.478] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.478] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3240, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 1 [0168.478] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3240, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 0 [0168.478] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0168.478] GetProcessHeap () returned 0xfd0000 [0168.478] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.478] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0168.478] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0168.479] GetProcessHeap () returned 0xfd0000 [0168.479] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.479] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb76134e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0168.479] GetProcessHeap () returned 0xfd0000 [0168.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb76134e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.479] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb76134e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.479] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7621f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0168.479] GetProcessHeap () returned 0xfd0000 [0168.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7621f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.480] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7621f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.480] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40bda463, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x78f57a4e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x25839900, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0168.480] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40bda463, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x78f57a4e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x25839900, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0168.480] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.480] GetProcessHeap () returned 0xfd0000 [0168.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.480] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f4006c, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x16fbff39, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x47f4006c, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0168.480] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f4006c, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x16fbff39, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x47f4006c, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0168.480] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0168.480] GetProcessHeap () returned 0xfd0000 [0168.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.480] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7edc75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0168.480] GetProcessHeap () returned 0xfd0000 [0168.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7edc75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0168.482] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7edc75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.482] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a6754cb, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e12866, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e12866, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0168.483] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0168.484] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0168.485] GetProcessHeap () returned 0xfd0000 [0168.485] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.485] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7ef366, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0168.485] GetProcessHeap () returned 0xfd0000 [0168.485] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7ef366, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0168.485] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7ef366, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.485] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0168.485] GetProcessHeap () returned 0xfd0000 [0168.485] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.494] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.495] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.495] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.495] GetProcessHeap () returned 0xfd0000 [0168.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.495] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0168.495] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0168.495] GetProcessHeap () returned 0xfd0000 [0168.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.495] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f130f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0168.495] GetProcessHeap () returned 0xfd0000 [0168.495] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f130f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.495] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f130f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.495] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0168.495] GetProcessHeap () returned 0xfd0000 [0168.495] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0168.496] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.496] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.496] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0168.496] GetProcessHeap () returned 0xfd0000 [0168.496] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.496] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0168.496] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0168.496] GetProcessHeap () returned 0xfd0000 [0168.496] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.496] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa0004713, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85e523, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b77ba12, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0168.496] GetProcessHeap () returned 0xfd0000 [0168.496] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa0004713, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85e523, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b77ba12, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.497] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa0004713, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85e523, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b77ba12, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.497] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xabcaac1e, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85f935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xabcaac1e, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0168.497] GetProcessHeap () returned 0xfd0000 [0168.497] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VC\\amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xabcaac1e, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85f935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xabcaac1e, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0168.497] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xabcaac1e, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85f935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xabcaac1e, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.497] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a678100, ftCreationTime.dwHighDateTime=0x1cc1191, ftLastAccessTime.dwLowDateTime=0xabcd0d23, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a678100, ftLastWriteTime.dwHighDateTime=0x1cc1191, nFileSizeHigh=0x0, nFileSizeLow=0xdf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 1 [0168.497] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a678100, ftCreationTime.dwHighDateTime=0x1cc1191, ftLastAccessTime.dwLowDateTime=0xabcd0d23, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6a678100, ftLastWriteTime.dwHighDateTime=0x1cc1191, nFileSizeHigh=0x0, nFileSizeLow=0xdf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 0 [0168.497] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0168.497] GetProcessHeap () returned 0xfd0000 [0168.497] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.497] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6affe800, ftCreationTime.dwHighDateTime=0x1cbd078, ftLastAccessTime.dwLowDateTime=0xc8458b03, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6affe800, ftLastWriteTime.dwHighDateTime=0x1cbd078, nFileSizeHigh=0x0, nFileSizeLow=0xc3350, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ee33900, ftCreationTime.dwHighDateTime=0x1cc11a1, ftLastAccessTime.dwLowDateTime=0xa002a840, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x9ee33900, ftLastWriteTime.dwHighDateTime=0x1cc11a1, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1096c400, ftCreationTime.dwHighDateTime=0x1cbfe3c, ftLastAccessTime.dwLowDateTime=0x2b77ba12, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x1096c400, ftLastWriteTime.dwHighDateTime=0x1cbfe3c, nFileSizeHigh=0x0, nFileSizeLow=0xa3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1096c400, ftCreationTime.dwHighDateTime=0x1cbfe3c, ftLastAccessTime.dwLowDateTime=0x2b77ba12, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x1096c400, ftLastWriteTime.dwHighDateTime=0x1cbfe3c, nFileSizeHigh=0x0, nFileSizeLow=0xa3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0168.498] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0168.498] GetProcessHeap () returned 0xfd0000 [0168.498] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb8602cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0168.498] GetProcessHeap () returned 0xfd0000 [0168.498] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb8602cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0168.498] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb8602cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x14b8a29e, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x14b8a29e, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0168.498] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0168.498] GetProcessHeap () returned 0xfd0000 [0168.498] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.498] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4284c2, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0168.499] GetProcessHeap () returned 0xfd0000 [0168.499] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4284c2, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.499] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4284c2, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.499] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0491a3, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppInfoDocument", cAlternateFileName="APPINF~1")) returned 1 [0168.499] GetProcessHeap () returned 0xfd0000 [0168.499] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\AppInfoDocument\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0491a3, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0168.514] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0491a3, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.514] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8744779b, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x4a0491a3, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x8746da27, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x25b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns.store", cAlternateFileName="ADDINS~1.STO")) returned 1 [0168.514] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 1 [0168.514] GetProcessHeap () returned 0xfd0000 [0168.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.522] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.522] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x22090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0168.522] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x22090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0168.522] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.522] GetProcessHeap () returned 0xfd0000 [0168.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.522] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 0 [0168.522] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0168.522] GetProcessHeap () returned 0xfd0000 [0168.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.522] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e47494b, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a7e2a6f, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 1 [0168.522] GetProcessHeap () returned 0xfd0000 [0168.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e47494b, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a7e2a6f, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.527] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e47494b, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a7e2a6f, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.527] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a402c44, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a9600d2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a9600d2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInSideAdapters", cAlternateFileName="ADDINS~1")) returned 1 [0168.527] GetProcessHeap () returned 0xfd0000 [0168.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a402c44, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a9600d2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a9600d2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0168.529] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a402c44, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a9600d2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a9600d2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.529] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a402c44, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xaa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0168.530] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a7bc69e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xd098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0168.530] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a8c7860, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x15af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0168.530] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a913c21, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xb098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0168.530] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a9600d2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xaaf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", cAlternateFileName="MI41FD~1.DLL")) returned 1 [0168.530] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a9600d2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xaaf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", cAlternateFileName="MI41FD~1.DLL")) returned 0 [0168.530] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0168.531] GetProcessHeap () returned 0xfd0000 [0168.531] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.531] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7e2a6f, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4abc2635, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInViews", cAlternateFileName="ADDINV~1")) returned 1 [0168.531] GetProcessHeap () returned 0xfd0000 [0168.531] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7e2a6f, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4abc2635, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0168.533] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7e2a6f, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4abc2635, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.533] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x19058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.v9.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0168.533] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a87b3c4, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x8cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0168.533] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x14af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0168.533] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x14af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0168.533] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0168.534] GetProcessHeap () returned 0xfd0000 [0168.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.534] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a107d7a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a1c6876, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contracts", cAlternateFileName="CONTRA~1")) returned 1 [0168.534] GetProcessHeap () returned 0xfd0000 [0168.534] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a107d7a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a1c6876, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0168.536] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a107d7a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a1c6876, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.536] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a107d7a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0168.537] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a12df59, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x7690, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0168.537] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6680, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0168.537] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a1a078a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xe080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0168.537] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a1a078a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xe080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0168.537] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0168.538] GetProcessHeap () returned 0xfd0000 [0168.538] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.538] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a74a126, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a8ed9d5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HostSideAdapters", cAlternateFileName="HOSTSI~1")) returned 1 [0168.538] GetProcessHeap () returned 0xfd0000 [0168.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a74a126, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a8ed9d5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a74a126, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a8ed9d5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a82eefe, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x9298, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0168.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a7701e7, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x13898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0168.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x10088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", cAlternateFileName="MIF250~1.DLL")) returned 1 [0168.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a7701e7, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xaa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0168.541] GetProcessHeap () returned 0xfd0000 [0168.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.541] GetProcessHeap () returned 0xfd0000 [0168.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.541] GetProcessHeap () returned 0xfd0000 [0168.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.677] GetProcessHeap () returned 0xfd0000 [0168.677] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.680] GetProcessHeap () returned 0xfd0000 [0168.680] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0168.682] GetProcessHeap () returned 0xfd0000 [0168.682] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.683] GetProcessHeap () returned 0xfd0000 [0168.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.683] GetProcessHeap () returned 0xfd0000 [0168.684] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.684] GetProcessHeap () returned 0xfd0000 [0168.684] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.684] GetProcessHeap () returned 0xfd0000 [0168.684] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0168.685] GetProcessHeap () returned 0xfd0000 [0168.685] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0168.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.686] GetProcessHeap () returned 0xfd0000 [0168.686] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0168.686] GetProcessHeap () returned 0xfd0000 [0168.686] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0168.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0168.688] GetProcessHeap () returned 0xfd0000 [0168.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\ado\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbba47a90, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.690] GetProcessHeap () returned 0xfd0000 [0168.690] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbba4878a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.691] GetProcessHeap () returned 0xfd0000 [0168.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.691] GetProcessHeap () returned 0xfd0000 [0168.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.691] GetProcessHeap () returned 0xfd0000 [0168.691] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbba48bb1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.692] GetProcessHeap () returned 0xfd0000 [0168.692] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.692] GetProcessHeap () returned 0xfd0000 [0168.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\msadc\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb051de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.694] GetProcessHeap () returned 0xfd0000 [0168.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbbb05d7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.694] GetProcessHeap () returned 0xfd0000 [0168.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.694] GetProcessHeap () returned 0xfd0000 [0168.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.694] GetProcessHeap () returned 0xfd0000 [0168.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb59ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.696] GetProcessHeap () returned 0xfd0000 [0168.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbbb5aeab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.697] GetProcessHeap () returned 0xfd0000 [0168.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0168.697] GetProcessHeap () returned 0xfd0000 [0168.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0168.697] GetProcessHeap () returned 0xfd0000 [0168.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0168.698] GetProcessHeap () returned 0xfd0000 [0168.698] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0168.698] GetProcessHeap () returned 0xfd0000 [0168.698] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0168.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8dcc38d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8dcc38d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0168.699] GetProcessHeap () returned 0xfd0000 [0168.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0168.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07d7559, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0168.699] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07d7559, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.699] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0168.699] GetProcessHeap () returned 0xfd0000 [0168.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0168.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0168.700] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.700] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b7e268, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79", cAlternateFileName="610316~1.79")) returned 1 [0168.700] GetProcessHeap () returned 0xfd0000 [0168.700] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0168.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b7e268, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0168.702] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b7e268, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x512e9f64, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79.manifest", cAlternateFileName="610316~1.MAN")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4836ebd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4836ebd, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b9e94b0, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x307ef58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll", cAlternateFileName="")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8c182c9e, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll.sig", cAlternateFileName="CHROME~3.SIG")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b2c23d0, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe.sig", cAlternateFileName="CHROME~2.SIG")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x513c8214, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xb65d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_100_percent.pak", cAlternateFileName="CHROME~1.PAK")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51f4fca4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xf37fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_200_percent.pak", cAlternateFileName="CHROME~2.PAK")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4a4cfe5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4a4cfe5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8ca739b6, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x3b4a558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll", cAlternateFileName="CHROME~1.DLL")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8d3b0b82, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll.sig", cAlternateFileName="CHROME~1.SIG")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8d5ecec8, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x85f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~2.DLL")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8d980738, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0xa0758, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_watcher.dll", cAlternateFileName="CHROME~3.DLL")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51570ef4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x434b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0168.703] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe29849c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_apps", cAlternateFileName="DEFAUL~1")) returned 1 [0168.704] GetProcessHeap () returned 0xfd0000 [0168.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\default_apps\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe29849c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe29849c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5170b174, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="docs.crx", cAlternateFileName="")) returned 1 [0168.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51725f24, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x63d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="drive.crx", cAlternateFileName="")) returned 1 [0168.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5173e5c4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0168.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51732274, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x5de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmail.crx", cAlternateFileName="")) returned 1 [0168.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51737094, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 1 [0168.709] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51737094, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 0 [0168.709] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.709] GetProcessHeap () returned 0xfd0000 [0168.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.709] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8de9172c, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x3558, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1 [0168.709] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe29849c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0168.710] GetProcessHeap () returned 0xfd0000 [0168.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Extensions\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe29849c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0168.710] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe29849c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.710] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51740cd4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0168.710] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29849c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29849c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51740cd4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 0 [0168.710] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0168.710] GetProcessHeap () returned 0xfd0000 [0168.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.710] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29aac04, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29aac04, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5158e3b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x9b9830, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0168.710] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b7e268, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b7e268, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0168.710] GetProcessHeap () returned 0xfd0000 [0168.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Installer\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b7e268, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b7e268, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0168.711] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b7e268, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b7e268, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.711] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b7e268, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe06f2740, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1cc958, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrmstp.exe", cAlternateFileName="")) returned 1 [0168.711] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe263d5fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe263d5fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x99d99de0, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0xae7ae07, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.7z", cAlternateFileName="")) returned 1 [0168.711] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b7e268, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe06f2740, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1cc958, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0168.711] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b7e268, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b7e268, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe06f2740, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1cc958, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 0 [0168.711] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0168.713] GetProcessHeap () returned 0xfd0000 [0168.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.713] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8e1fed42, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x18758, dwReserved0=0x0, dwReserved1=0x0, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0168.714] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8e5b880c, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x3d6158, dwReserved0=0x0, dwReserved1=0x0, cFileName="libglesv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0168.714] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4620dd7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locales", cAlternateFileName="")) returned 1 [0168.714] GetProcessHeap () returned 0xfd0000 [0168.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\Locales\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4620dd7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0168.715] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4620dd7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.716] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44571e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe44571e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5176a4e4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x6368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="am.pak", cAlternateFileName="")) returned 1 [0168.716] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44571e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe44571e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5178eed4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x61971, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar.pak", cAlternateFileName="")) returned 1 [0168.716] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44571e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe44571e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x517a0044, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x7387a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4515ed1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4515ed1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x517badf4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x96010, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4515ed1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4515ed1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x517e6d14, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x47028, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4515ed1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4515ed1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5183c444, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4818c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5185e724, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x40d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="da.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51871fa4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3d776, dwReserved0=0x0, dwReserved1=0x0, cFileName="de.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5189b7b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x7f4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="el.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x518b6564, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3af54, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB.pak", cAlternateFileName="")) returned 1 [0168.717] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x518d8844, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3b0d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x518e99b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x46331, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-419.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe456223f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe456223f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5190bc94, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x476bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="es.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51929154, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3ebe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="et.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51948d24, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x651ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5196d714, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x425ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51992104, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4884a, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x519c5554, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4b9a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x519e2a14, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x8d4aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45884fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45884fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51a025e4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x53398, dwReserved0=0x0, dwReserved1=0x0, cFileName="he.pak", cAlternateFileName="")) returned 1 [0168.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51a26fd4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x9114d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51a492b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4307f, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51a68e84, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4af4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51a8ff84, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3fca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51ab4974, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x44e38, dwReserved0=0x0, dwReserved1=0x0, cFileName="it.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51ade184, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x54eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51afb644, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xa2f0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b18b04, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x47baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45ae6e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45ae6e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b35fc4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4869b, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b386d4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x48945, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b3fc04, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xb6502, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml.pak", cAlternateFileName="")) returned 1 [0168.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b44a24, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x8f98d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b49844, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x36184, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b4e664, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x401f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b53484, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x440c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b582a4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x472ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b5f7d4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x45594, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b61ee4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x46a8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d495b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45d495b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51b69414, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x47fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51c78404, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x70754, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51c7f934, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x4a4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51cc6604, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x42fc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d0abc4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x6b5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr.pak", cAlternateFileName="")) returned 1 [0168.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d16f14, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x40eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d25974, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3c37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d391f4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xa8772, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d3e014, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x9c965, dwReserved0=0x0, dwReserved1=0x0, cFileName="te.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45fabb3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe45fabb3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d51894, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x8cbb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="th.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4620dd7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d566b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x45f47, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4620dd7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d602f4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x6fff3, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4620dd7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51d76284, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x5116b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4620dd7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51dae4f4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3ae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4620dd7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51db8134, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3af8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW.pak", cAlternateFileName="")) returned 1 [0168.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4620dd7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4620dd7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51db8134, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3af8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW.pak", cAlternateFileName="")) returned 0 [0168.892] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0168.896] GetProcessHeap () returned 0xfd0000 [0168.896] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4647067, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4647067, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51640744, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x0, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1 [0168.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4647067, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4647067, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x516566d4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x36315, dwReserved0=0x0, dwReserved1=0x0, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0168.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46b976b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46b976b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x516fa004, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0xd37e32, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pak", cAlternateFileName="RESOUR~1.PAK")) returned 1 [0168.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51701534, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x175b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1 [0168.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swiftshader", cAlternateFileName="SWIFTS~1")) returned 1 [0168.896] GetProcessHeap () returned 0xfd0000 [0168.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\swiftshader\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.896] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.897] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8efb459a, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x21d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0168.897] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8f321bb0, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x291558, dwReserved0=0x0, dwReserved1=0x0, cFileName="libglesv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0168.897] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8f321bb0, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x291558, dwReserved0=0x0, dwReserved1=0x0, cFileName="libglesv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 0 [0168.897] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.897] GetProcessHeap () returned 0xfd0000 [0168.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.897] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1 [0168.897] GetProcessHeap () returned 0xfd0000 [0168.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0168.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\VisualElements\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51dc4484, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x442a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51dd2ee4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x6092, dwReserved0=0x0, dwReserved1=0x0, cFileName="logobeta.png", cAlternateFileName="")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51ddf234, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x5741, dwReserved0=0x0, dwReserved1=0x0, cFileName="logocanary.png", cAlternateFileName="LOGOCA~1.PNG")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51df03a4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x60be, dwReserved0=0x0, dwReserved1=0x0, cFileName="logodev.png", cAlternateFileName="")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51dfc6f4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x1ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogo.png", cAlternateFileName="SMALLL~1.PNG")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51e06334, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x2419, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogobeta.png", cAlternateFileName="SMALLL~2.PNG")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51e0b154, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~3.PNG")) returned 1 [0168.998] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51e210e4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x238f, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogodev.png", cAlternateFileName="SMALLL~4.PNG")) returned 1 [0168.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51e210e4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x238f, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogodev.png", cAlternateFileName="SMALLL~4.PNG")) returned 0 [0168.999] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0168.999] GetProcessHeap () returned 0xfd0000 [0168.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0168.999] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0168.999] GetProcessHeap () returned 0xfd0000 [0169.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\WidevineCdm\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46df998, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51ea7554, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x3b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0169.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 1 [0169.000] GetProcessHeap () returned 0xfd0000 [0169.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\WidevineCdm\\_platform_specific\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0169.000] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.001] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win_x64", cAlternateFileName="")) returned 1 [0169.001] GetProcessHeap () returned 0xfd0000 [0169.001] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0169.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\61.0.3163.79\\WidevineCdm\\_platform_specific\\win_x64\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0169.007] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.007] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4705bda, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4705bda, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51ef5754, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x491b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdm.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1 [0169.007] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4705bda, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4705bda, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51ef7e64, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdm.dll.sig", cAlternateFileName="WIDEVI~1.SIG")) returned 1 [0169.007] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8f98a0ce, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x43b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~2.DLL")) returned 1 [0169.007] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8fabb39e, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll.sig", cAlternateFileName="WIDEVI~2.SIG")) returned 1 [0169.007] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8fabb39e, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll.sig", cAlternateFileName="WIDEVI~2.SIG")) returned 0 [0169.007] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0169.008] GetProcessHeap () returned 0xfd0000 [0169.008] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0169.008] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win_x64", cAlternateFileName="")) returned 0 [0169.008] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0169.008] GetProcessHeap () returned 0xfd0000 [0169.008] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.008] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0 [0169.008] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.008] GetProcessHeap () returned 0xfd0000 [0169.008] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.010] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0169.010] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.010] GetProcessHeap () returned 0xfd0000 [0169.010] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.010] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8a617bee, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x162558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0169.010] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.VisualElementsManifest.xml", cAlternateFileName="CHROME~1.XML")) returned 1 [0169.010] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bca716, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4bca716, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe050290c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1f46e, dwReserved0=0x0, dwReserved1=0x0, cFileName="master_preferences", cAlternateFileName="MASTER~1")) returned 1 [0169.010] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 1 [0169.010] GetProcessHeap () returned 0xfd0000 [0169.010] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0169.010] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.010] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4cfb9d0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170907132439.pma", cAlternateFileName="201709~1.PMA")) returned 1 [0169.011] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4cfb9d0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4cfb9d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4cfb9d0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170907132439.pma", cAlternateFileName="201709~1.PMA")) returned 0 [0169.011] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0169.011] GetProcessHeap () returned 0xfd0000 [0169.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.011] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0169.011] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.011] GetProcessHeap () returned 0xfd0000 [0169.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.011] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0169.011] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.011] GetProcessHeap () returned 0xfd0000 [0169.011] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.012] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0169.012] GetProcessHeap () returned 0xfd0000 [0169.012] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="咊\x97þ巠Ă~")) returned 0xffffffff [0169.013] GetProcessHeap () returned 0xfd0000 [0169.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.013] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3da0810, ftCreationTime.dwHighDateTime=0x1d5f078, ftLastAccessTime.dwLowDateTime=0x83fe5720, ftLastAccessTime.dwHighDateTime=0x1d5a971, ftLastWriteTime.dwLowDateTime=0x83fe5720, ftLastWriteTime.dwHighDateTime=0x1d5a971, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="persons_move.exe", cAlternateFileName="PERSON~1.EXE")) returned 1 [0169.013] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 1 [0169.013] GetProcessHeap () returned 0xfd0000 [0169.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0169.014] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.014] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc7d58e1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.3.33.5", cAlternateFileName="1333~1.5")) returned 1 [0169.014] GetProcessHeap () returned 0xfd0000 [0169.014] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\1.3.33.5\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc7d58e1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.019] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc7d58e1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.022] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x46850, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleCrashHandler.exe", cAlternateFileName="GOOGLE~3.EXE")) returned 1 [0169.022] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x59850, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleCrashHandler64.exe", cAlternateFileName="GOOGLE~4.EXE")) returned 1 [0169.022] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc631f07, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x25650, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdate.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7d58e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x17850, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateBroker.exe", cAlternateFileName="GO664E~1.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2a650, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateComRegisterShell64.exe", cAlternateFileName="GOBD5D~1.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x92c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateCore.exe", cAlternateFileName="GOOGLE~2.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateHelper.msi", cAlternateFileName="GOOGLE~1.MSI")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7d58e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x17850, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateOnDemand.exe", cAlternateFileName="GOF5E2~1.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc7d58e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc8ddbb3d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOFB2B~1.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7d58e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x17850, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateWebPlugin.exe", cAlternateFileName="GOF8A8~1.EXE")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc631f07, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1abe50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdate.dll", cAlternateFileName="")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa450, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_am.dll", cAlternateFileName="GOOPDA~1.DLL")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa050, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ar.dll", cAlternateFileName="GOOPDA~2.DLL")) returned 1 [0169.023] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_bg.dll", cAlternateFileName="GOOPDA~3.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_bn.dll", cAlternateFileName="GOOPDA~4.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ca.dll", cAlternateFileName="GO29C7~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_cs.dll", cAlternateFileName="GO58E6~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_da.dll", cAlternateFileName="GODC3A~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb050, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_de.dll", cAlternateFileName="GOAC0F~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_el.dll", cAlternateFileName="GO5382~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_en-GB.dll", cAlternateFileName="GO5AC6~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa450, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_en.dll", cAlternateFileName="GOB81A~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_es-419.dll", cAlternateFileName="GOB840~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc658172, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc658172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb050, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_es.dll", cAlternateFileName="GOE1FA~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_et.dll", cAlternateFileName="GO372F~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa450, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_fa.dll", cAlternateFileName="GO664E~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_fi.dll", cAlternateFileName="GOBE63~1.DLL")) returned 1 [0169.024] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_fil.dll", cAlternateFileName="GOD7F9~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_fr.dll", cAlternateFileName="GOB0D5~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_gu.dll", cAlternateFileName="GOA5CA~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_hi.dll", cAlternateFileName="GO950C~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_hr.dll", cAlternateFileName="GOD93D~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_hu.dll", cAlternateFileName="GO65EC~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_id.dll", cAlternateFileName="GO9B55~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_is.dll", cAlternateFileName="GOEB36~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_it.dll", cAlternateFileName="GO79FD~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc67e3c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc67e3c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x9e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_iw.dll", cAlternateFileName="GOF8FD~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6ca88e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6ca88e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x9a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ja.dll", cAlternateFileName="GO19B9~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6ca88e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6ca88e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_kn.dll", cAlternateFileName="GOD1E2~1.DLL")) returned 1 [0169.025] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6ca88e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6ca88e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ko.dll", cAlternateFileName="GO9703~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6ca88e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6ca88e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_lt.dll", cAlternateFileName="GOB674~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_lv.dll", cAlternateFileName="GO6D3D~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb450, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ml.dll", cAlternateFileName="GOC08E~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_mr.dll", cAlternateFileName="GOFE9B~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc526ea5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ms.dll", cAlternateFileName="GO6698~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_nl.dll", cAlternateFileName="GOD98C~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_no.dll", cAlternateFileName="GO5A8C~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_pl.dll", cAlternateFileName="GO21C1~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc6f0ad4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc6f0ad4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_pt-BR.dll", cAlternateFileName="GOBB1C~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_pt-PT.dll", cAlternateFileName="GO3668~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ro.dll", cAlternateFileName="GOF742~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ru.dll", cAlternateFileName="GO67EE~1.DLL")) returned 1 [0169.026] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_sk.dll", cAlternateFileName="GO472D~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_sl.dll", cAlternateFileName="GO2CB4~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_sr.dll", cAlternateFileName="GO9365~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_sv.dll", cAlternateFileName="GO5E84~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc716d2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc716d2d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_sw.dll", cAlternateFileName="GO07AF~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb050, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ta.dll", cAlternateFileName="GOB6CE~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xae50, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_te.dll", cAlternateFileName="GO8BF2~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa450, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_th.dll", cAlternateFileName="GO438A~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_tr.dll", cAlternateFileName="GO0156~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_uk.dll", cAlternateFileName="GOFFE7~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_ur.dll", cAlternateFileName="GO0A51~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc54d0e2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_vi.dll", cAlternateFileName="GO458B~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc5734ac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x9050, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_zh-CN.dll", cAlternateFileName="GO3A8A~1.DLL")) returned 1 [0169.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc5734ac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x9050, dwReserved0=0x0, dwReserved1=0x0, cFileName="goopdateres_zh-TW.dll", cAlternateFileName="GO5219~1.DLL")) returned 1 [0169.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7d58e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7d58e1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x99850, dwReserved0=0x0, dwReserved1=0x0, cFileName="npGoogleUpdate3.dll", cAlternateFileName="NPGOOG~1.DLL")) returned 1 [0169.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x32650, dwReserved0=0x0, dwReserved1=0x0, cFileName="psmachine.dll", cAlternateFileName="PSMACH~1.DLL")) returned 1 [0169.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="psmachine_64.dll", cAlternateFileName="PSMACH~2.DLL")) returned 1 [0169.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x32650, dwReserved0=0x0, dwReserved1=0x0, cFileName="psuser.dll", cAlternateFileName="")) returned 1 [0169.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="psuser_64.dll", cAlternateFileName="PSUSER~1.DLL")) returned 1 [0169.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="psuser_64.dll", cAlternateFileName="PSUSER~1.DLL")) returned 0 [0169.028] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.029] GetProcessHeap () returned 0xfd0000 [0169.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.029] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Download", cAlternateFileName="")) returned 1 [0169.029] GetProcessHeap () returned 0xfd0000 [0169.029] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\Download\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.030] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.030] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8A69D345-D564-463C-AFF1-A69D9E530F96}", cAlternateFileName="{8A69D~1")) returned 1 [0169.030] GetProcessHeap () returned 0xfd0000 [0169.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.031] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.031] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79", cAlternateFileName="610316~1.79")) returned 1 [0169.031] GetProcessHeap () returned 0xfd0000 [0169.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\61.0.3163.79\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.032] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.032] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x738f5780, ftLastWriteTime.dwHighDateTime=0x1d32558, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0868, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79_chrome_installer.exe", cAlternateFileName="610316~1.EXE")) returned 1 [0169.032] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x738f5780, ftLastWriteTime.dwHighDateTime=0x1d32558, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0868, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79_chrome_installer.exe", cAlternateFileName="610316~1.EXE")) returned 0 [0169.033] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.033] GetProcessHeap () returned 0xfd0000 [0169.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.033] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79", cAlternateFileName="610316~1.79")) returned 0 [0169.033] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0169.033] GetProcessHeap () returned 0xfd0000 [0169.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.033] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8A69D345-D564-463C-AFF1-A69D9E530F96}", cAlternateFileName="{8A69D~1")) returned 0 [0169.033] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.033] GetProcessHeap () returned 0xfd0000 [0169.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.034] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x25650, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdate.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0169.034] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 1 [0169.034] GetProcessHeap () returned 0xfd0000 [0169.034] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\Install\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.035] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.035] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6124B51C-167F-4C55-9898-E7167409448B}", cAlternateFileName="{6124B~1")) returned 1 [0169.035] GetProcessHeap () returned 0xfd0000 [0169.035] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Update2\\Install\\{6124B51C-167F-4C55-9898-E7167409448B}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.036] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.036] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe04b63d9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x738f5780, ftLastWriteTime.dwHighDateTime=0x1d32558, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0868, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79_chrome_installer.exe", cAlternateFileName="610316~1.EXE")) returned 1 [0169.036] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe04b63d9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x738f5780, ftLastWriteTime.dwHighDateTime=0x1d32558, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0868, dwReserved0=0x0, dwReserved1=0x0, cFileName="61.0.3163.79_chrome_installer.exe", cAlternateFileName="610316~1.EXE")) returned 0 [0169.036] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.036] GetProcessHeap () returned 0xfd0000 [0169.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.036] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6124B51C-167F-4C55-9898-E7167409448B}", cAlternateFileName="{6124B~1")) returned 0 [0169.036] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.036] GetProcessHeap () returned 0xfd0000 [0169.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.036] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 0 [0169.036] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0169.036] GetProcessHeap () returned 0xfd0000 [0169.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.037] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 0 [0169.037] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.037] GetProcessHeap () returned 0xfd0000 [0169.037] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.037] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0169.037] GetProcessHeap () returned 0xfd0000 [0169.037] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0169.039] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.039] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc12f0c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.039] GetProcessHeap () returned 0xfd0000 [0169.039] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc12f0c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.039] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc12f0c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x408b2676, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x69769e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409e61df, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f3c6579, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x76938d00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0169.040] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.040] GetProcessHeap () returned 0xfd0000 [0169.040] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95261236, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x95261236, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x95261236, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x953b87d3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x953b87d3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x953b87d3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9523afd3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9523afd3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9523afd3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb93, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie9props.propdesc", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x14fb6499, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x75e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95214d68, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x95214d68, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x95214d68, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9523afd3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9523afd3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9523afd3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x52600, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8d39e400, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc8d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0169.040] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc12f4a8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0169.041] GetProcessHeap () returned 0xfd0000 [0169.041] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\images\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc12f4a8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.129] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc12f4a8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc12f4a8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.129] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.130] GetProcessHeap () returned 0xfd0000 [0169.130] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.130] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0169.130] GetProcessHeap () returned 0xfd0000 [0169.130] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0169.131] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c4430, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x971e5734, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x971e5734, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c4430, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x971e5734, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x971e5734, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0169.131] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0169.131] GetProcessHeap () returned 0xfd0000 [0169.131] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x953b87d3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x953b87d3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x953b87d3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc660860, ftCreationTime.dwHighDateTime=0x1d5c803, ftLastAccessTime.dwLowDateTime=0xa31882c0, ftLastAccessTime.dwHighDateTime=0x1d5999f, ftLastWriteTime.dwLowDateTime=0xa31882c0, ftLastWriteTime.dwHighDateTime=0x1d5999f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="whatsapp.exe", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc660860, ftCreationTime.dwHighDateTime=0x1d5c803, ftLastAccessTime.dwLowDateTime=0xa31882c0, ftLastAccessTime.dwHighDateTime=0x1d5999f, ftLastWriteTime.dwLowDateTime=0xa31882c0, ftLastWriteTime.dwHighDateTime=0x1d5999f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="whatsapp.exe", cAlternateFileName="")) returned 0 [0169.131] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0169.131] GetProcessHeap () returned 0xfd0000 [0169.131] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0169.131] GetProcessHeap () returned 0xfd0000 [0169.131] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0169.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fcdb590, ftCreationTime.dwHighDateTime=0x1d5c3c5, ftLastAccessTime.dwLowDateTime=0x9da219a0, ftLastAccessTime.dwHighDateTime=0x1d5782f, ftLastWriteTime.dwLowDateTime=0x9da219a0, ftLastWriteTime.dwHighDateTime=0x1d5782f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91df580, ftCreationTime.dwHighDateTime=0x1d5e196, ftLastAccessTime.dwLowDateTime=0xf449cf60, ftLastAccessTime.dwHighDateTime=0x1d5c4aa, ftLastWriteTime.dwLowDateTime=0xf449cf60, ftLastWriteTime.dwHighDateTime=0x1d5c4aa, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91df580, ftCreationTime.dwHighDateTime=0x1d5e196, ftLastAccessTime.dwLowDateTime=0xf449cf60, ftLastAccessTime.dwHighDateTime=0x1d5c4aa, ftLastWriteTime.dwLowDateTime=0xf449cf60, ftLastWriteTime.dwHighDateTime=0x1d5c4aa, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 0 [0169.132] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0169.132] GetProcessHeap () returned 0xfd0000 [0169.132] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69bc7dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69bc7dd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0169.132] GetProcessHeap () returned 0xfd0000 [0169.132] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69bc7dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69bc7dd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.139] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69bc7dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69bc7dd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.139] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1dc6a0, ftCreationTime.dwHighDateTime=0x1d583fc, ftLastAccessTime.dwLowDateTime=0x1ba98e20, ftLastAccessTime.dwHighDateTime=0x1d5bd39, ftLastWriteTime.dwLowDateTime=0x1ba98e20, ftLastWriteTime.dwHighDateTime=0x1d5bd39, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0169.139] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xbc17eb24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4adfea18, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0169.139] GetProcessHeap () returned 0xfd0000 [0169.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xbc17eb24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4adfea18, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0169.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xbc17eb24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4adfea18, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a238f8c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x7a4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a2ab773, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5440, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a402c44, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae24be2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0169.149] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae24be2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 0 [0169.149] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0169.149] GetProcessHeap () returned 0xfd0000 [0169.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.149] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0169.150] GetProcessHeap () returned 0xfd0000 [0169.150] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.150] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9beb855b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9beb855b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9beb855b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_client.xml", cAlternateFileName="")) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce8441a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9ce8441a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9ce8441a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="")) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce8441a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9ce8441a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9ce8441a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="")) returned 0 [0169.150] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.150] GetProcessHeap () returned 0xfd0000 [0169.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 0 [0169.150] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.150] GetProcessHeap () returned 0xfd0000 [0169.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef4e2594, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef4e2594, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1 [0169.151] GetProcessHeap () returned 0xfd0000 [0169.151] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef4e2594, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef4e2594, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.160] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef4e2594, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef4e2594, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.160] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef3b1257, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef3d74a4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef3d74a4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0169.160] GetProcessHeap () returned 0xfd0000 [0169.160] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef3b1257, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef3d74a4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef3d74a4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.161] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef3b1257, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef3d74a4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef3d74a4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3b1257, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef3b1257, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef3d74a4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3b1257, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef3b1257, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef3d74a4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0 [0169.161] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.161] GetProcessHeap () returned 0xfd0000 [0169.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1289ad, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef1289ad, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7da49100, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x2f5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0169.162] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4bc309, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef4bc309, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef4e2594, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x15e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall.exe", cAlternateFileName="UNINST~1.EXE")) returned 1 [0169.162] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef14ec0d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef14ec0d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x5cdc3b80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 1 [0169.162] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef14ec0d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef14ec0d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x5cdc3b80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 0 [0169.162] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.162] GetProcessHeap () returned 0xfd0000 [0169.162] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe578ec53, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe578ec53, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0169.163] GetProcessHeap () returned 0xfd0000 [0169.163] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe578ec53, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe578ec53, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.165] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe578ec53, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe578ec53, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.165] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0169.165] GetProcessHeap () returned 0xfd0000 [0169.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0169.165] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.165] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0169.165] GetProcessHeap () returned 0xfd0000 [0169.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.166] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0169.167] GetProcessHeap () returned 0xfd0000 [0169.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.167] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4edf80e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4edf80e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4edf80e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4edf80e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4edf80e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4edf80e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0169.167] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.167] GetProcessHeap () returned 0xfd0000 [0169.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.168] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0169.168] GetProcessHeap () returned 0xfd0000 [0169.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0169.168] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.168] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5733fb2f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5733fb2f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd469ff00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0169.168] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5733fb2f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5733fb2f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd469ff00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5733fb2f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5733fb2f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd469ff00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0169.169] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0169.169] GetProcessHeap () returned 0xfd0000 [0169.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0169.169] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0169.169] GetProcessHeap () returned 0xfd0000 [0169.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0169.169] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0169.169] GetProcessHeap () returned 0xfd0000 [0169.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10826270, ftCreationTime.dwHighDateTime=0x1d5b798, ftLastAccessTime.dwLowDateTime=0xc382d110, ftLastAccessTime.dwHighDateTime=0x1d5ae98, ftLastWriteTime.dwLowDateTime=0xc382d110, ftLastWriteTime.dwHighDateTime=0x1d5ae98, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="registration blue.exe", cAlternateFileName="REGIST~1.EXE")) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x962e97d0, ftCreationTime.dwHighDateTime=0x1d5a088, ftLastAccessTime.dwLowDateTime=0xbbf906f0, ftLastAccessTime.dwHighDateTime=0x1d5d948, ftLastWriteTime.dwLowDateTime=0xbbf906f0, ftLastWriteTime.dwHighDateTime=0x1d5d948, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="transmitted.exe", cAlternateFileName="TRANSM~1.EXE")) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x962e97d0, ftCreationTime.dwHighDateTime=0x1d5a088, ftLastAccessTime.dwLowDateTime=0xbbf906f0, ftLastAccessTime.dwHighDateTime=0x1d5d948, ftLastWriteTime.dwLowDateTime=0xbbf906f0, ftLastWriteTime.dwHighDateTime=0x1d5d948, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="transmitted.exe", cAlternateFileName="TRANSM~1.EXE")) returned 0 [0169.170] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.170] GetProcessHeap () returned 0xfd0000 [0169.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0169.170] GetProcessHeap () returned 0xfd0000 [0169.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.171] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.171] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x731b1f90, ftCreationTime.dwHighDateTime=0x1d5a0e5, ftLastAccessTime.dwLowDateTime=0x42791830, ftLastAccessTime.dwHighDateTime=0x1d59404, ftLastWriteTime.dwLowDateTime=0x42791830, ftLastWriteTime.dwHighDateTime=0x1d59404, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1 [0169.172] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47c24e0, ftCreationTime.dwHighDateTime=0x1d56dc2, ftLastAccessTime.dwLowDateTime=0x5c98b000, ftLastAccessTime.dwHighDateTime=0x1d5750e, ftLastWriteTime.dwLowDateTime=0x5c98b000, ftLastWriteTime.dwHighDateTime=0x1d5750e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="burning.exe", cAlternateFileName="")) returned 1 [0169.172] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd541e70, ftCreationTime.dwHighDateTime=0x1d58567, ftLastAccessTime.dwLowDateTime=0xbb5de40, ftLastAccessTime.dwHighDateTime=0x1d5b09d, ftLastWriteTime.dwLowDateTime=0xbb5de40, ftLastWriteTime.dwHighDateTime=0x1d5b09d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="home marathon dining.exe", cAlternateFileName="HOMEMA~1.EXE")) returned 1 [0169.172] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0169.172] GetProcessHeap () returned 0xfd0000 [0169.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.172] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.172] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a8888e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a8888e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0169.172] GetProcessHeap () returned 0xfd0000 [0169.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a8888e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a8888e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0169.173] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a8888e, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a8888e, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.173] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0169.173] GetProcessHeap () returned 0xfd0000 [0169.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.181] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.181] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575a2150, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575a2150, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0169.181] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x574bd2f8, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x574bd2f8, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x407000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0169.181] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575c83aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575c83aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0169.181] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575c83aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575c83aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575c83aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575c83aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x50a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575c83aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575c83aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575c83aa, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x575c83aa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57614879, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57614879, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0169.182] GetProcessHeap () returned 0xfd0000 [0169.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0169.183] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4f2bdbb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4f2bdbb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4f2bdbb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4f2bdbb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0169.183] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0169.183] GetProcessHeap () returned 0xfd0000 [0169.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0169.183] GetProcessHeap () returned 0xfd0000 [0169.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0169.184] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a627cb, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7a627cb, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a627cb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57365d86, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57365d86, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57365d86, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57365d86, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0169.184] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0169.184] GetProcessHeap () returned 0xfd0000 [0169.184] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909a7d72, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c4a1e8c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6c4c7f7a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909a7d72, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d14c866, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6d14c866, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90981b06, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x65065569, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x65065569, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57555c84, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57555c84, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909a7d72, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6749ba48, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x674e7ec0, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90981b06, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x66fb0c3e, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6710806a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x5b7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5763aadc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5763aadc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57686f9f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57686f9f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x14c97d00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x117000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57686f9f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57686f9f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x14c97d00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x18e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x576ad20c, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x576ad20c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x14c97d00, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x84000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5763aadc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5763aadc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5763aadc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5763aadc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5763aadc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5763aadc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5763aadc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5763aadc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5763aadc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5763aadc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x132000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57660d39, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57660d39, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x13985000, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a3c8b9, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4f05e1c, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4f2bdbb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0169.186] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a3c8b9, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe4f05e1c, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe4f2bdbb, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0169.186] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.186] GetProcessHeap () returned 0xfd0000 [0169.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.186] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a8888e, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0169.186] GetProcessHeap () returned 0xfd0000 [0169.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a8888e, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0169.189] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a8888e, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b2245, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573b2245, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b2245, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573b2245, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xb3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b2245, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573b2245, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b2245, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573b2245, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0169.194] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b2245, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573b2245, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0169.194] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7aaecd3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0169.194] GetProcessHeap () returned 0xfd0000 [0169.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7aaecd3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.194] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7aaecd3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.194] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5738bfdc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5738bfdc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0169.195] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5738bfdc, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5738bfdc, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0169.195] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.195] GetProcessHeap () returned 0xfd0000 [0169.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.195] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7aaecd3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0169.195] GetProcessHeap () returned 0xfd0000 [0169.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7aaecd3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.195] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7aaecd3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe7aaecd3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7aaecd3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.195] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57365d86, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57365d86, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0169.195] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57365d86, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57365d86, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0169.195] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0169.195] GetProcessHeap () returned 0xfd0000 [0169.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.195] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0169.195] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573fe702, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573fe702, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xa4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573fe702, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573fe702, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573fe702, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573fe702, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57424968, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57424968, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57424968, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57424968, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57424968, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x57424968, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5744abc5, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5744abc5, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xaa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5744abc5, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x5744abc5, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd6cc5900, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0169.197] GetProcessHeap () returned 0xfd0000 [0169.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.197] GetProcessHeap () returned 0xfd0000 [0169.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.342] GetProcessHeap () returned 0xfd0000 [0169.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.342] GetProcessHeap () returned 0xfd0000 [0169.357] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.362] GetProcessHeap () returned 0xfd0000 [0169.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b203e0, ftCreationTime.dwHighDateTime=0x1d59ed9, ftLastAccessTime.dwLowDateTime=0x688cf500, ftLastAccessTime.dwHighDateTime=0x1d5e963, ftLastWriteTime.dwLowDateTime=0x688cf500, ftLastWriteTime.dwHighDateTime=0x1d5e963, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chicks experienced powell.exe", cAlternateFileName="CHICKS~1.EXE")) returned 1 [0169.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc41d3f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.364] GetProcessHeap () returned 0xfd0000 [0169.364] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc41d3f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.365] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc41d3f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xcd996200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll.mui", cAlternateFileName="")) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 0 [0169.365] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.365] GetProcessHeap () returned 0xfd0000 [0169.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa686fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa686fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa686fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f4a2e, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xee5007f7, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x419f4a2e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x173a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0169.365] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f4a2e, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xee441c33, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x419f4a2e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xae5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f4a2e, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xee631ad5, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x419f4a2e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x177a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f4a2e, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xee54ccae, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x419f4a2e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x33a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad11c00, ftCreationTime.dwHighDateTime=0x1d5b1da, ftLastAccessTime.dwLowDateTime=0x5cd766d0, ftLastAccessTime.dwHighDateTime=0x1d5a93c, ftLastWriteTime.dwLowDateTime=0x5cd766d0, ftLastWriteTime.dwHighDateTime=0x1d5a93c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41d9a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline", cAlternateFileName="")) returned 1 [0169.366] GetProcessHeap () returned 0xfd0000 [0169.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\Offline\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41d9a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0169.366] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41d9a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41d9a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.366] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0169.366] GetProcessHeap () returned 0xfd0000 [0169.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f21e20, ftCreationTime.dwHighDateTime=0x1d56f86, ftLastAccessTime.dwLowDateTime=0x9d4b3f20, ftLastAccessTime.dwHighDateTime=0x1d5cd36, ftLastWriteTime.dwLowDateTime=0x9d4b3f20, ftLastWriteTime.dwHighDateTime=0x1d5cd36, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="omnipos.exe", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3ad051, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a3ad051, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a3ad051, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1 [0169.366] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3ad051, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a3ad051, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a3ad051, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 0 [0169.366] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.367] GetProcessHeap () returned 0xfd0000 [0169.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.367] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6bac5dc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bac5dc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0169.367] GetProcessHeap () returned 0xfd0000 [0169.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6bac5dc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bac5dc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.368] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6bac5dc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bac5dc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.368] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af0020, ftCreationTime.dwHighDateTime=0x1d59368, ftLastAccessTime.dwLowDateTime=0xdb688200, ftLastAccessTime.dwHighDateTime=0x1d568e0, ftLastWriteTime.dwLowDateTime=0xdb688200, ftLastWriteTime.dwHighDateTime=0x1d568e0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0169.368] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b24d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.368] GetProcessHeap () returned 0xfd0000 [0169.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b24d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.369] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b24d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40aa916a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x76938d00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x7a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ce8172, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75626000, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ce8172, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x79d60fab, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75626000, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0169.369] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.369] GetProcessHeap () returned 0xfd0000 [0169.369] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30059fd0, ftCreationTime.dwHighDateTime=0x1d57423, ftLastAccessTime.dwLowDateTime=0x4ca5fe60, ftLastAccessTime.dwHighDateTime=0x1d57ca6, ftLastWriteTime.dwLowDateTime=0x4ca5fe60, ftLastWriteTime.dwHighDateTime=0x1d57ca6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="o huge.exe", cAlternateFileName="OHUGE~1.EXE")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xde00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6fdf0, ftCreationTime.dwHighDateTime=0x1d5b895, ftLastAccessTime.dwLowDateTime=0x7709fd10, ftLastAccessTime.dwHighDateTime=0x1d5d416, ftLastWriteTime.dwLowDateTime=0x7709fd10, ftLastWriteTime.dwHighDateTime=0x1d5d416, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="spgagentservice.exe", cAlternateFileName="SPGAGE~1.EXE")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0169.370] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0169.370] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0169.370] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.370] GetProcessHeap () returned 0xfd0000 [0169.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.370] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0169.370] GetProcessHeap () returned 0xfd0000 [0169.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.373] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.373] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5296d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.373] GetProcessHeap () returned 0xfd0000 [0169.373] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5296d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.375] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5296d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.375] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b1b89b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x113f9c00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0169.375] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40bda463, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x113f9c00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1 [0169.375] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40aa916a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1 [0169.375] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1 [0169.375] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd13924, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1 [0169.376] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de1e9a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x10aa0400, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1 [0169.376] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1 [0169.376] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x100e6f00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 0 [0169.376] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.376] GetProcessHeap () returned 0xfd0000 [0169.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.377] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760c16a0, ftCreationTime.dwHighDateTime=0x1d599e2, ftLastAccessTime.dwLowDateTime=0x70f6b290, ftLastAccessTime.dwHighDateTime=0x1d5eefd, ftLastWriteTime.dwLowDateTime=0x70f6b290, ftLastWriteTime.dwHighDateTime=0x1d5eefd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0169.377] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0169.377] GetProcessHeap () returned 0xfd0000 [0169.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Icons\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.377] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.377] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.377] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.377] GetProcessHeap () returned 0xfd0000 [0169.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.377] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc580db4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0169.377] GetProcessHeap () returned 0xfd0000 [0169.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc580db4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc580db4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x50db, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0x0, dwReserved1=0x0, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_120.png", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_48.png", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 1 [0169.379] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe7ed8800, ftLastWriteTime.dwHighDateTime=0x1d283c7, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 0 [0169.379] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.380] GetProcessHeap () returned 0xfd0000 [0169.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.380] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xab521500, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x28200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0169.380] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc581c81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1 [0169.380] GetProcessHeap () returned 0xfd0000 [0169.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc581c81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0169.381] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc581c81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.381] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc581c81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.381] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0169.381] GetProcessHeap () returned 0xfd0000 [0169.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.381] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd062b0, ftCreationTime.dwHighDateTime=0x1d59dc2, ftLastAccessTime.dwLowDateTime=0x4561f1a0, ftLastAccessTime.dwHighDateTime=0x1d5827c, ftLastWriteTime.dwLowDateTime=0x4561f1a0, ftLastWriteTime.dwHighDateTime=0x1d5827c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="releaserefine.exe", cAlternateFileName="RELEAS~1.EXE")) returned 1 [0169.382] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x734ad200, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x1b8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0169.382] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5826b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1 [0169.382] GetProcessHeap () returned 0xfd0000 [0169.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Skins\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5826b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0169.382] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5826b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.382] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xcf0d5f00, ftLastWriteTime.dwHighDateTime=0x1d29f91, nFileSizeHigh=0x0, nFileSizeLow=0x11550, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0169.382] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xcf0d5f00, ftLastWriteTime.dwHighDateTime=0x1d29f91, nFileSizeHigh=0x0, nFileSizeLow=0x11550, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 0 [0169.382] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0169.382] GetProcessHeap () returned 0xfd0000 [0169.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.382] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0169.382] GetProcessHeap () returned 0xfd0000 [0169.383] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0169.383] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.383] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0169.383] GetProcessHeap () returned 0xfd0000 [0169.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe81e0c00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4339c91, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x49de7600, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4339c91, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x97ef800, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x28c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc0c73f00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x3c74bc00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x6a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1 [0169.383] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x1a2f6e00, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1 [0169.384] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x30d5c500, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1 [0169.384] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x49de7600, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1 [0169.384] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa435feea, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x49de7600, ftLastWriteTime.dwHighDateTime=0x1d29fa2, nFileSizeHigh=0x0, nFileSizeLow=0x19800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 0 [0169.384] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.384] GetProcessHeap () returned 0xfd0000 [0169.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.385] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6a08f14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a08f14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0169.385] GetProcessHeap () returned 0xfd0000 [0169.385] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Multimedia Platform\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6a08f14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a08f14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.386] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6a08f14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a08f14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.387] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2dba20, ftCreationTime.dwHighDateTime=0x1d5e249, ftLastAccessTime.dwLowDateTime=0x77955200, ftLastAccessTime.dwHighDateTime=0x1d5edd1, ftLastWriteTime.dwLowDateTime=0x77955200, ftLastWriteTime.dwHighDateTime=0x1d5edd1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="allergy_ended_vietnamese.exe", cAlternateFileName="ALLERG~1.EXE")) returned 1 [0169.387] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae52f0, ftCreationTime.dwHighDateTime=0x1d58f76, ftLastAccessTime.dwLowDateTime=0x102fca80, ftLastAccessTime.dwHighDateTime=0x1d5c35d, ftLastWriteTime.dwLowDateTime=0x102fca80, ftLastWriteTime.dwHighDateTime=0x1d5c35d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="leechftp.exe", cAlternateFileName="")) returned 1 [0169.387] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5feeada0, ftCreationTime.dwHighDateTime=0x1d5bea0, ftLastAccessTime.dwLowDateTime=0x20c26bc0, ftLastAccessTime.dwHighDateTime=0x1d5759f, ftLastWriteTime.dwLowDateTime=0x20c26bc0, ftLastWriteTime.dwHighDateTime=0x1d5759f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mia_swing.exe", cAlternateFileName="MIA_SW~1.EXE")) returned 1 [0169.387] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954773d8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x954773d8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x954773d8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0169.387] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954773d8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x954773d8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x954773d8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0169.387] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.388] GetProcessHeap () returned 0xfd0000 [0169.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.388] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0169.388] GetProcessHeap () returned 0xfd0000 [0169.388] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.389] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.390] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5858e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7129af65, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0169.390] GetProcessHeap () returned 0xfd0000 [0169.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\Accessories\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5858e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7129af65, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.390] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5858e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7129af65, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.390] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc58631c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.390] GetProcessHeap () returned 0xfd0000 [0169.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc58631c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0169.391] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc58631c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.391] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x6d0a2500, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0169.391] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bacb92, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x6d0a2500, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 0 [0169.391] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0169.392] GetProcessHeap () returned 0xfd0000 [0169.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x480bd806, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xdc94812c, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x480bd806, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x417c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0169.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76410ee5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x76410ee5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x76410ee5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0169.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76410ee5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x76410ee5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x76410ee5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0169.392] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.393] GetProcessHeap () returned 0xfd0000 [0169.393] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.393] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223e6a80, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x2b4aeab0, ftLastAccessTime.dwHighDateTime=0x1d57322, ftLastWriteTime.dwLowDateTime=0x2b4aeab0, ftLastWriteTime.dwHighDateTime=0x1d57322, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="edcsvr.exe", cAlternateFileName="")) returned 1 [0169.393] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b044a70, ftCreationTime.dwHighDateTime=0x1d5e491, ftLastAccessTime.dwLowDateTime=0x53d00b00, ftLastAccessTime.dwHighDateTime=0x1d5c6d3, ftLastWriteTime.dwLowDateTime=0x53d00b00, ftLastWriteTime.dwHighDateTime=0x1d5c6d3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="lone.exe", cAlternateFileName="")) returned 1 [0169.393] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e7e690, ftCreationTime.dwHighDateTime=0x1d5b189, ftLastAccessTime.dwLowDateTime=0xff050000, ftLastAccessTime.dwHighDateTime=0x1d5c01d, ftLastWriteTime.dwLowDateTime=0xff050000, ftLastWriteTime.dwHighDateTime=0x1d5c01d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="played secure.exe", cAlternateFileName="PLAYED~1.EXE")) returned 1 [0169.393] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0169.393] GetProcessHeap () returned 0xfd0000 [0169.393] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\TableTextService\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0169.395] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.395] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5e4b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.395] GetProcessHeap () returned 0xfd0000 [0169.395] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5e4b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0169.395] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5e4b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a5565b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x2d910800, ftLastWriteTime.dwHighDateTime=0x1d29fa7, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a5565b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x2d910800, ftLastWriteTime.dwHighDateTime=0x1d29fa7, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 0 [0169.396] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0169.396] GetProcessHeap () returned 0xfd0000 [0169.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776fe01f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776fe01f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776fe01f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x97a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776b1b4c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776b1b4c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776b1b4c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x376a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776fe01f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776fe01f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776fe01f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x136c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775f2f48, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775f2f48, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775f2f48, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xef500, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776b1b4c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776b1b4c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776b1b4c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3776, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceTigrinya.txt", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775ccce1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775ccce1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775ccce1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775ccce1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775ccce1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775ccce1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0 [0169.396] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0169.396] GetProcessHeap () returned 0xfd0000 [0169.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0169.396] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.397] GetProcessHeap () returned 0xfd0000 [0169.397] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.397] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6bac5dc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bac5dc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0169.397] GetProcessHeap () returned 0xfd0000 [0169.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6bac5dc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bac5dc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0169.516] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6bac5dc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bac5dc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.516] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.516] GetProcessHeap () returned 0xfd0000 [0169.516] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0169.517] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4094d875, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0169.517] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0169.517] GetProcessHeap () returned 0xfd0000 [0169.517] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19340, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963430c, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7963430c, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x1de400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x194200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf69289, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cf69289, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cf69289, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x18f7d52f, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f019f70, ftCreationTime.dwHighDateTime=0x1d5eb37, ftLastAccessTime.dwLowDateTime=0xf370b1f0, ftLastAccessTime.dwHighDateTime=0x1d58155, ftLastWriteTime.dwLowDateTime=0xf370b1f0, ftLastWriteTime.dwHighDateTime=0x1d58155, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5faa1ac0, ftCreationTime.dwHighDateTime=0x1d5a49a, ftLastAccessTime.dwLowDateTime=0x6c3e00c0, ftLastAccessTime.dwHighDateTime=0x1d5ea00, ftLastWriteTime.dwLowDateTime=0x6c3e00c0, ftLastWriteTime.dwHighDateTime=0x1d5ea00, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5faa1ac0, ftCreationTime.dwHighDateTime=0x1d5a49a, ftLastAccessTime.dwLowDateTime=0x6c3e00c0, ftLastAccessTime.dwHighDateTime=0x1d5ea00, ftLastWriteTime.dwLowDateTime=0x6c3e00c0, ftLastWriteTime.dwHighDateTime=0x1d5ea00, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 0 [0169.518] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0169.518] GetProcessHeap () returned 0xfd0000 [0169.518] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0169.518] GetProcessHeap () returned 0xfd0000 [0169.518] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.518] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.518] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x881760a0, ftCreationTime.dwHighDateTime=0x1d5dc9c, ftLastAccessTime.dwLowDateTime=0xd976a00, ftLastAccessTime.dwHighDateTime=0x1d5e075, ftLastWriteTime.dwLowDateTime=0xd976a00, ftLastWriteTime.dwHighDateTime=0x1d5e075, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e40120, ftCreationTime.dwHighDateTime=0x1d586cb, ftLastAccessTime.dwLowDateTime=0xa00d1f60, ftLastAccessTime.dwHighDateTime=0x1d5a222, ftLastWriteTime.dwLowDateTime=0xa00d1f60, ftLastWriteTime.dwHighDateTime=0x1d5a222, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e40120, ftCreationTime.dwHighDateTime=0x1d586cb, ftLastAccessTime.dwLowDateTime=0xa00d1f60, ftLastAccessTime.dwHighDateTime=0x1d5a222, ftLastWriteTime.dwLowDateTime=0xa00d1f60, ftLastWriteTime.dwHighDateTime=0x1d5a222, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 0 [0169.519] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0169.519] GetProcessHeap () returned 0xfd0000 [0169.519] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe8dcc38d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8dcc38d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0169.519] GetProcessHeap () returned 0xfd0000 [0169.519] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe8dcc38d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8dcc38d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.521] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe8dcc38d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8dcc38d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0169.521] GetProcessHeap () returned 0xfd0000 [0169.521] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0169.521] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.521] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0169.521] GetProcessHeap () returned 0xfd0000 [0169.521] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7e67c0, ftCreationTime.dwHighDateTime=0x1d5785f, ftLastAccessTime.dwLowDateTime=0xc527f5c0, ftLastAccessTime.dwHighDateTime=0x1d5a4f9, ftLastWriteTime.dwLowDateTime=0xc527f5c0, ftLastWriteTime.dwHighDateTime=0x1d5a4f9, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="outlook.exe", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaf30dd0, ftCreationTime.dwHighDateTime=0x1d56b80, ftLastAccessTime.dwLowDateTime=0x7c36a4c0, ftLastAccessTime.dwHighDateTime=0x1d57078, ftLastWriteTime.dwLowDateTime=0x7c36a4c0, ftLastWriteTime.dwHighDateTime=0x1d57078, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="securities-fantastic.exe", cAlternateFileName="SECURI~1.EXE")) returned 1 [0169.522] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0169.522] GetProcessHeap () returned 0xfd0000 [0169.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0169.522] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.522] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.522] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0169.522] GetProcessHeap () returned 0xfd0000 [0169.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.522] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0169.522] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.522] GetProcessHeap () returned 0xfd0000 [0169.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0169.522] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0169.522] GetProcessHeap () returned 0xfd0000 [0169.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0169.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0169.523] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.523] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0169.523] GetProcessHeap () returned 0xfd0000 [0169.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.524] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.524] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0169.524] GetProcessHeap () returned 0xfd0000 [0169.524] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0169.525] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.525] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.525] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0169.525] GetProcessHeap () returned 0xfd0000 [0169.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.525] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Schema", cAlternateFileName="")) returned 1 [0169.525] GetProcessHeap () returned 0xfd0000 [0169.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.525] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.525] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.525] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.525] GetProcessHeap () returned 0xfd0000 [0169.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.525] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Schema", cAlternateFileName="")) returned 0 [0169.525] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.526] GetProcessHeap () returned 0xfd0000 [0169.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0169.526] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3125930, ftCreationTime.dwHighDateTime=0x1d5a9ae, ftLastAccessTime.dwLowDateTime=0x2fb2f870, ftLastAccessTime.dwHighDateTime=0x1d5be10, ftLastWriteTime.dwLowDateTime=0x2fb2f870, ftLastWriteTime.dwHighDateTime=0x1d5be10, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="icq.exe", cAlternateFileName="")) returned 1 [0169.526] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0169.526] GetProcessHeap () returned 0xfd0000 [0169.526] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0169.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0169.528] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0169.528] GetProcessHeap () returned 0xfd0000 [0169.528] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0169.528] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.529] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0169.529] GetProcessHeap () returned 0xfd0000 [0169.529] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.531] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.531] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0169.531] GetProcessHeap () returned 0xfd0000 [0169.531] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.532] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.532] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive", cAlternateFileName="COMPRE~1")) returned 1 [0169.532] GetProcessHeap () returned 0xfd0000 [0169.532] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.532] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.532] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 1 [0169.533] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 0 [0169.533] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0169.533] GetProcessHeap () returned 0xfd0000 [0169.533] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.533] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0169.533] GetProcessHeap () returned 0xfd0000 [0169.533] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0169.534] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 0 [0169.534] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0169.534] GetProcessHeap () returned 0xfd0000 [0169.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0169.534] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.534] GetProcessHeap () returned 0xfd0000 [0169.534] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.psd1", cAlternateFileName="")) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3016, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.psm1", cAlternateFileName="")) returned 1 [0169.534] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OperationValidationResources.psd1", cAlternateFileName="")) returned 1 [0169.535] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test", cAlternateFileName="")) returned 1 [0169.535] GetProcessHeap () returned 0xfd0000 [0169.535] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.535] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.535] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.Tests.ps1", cAlternateFileName="")) returned 1 [0169.535] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0169.535] GetProcessHeap () returned 0xfd0000 [0169.535] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0169.537] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.537] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics", cAlternateFileName="EXAMPL~1.DIA")) returned 1 [0169.537] GetProcessHeap () returned 0xfd0000 [0169.537] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0169.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.538] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.538] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0169.538] GetProcessHeap () returned 0xfd0000 [0169.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0169.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0169.539] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.539] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0169.539] GetProcessHeap () returned 0xfd0000 [0169.539] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0169.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0169.541] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.541] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0169.541] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0169.541] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0169.541] GetProcessHeap () returned 0xfd0000 [0169.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0169.541] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0169.541] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0169.541] GetProcessHeap () returned 0xfd0000 [0169.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0169.541] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0169.541] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.541] GetProcessHeap () returned 0xfd0000 [0169.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0169.543] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0169.543] GetProcessHeap () returned 0xfd0000 [0169.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0169.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0169.546] GetProcessHeap () returned 0xfd0000 [0169.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0169.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0169.547] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.547] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0169.547] GetProcessHeap () returned 0xfd0000 [0169.547] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0169.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.549] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.549] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0169.549] GetProcessHeap () returned 0xfd0000 [0169.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0169.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0169.549] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.550] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0169.550] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0169.550] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0169.550] GetProcessHeap () returned 0xfd0000 [0169.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0169.550] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0169.550] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.550] GetProcessHeap () returned 0xfd0000 [0169.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0169.550] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0169.550] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 0 [0169.550] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0169.550] GetProcessHeap () returned 0xfd0000 [0169.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0169.708] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0169.708] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.708] GetProcessHeap () returned 0xfd0000 [0169.708] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0169.709] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0169.709] GetProcessHeap () returned 0xfd0000 [0169.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0169.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.709] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.709] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1.1", cAlternateFileName="11D0A5~1.1")) returned 1 [0169.709] GetProcessHeap () returned 0xfd0000 [0169.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0169.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.709] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.710] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0169.710] GetProcessHeap () returned 0xfd0000 [0169.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0169.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0169.712] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.712] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0169.712] GetProcessHeap () returned 0xfd0000 [0169.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0169.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0169.712] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.712] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0169.713] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0169.713] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0169.713] GetProcessHeap () returned 0xfd0000 [0169.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0169.713] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0169.713] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0169.713] GetProcessHeap () returned 0xfd0000 [0169.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0169.713] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0169.713] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0169.713] GetProcessHeap () returned 0xfd0000 [0169.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0169.715] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0169.715] GetProcessHeap () returned 0xfd0000 [0169.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0169.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0169.716] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.716] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0169.716] GetProcessHeap () returned 0xfd0000 [0169.716] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0169.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0169.718] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.718] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0169.718] GetProcessHeap () returned 0xfd0000 [0169.718] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0169.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.719] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.719] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0169.719] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0169.719] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.719] GetProcessHeap () returned 0xfd0000 [0169.719] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0169.719] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0169.719] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0169.719] GetProcessHeap () returned 0xfd0000 [0169.719] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0169.719] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0169.719] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0169.719] GetProcessHeap () returned 0xfd0000 [0169.719] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0169.721] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0169.721] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.721] GetProcessHeap () returned 0xfd0000 [0169.721] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0169.722] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0169.722] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0169.722] GetProcessHeap () returned 0xfd0000 [0169.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.722] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0169.722] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.722] GetProcessHeap () returned 0xfd0000 [0169.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.723] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test", cAlternateFileName="")) returned 0 [0169.723] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.724] GetProcessHeap () returned 0xfd0000 [0169.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.724] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0169.724] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0169.724] GetProcessHeap () returned 0xfd0000 [0169.724] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.724] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0169.724] GetProcessHeap () returned 0xfd0000 [0169.724] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0169.724] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.724] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0169.724] GetProcessHeap () returned 0xfd0000 [0169.724] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0169.726] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.726] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0169.726] GetProcessHeap () returned 0xfd0000 [0169.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.729] GetProcessHeap () returned 0xfd0000 [0169.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.729] GetProcessHeap () returned 0xfd0000 [0169.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.729] GetProcessHeap () returned 0xfd0000 [0169.729] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.731] GetProcessHeap () returned 0xfd0000 [0169.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0169.732] GetProcessHeap () returned 0xfd0000 [0169.732] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.736] GetProcessHeap () returned 0xfd0000 [0169.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.737] GetProcessHeap () returned 0xfd0000 [0169.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.737] GetProcessHeap () returned 0xfd0000 [0169.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.738] GetProcessHeap () returned 0xfd0000 [0169.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.738] GetProcessHeap () returned 0xfd0000 [0169.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0169.738] GetProcessHeap () returned 0xfd0000 [0169.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.741] GetProcessHeap () returned 0xfd0000 [0169.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.741] GetProcessHeap () returned 0xfd0000 [0169.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.742] GetProcessHeap () returned 0xfd0000 [0169.742] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.742] GetProcessHeap () returned 0xfd0000 [0169.742] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.742] GetProcessHeap () returned 0xfd0000 [0169.742] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.848] GetProcessHeap () returned 0xfd0000 [0169.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x356e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Be.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x339d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2794, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x281d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2861, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contain.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2933, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c78fa, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511c78fa, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exist.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2787, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Match.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2869, dwReserved0=0x0, dwReserved1=0x0, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2815, dwReserved0=0x0, dwReserved1=0x0, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x395e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3239, dwReserved0=0x0, dwReserved1=0x0, cFileName="Should.ps1", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1 [0169.855] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1 [0169.855] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0 [0169.855] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0169.855] GetProcessHeap () returned 0xfd0000 [0169.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.855] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x686e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x291c, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2848, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4401, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3196, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x37ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510bc884, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510bc884, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3672, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5fcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9205, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1 [0169.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0 [0169.858] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.858] GetProcessHeap () returned 0xfd0000 [0169.858] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.psd1", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x62de, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.psm1", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b06, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.md", cAlternateFileName="")) returned 1 [0169.858] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snippets", cAlternateFileName="")) returned 1 [0169.858] GetProcessHeap () returned 0xfd0000 [0169.858] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c78fa, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511c78fa, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.868] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0 [0169.868] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0169.869] GetProcessHeap () returned 0xfd0000 [0169.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.869] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snippets", cAlternateFileName="")) returned 0 [0169.869] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.869] GetProcessHeap () returned 0xfd0000 [0169.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.870] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0169.870] GetProcessHeap () returned 0xfd0000 [0169.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.873] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.873] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ac43c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0169.873] GetProcessHeap () returned 0xfd0000 [0169.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ac43c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.874] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ac43c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0 [0169.874] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.874] GetProcessHeap () returned 0xfd0000 [0169.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="chocolateyInstall.ps1", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8aca62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.875] GetProcessHeap () returned 0xfd0000 [0169.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8aca62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.875] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8aca62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1739, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1 [0169.876] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0 [0169.876] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.878] GetProcessHeap () returned 0xfd0000 [0169.878] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.878] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Examples", cAlternateFileName="")) returned 1 [0169.878] GetProcessHeap () returned 0xfd0000 [0169.878] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0169.879] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ad5fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1 [0169.879] GetProcessHeap () returned 0xfd0000 [0169.879] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ad5fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.879] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ad5fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1 [0169.879] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0 [0169.879] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.880] GetProcessHeap () returned 0xfd0000 [0169.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0169.880] GetProcessHeap () returned 0xfd0000 [0169.880] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.880] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0 [0169.880] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.880] GetProcessHeap () returned 0xfd0000 [0169.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0169.880] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0169.880] GetProcessHeap () returned 0xfd0000 [0169.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0169.880] GetProcessHeap () returned 0xfd0000 [0169.880] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0169.882] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.882] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc95c764, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1 [0169.882] GetProcessHeap () returned 0xfd0000 [0169.882] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a620b8 [0169.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc95c764, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0169.884] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc95c764, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.884] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1021, dwReserved0=0x0, dwReserved1=0x0, cFileName="Be.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLike.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLike.Tests.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLikeExactly.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeLikeExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x573, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeOfType.ps1", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BeOfType.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contain.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987e10f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987e10f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987e10f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exist.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Match.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1340, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Set-TestInconclusive.ps1", cAlternateFileName="")) returned 1 [0169.887] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Should.ps1", cAlternateFileName="")) returned 1 [0169.887] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1 [0169.887] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1 [0169.887] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0 [0169.887] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0169.888] GetProcessHeap () returned 0xfd0000 [0169.888] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a620b8 | out: hHeap=0xfd0000) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-A.Tests.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-B.Tests.ps1", cAlternateFileName="")) returned 1 [0169.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe941, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x370d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4033, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0 [0169.890] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0169.890] GetProcessHeap () returned 0xfd0000 [0169.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.psd1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6956, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.psm1", cAlternateFileName="")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b95, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1 [0169.891] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.md", cAlternateFileName="")) returned 1 [0169.891] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snippets", cAlternateFileName="")) returned 1 [0169.891] GetProcessHeap () returned 0xfd0000 [0169.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a520b0 [0169.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0169.892] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.892] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.894] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7d993, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e7d993, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e7d993, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.894] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.894] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0169.894] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0 [0169.894] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0169.895] GetProcessHeap () returned 0xfd0000 [0169.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a520b0 | out: hHeap=0xfd0000) returned 1 [0169.895] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snippets", cAlternateFileName="")) returned 0 [0169.895] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0169.895] GetProcessHeap () returned 0xfd0000 [0169.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0169.896] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0169.896] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0169.896] GetProcessHeap () returned 0xfd0000 [0169.896] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0169.896] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0169.896] GetProcessHeap () returned 0xfd0000 [0169.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0169.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0169.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.896] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0169.896] GetProcessHeap () returned 0xfd0000 [0169.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0169.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.045] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.045] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbca0086d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.045] GetProcessHeap () returned 0xfd0000 [0170.045] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbca0086d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0170.045] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbca0086d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.045] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x129b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 0 [0170.046] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0170.046] GetProcessHeap () returned 0xfd0000 [0170.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8653f0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Format.ps1xml", cAlternateFileName="PSGETF~1.PS1")) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8653f0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13872, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSGet.Resource.psd1", cAlternateFileName="PSGETR~1.PSD")) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8653f0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8653f0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSModule.psm1", cAlternateFileName="PSMODU~1.PSM")) returned 0 [0170.046] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.046] GetProcessHeap () returned 0xfd0000 [0170.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.046] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0170.046] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0170.046] GetProcessHeap () returned 0xfd0000 [0170.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.047] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 0 [0170.048] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0170.048] GetProcessHeap () returned 0xfd0000 [0170.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.048] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0170.048] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0170.048] GetProcessHeap () returned 0xfd0000 [0170.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0170.048] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0170.048] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0170.048] GetProcessHeap () returned 0xfd0000 [0170.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0170.049] FindNextFileW (in: hFindFile=0xfe9800, lpFindFileData=0x349f7f0 | out: lpFindFileData=0x349f7f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0170.049] GetProcessHeap () returned 0xfd0000 [0170.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0170.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0170.049] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="..", cAlternateFileName="")) returned 1 [0170.049] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x714, cFileName="Adobe", cAlternateFileName="")) returned 1 [0170.049] GetProcessHeap () returned 0xfd0000 [0170.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0170.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.050] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.050] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0170.050] GetProcessHeap () returned 0xfd0000 [0170.050] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.052] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.052] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0170.052] GetProcessHeap () returned 0xfd0000 [0170.052] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0170.053] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.053] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.053] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0170.053] GetProcessHeap () returned 0xfd0000 [0170.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.053] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0170.053] GetProcessHeap () returned 0xfd0000 [0170.053] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.054] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.054] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.054] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0170.054] GetProcessHeap () returned 0xfd0000 [0170.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.054] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0170.054] GetProcessHeap () returned 0xfd0000 [0170.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\S\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.054] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.054] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.054] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0170.054] GetProcessHeap () returned 0xfd0000 [0170.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.055] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0170.055] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.055] GetProcessHeap () returned 0xfd0000 [0170.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.055] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0170.055] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0170.055] GetProcessHeap () returned 0xfd0000 [0170.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0170.056] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0170.056] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Comms", cAlternateFileName="")) returned 1 [0170.056] GetProcessHeap () returned 0xfd0000 [0170.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0170.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Comms\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.057] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.057] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.057] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.057] GetProcessHeap () returned 0xfd0000 [0170.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0170.057] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Desktop", cAlternateFileName="")) returned 1 [0170.058] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0170.058] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0170.058] GetProcessHeap () returned 0xfd0000 [0170.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0170.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0170.058] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.058] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0170.058] GetProcessHeap () returned 0xfd0000 [0170.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\AppV\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.059] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.059] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0170.059] GetProcessHeap () returned 0xfd0000 [0170.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0170.060] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.060] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0170.060] GetProcessHeap () returned 0xfd0000 [0170.060] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.060] GetProcessHeap () returned 0xfd0000 [0170.060] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.060] GetProcessHeap () returned 0xfd0000 [0170.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0170.061] GetProcessHeap () returned 0xfd0000 [0170.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.062] GetProcessHeap () returned 0xfd0000 [0170.062] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.064] GetProcessHeap () returned 0xfd0000 [0170.064] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.064] GetProcessHeap () returned 0xfd0000 [0170.064] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.069] GetProcessHeap () returned 0xfd0000 [0170.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.069] GetProcessHeap () returned 0xfd0000 [0170.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.069] GetProcessHeap () returned 0xfd0000 [0170.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.070] GetProcessHeap () returned 0xfd0000 [0170.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.082] GetProcessHeap () returned 0xfd0000 [0170.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.082] GetProcessHeap () returned 0xfd0000 [0170.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0170.084] GetProcessHeap () returned 0xfd0000 [0170.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.084] GetProcessHeap () returned 0xfd0000 [0170.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.084] GetProcessHeap () returned 0xfd0000 [0170.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.090] GetProcessHeap () returned 0xfd0000 [0170.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.204] GetProcessHeap () returned 0xfd0000 [0170.204] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.204] GetProcessHeap () returned 0xfd0000 [0170.204] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.265] GetProcessHeap () returned 0xfd0000 [0170.265] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.266] GetProcessHeap () returned 0xfd0000 [0170.266] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.266] GetProcessHeap () returned 0xfd0000 [0170.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.266] GetProcessHeap () returned 0xfd0000 [0170.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.266] GetProcessHeap () returned 0xfd0000 [0170.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0170.267] GetProcessHeap () returned 0xfd0000 [0170.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0170.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.268] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.268] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0170.268] GetProcessHeap () returned 0xfd0000 [0170.268] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0170.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.270] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest.xml", cAlternateFileName="")) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0170.270] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0170.271] GetProcessHeap () returned 0xfd0000 [0170.271] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0170.271] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0170.271] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.271] GetProcessHeap () returned 0xfd0000 [0170.271] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0170.271] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0170.271] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0170.271] GetProcessHeap () returned 0xfd0000 [0170.271] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.272] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0170.272] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.272] GetProcessHeap () returned 0xfd0000 [0170.272] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.272] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0170.273] GetProcessHeap () returned 0xfd0000 [0170.273] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.273] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.273] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0170.273] GetProcessHeap () returned 0xfd0000 [0170.273] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.274] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.274] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.274] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0170.274] GetProcessHeap () returned 0xfd0000 [0170.274] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.274] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0170.274] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0170.274] GetProcessHeap () returned 0xfd0000 [0170.274] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.274] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0170.274] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0170.274] GetProcessHeap () returned 0xfd0000 [0170.274] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.276] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0170.276] GetProcessHeap () returned 0xfd0000 [0170.276] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.283] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.283] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1 [0170.283] GetProcessHeap () returned 0xfd0000 [0170.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.285] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.285] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0170.285] GetProcessHeap () returned 0xfd0000 [0170.285] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0170.293] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0170.293] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.294] GetProcessHeap () returned 0xfd0000 [0170.294] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.294] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0170.294] GetProcessHeap () returned 0xfd0000 [0170.294] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0170.296] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.297] GetProcessHeap () returned 0xfd0000 [0170.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.297] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0170.297] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0170.297] GetProcessHeap () returned 0xfd0000 [0170.297] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.297] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0170.297] GetProcessHeap () returned 0xfd0000 [0170.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.317] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.317] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0170.317] GetProcessHeap () returned 0xfd0000 [0170.317] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0170.361] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.361] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0170.361] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0170.361] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0170.362] GetProcessHeap () returned 0xfd0000 [0170.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.362] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0170.362] GetProcessHeap () returned 0xfd0000 [0170.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0170.366] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.366] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0170.367] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0170.367] GetProcessHeap () returned 0xfd0000 [0170.367] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0170.368] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.368] GetProcessHeap () returned 0xfd0000 [0170.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0170.368] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0170.368] GetProcessHeap () returned 0xfd0000 [0170.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0170.369] GetProcessHeap () returned 0xfd0000 [0170.369] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.370] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.370] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.370] GetProcessHeap () returned 0xfd0000 [0170.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0170.370] GetProcessHeap () returned 0xfd0000 [0170.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.382] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1 [0170.393] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1 [0170.393] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1 [0170.394] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1 [0170.395] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0170.395] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.396] GetProcessHeap () returned 0xfd0000 [0170.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.396] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0170.396] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0170.396] GetProcessHeap () returned 0xfd0000 [0170.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.396] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0170.396] GetProcessHeap () returned 0xfd0000 [0170.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.397] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.397] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0170.397] GetProcessHeap () returned 0xfd0000 [0170.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.397] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.397] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0170.397] GetProcessHeap () returned 0xfd0000 [0170.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0170.402] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.402] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0170.403] GetProcessHeap () returned 0xfd0000 [0170.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0170.403] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.403] GetProcessHeap () returned 0xfd0000 [0170.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0170.403] GetProcessHeap () returned 0xfd0000 [0170.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.405] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.405] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.405] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0170.405] GetProcessHeap () returned 0xfd0000 [0170.405] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.405] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0170.405] GetProcessHeap () returned 0xfd0000 [0170.405] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.412] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.412] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0170.412] GetProcessHeap () returned 0xfd0000 [0170.412] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="咊\x97þ巠Ă|")) returned 0xffffffff [0170.412] GetProcessHeap () returned 0xfd0000 [0170.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.412] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0170.412] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0170.416] GetProcessHeap () returned 0xfd0000 [0170.416] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.416] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0170.416] GetProcessHeap () returned 0xfd0000 [0170.416] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.416] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.416] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0170.416] GetProcessHeap () returned 0xfd0000 [0170.416] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.420] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.420] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0170.420] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0170.420] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.420] GetProcessHeap () returned 0xfd0000 [0170.420] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.420] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0170.420] GetProcessHeap () returned 0xfd0000 [0170.420] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.421] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.421] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1 [0170.421] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0170.421] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0170.421] GetProcessHeap () returned 0xfd0000 [0170.421] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.421] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0170.421] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0170.421] GetProcessHeap () returned 0xfd0000 [0170.421] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.421] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0170.421] GetProcessHeap () returned 0xfd0000 [0170.421] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.427] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.427] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1 [0170.427] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1 [0170.427] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0170.427] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0170.428] GetProcessHeap () returned 0xfd0000 [0170.428] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.428] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0170.428] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.428] GetProcessHeap () returned 0xfd0000 [0170.428] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.428] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0170.428] GetProcessHeap () returned 0xfd0000 [0170.428] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.429] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.429] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0170.429] GetProcessHeap () returned 0xfd0000 [0170.429] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0170.429] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.430] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.430] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0170.430] GetProcessHeap () returned 0xfd0000 [0170.430] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.430] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0170.430] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0170.430] GetProcessHeap () returned 0xfd0000 [0170.430] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.430] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0170.430] GetProcessHeap () returned 0xfd0000 [0170.430] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.430] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.430] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0170.430] GetProcessHeap () returned 0xfd0000 [0170.430] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.431] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.431] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0170.431] GetProcessHeap () returned 0xfd0000 [0170.431] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0170.433] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0170.433] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0170.434] GetProcessHeap () returned 0xfd0000 [0170.434] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.434] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0170.434] GetProcessHeap () returned 0xfd0000 [0170.434] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0170.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0170.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0170.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0170.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0170.435] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0170.435] GetProcessHeap () returned 0xfd0000 [0170.435] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.435] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0170.435] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0170.435] GetProcessHeap () returned 0xfd0000 [0170.435] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.435] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0170.435] GetProcessHeap () returned 0xfd0000 [0170.435] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0170.436] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.436] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0170.436] GetProcessHeap () returned 0xfd0000 [0170.436] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.524] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.524] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.524] GetProcessHeap () returned 0xfd0000 [0170.524] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0170.525] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.525] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0170.525] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0170.525] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0170.526] GetProcessHeap () returned 0xfd0000 [0170.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0170.526] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.526] GetProcessHeap () returned 0xfd0000 [0170.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.526] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0170.527] GetProcessHeap () returned 0xfd0000 [0170.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0170.570] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.570] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.570] GetProcessHeap () returned 0xfd0000 [0170.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.570] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0170.571] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.571] GetProcessHeap () returned 0xfd0000 [0170.571] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0170.572] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0170.572] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0170.572] GetProcessHeap () returned 0xfd0000 [0170.572] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.572] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0170.572] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0170.572] GetProcessHeap () returned 0xfd0000 [0170.572] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.573] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0170.573] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.573] GetProcessHeap () returned 0xfd0000 [0170.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.573] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0170.573] GetProcessHeap () returned 0xfd0000 [0170.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0170.579] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.579] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.579] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0170.579] GetProcessHeap () returned 0xfd0000 [0170.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.579] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0170.579] GetProcessHeap () returned 0xfd0000 [0170.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă~")) returned 0xffffffff [0170.579] GetProcessHeap () returned 0xfd0000 [0170.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.579] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0170.579] GetProcessHeap () returned 0xfd0000 [0170.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.580] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.580] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0170.580] GetProcessHeap () returned 0xfd0000 [0170.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.581] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.581] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.581] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.581] GetProcessHeap () returned 0xfd0000 [0170.581] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.582] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0170.582] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0170.582] GetProcessHeap () returned 0xfd0000 [0170.582] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.582] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0170.582] GetProcessHeap () returned 0xfd0000 [0170.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.583] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.583] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0170.583] GetProcessHeap () returned 0xfd0000 [0170.583] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.583] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.583] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0170.584] GetProcessHeap () returned 0xfd0000 [0170.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.584] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.584] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.584] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0170.584] GetProcessHeap () returned 0xfd0000 [0170.584] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.584] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0170.584] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.584] GetProcessHeap () returned 0xfd0000 [0170.584] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.585] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0170.585] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0170.585] GetProcessHeap () returned 0xfd0000 [0170.585] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.585] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0170.585] GetProcessHeap () returned 0xfd0000 [0170.585] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.585] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.585] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INT", cAlternateFileName="")) returned 1 [0170.585] GetProcessHeap () returned 0xfd0000 [0170.585] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.585] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.585] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0170.585] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0170.586] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0170.586] GetProcessHeap () returned 0xfd0000 [0170.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.586] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0170.586] GetProcessHeap () returned 0xfd0000 [0170.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.588] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.588] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0170.588] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 1 [0170.588] GetProcessHeap () returned 0xfd0000 [0170.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0170.589] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.589] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.589] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0170.589] GetProcessHeap () returned 0xfd0000 [0170.589] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.589] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 0 [0170.589] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.589] GetProcessHeap () returned 0xfd0000 [0170.589] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.589] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0170.590] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0170.590] GetProcessHeap () returned 0xfd0000 [0170.590] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.590] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0170.590] GetProcessHeap () returned 0xfd0000 [0170.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MapData\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.590] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.590] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.590] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0170.590] GetProcessHeap () returned 0xfd0000 [0170.590] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.590] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0170.590] GetProcessHeap () returned 0xfd0000 [0170.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0170.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0170.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0170.591] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0170.591] GetProcessHeap () returned 0xfd0000 [0170.591] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.591] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0170.591] GetProcessHeap () returned 0xfd0000 [0170.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.592] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.592] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0170.592] GetProcessHeap () returned 0xfd0000 [0170.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.592] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.592] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.592] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0170.592] GetProcessHeap () returned 0xfd0000 [0170.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.592] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0170.592] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0170.592] GetProcessHeap () returned 0xfd0000 [0170.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.592] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0170.592] GetProcessHeap () returned 0xfd0000 [0170.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.593] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.593] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0170.593] GetProcessHeap () returned 0xfd0000 [0170.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.594] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.594] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cm", cAlternateFileName="")) returned 1 [0170.594] GetProcessHeap () returned 0xfd0000 [0170.594] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0170.595] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.595] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.595] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0170.595] GetProcessHeap () returned 0xfd0000 [0170.595] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.595] GetProcessHeap () returned 0xfd0000 [0170.595] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.604] GetProcessHeap () returned 0xfd0000 [0170.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.604] GetProcessHeap () returned 0xfd0000 [0170.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.604] GetProcessHeap () returned 0xfd0000 [0170.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0170.605] GetProcessHeap () returned 0xfd0000 [0170.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.605] GetProcessHeap () returned 0xfd0000 [0170.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.605] GetProcessHeap () returned 0xfd0000 [0170.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Office\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.605] GetProcessHeap () returned 0xfd0000 [0170.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0170.605] GetProcessHeap () returned 0xfd0000 [0170.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0170.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0170.608] GetProcessHeap () returned 0xfd0000 [0170.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.608] GetProcessHeap () returned 0xfd0000 [0170.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.609] GetProcessHeap () returned 0xfd0000 [0170.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.610] GetProcessHeap () returned 0xfd0000 [0170.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.610] GetProcessHeap () returned 0xfd0000 [0170.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.610] GetProcessHeap () returned 0xfd0000 [0170.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.612] GetProcessHeap () returned 0xfd0000 [0170.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.613] GetProcessHeap () returned 0xfd0000 [0170.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.614] GetProcessHeap () returned 0xfd0000 [0170.614] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.615] GetProcessHeap () returned 0xfd0000 [0170.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.615] GetProcessHeap () returned 0xfd0000 [0170.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.615] GetProcessHeap () returned 0xfd0000 [0170.615] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.616] GetProcessHeap () returned 0xfd0000 [0170.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0170.617] GetProcessHeap () returned 0xfd0000 [0170.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.618] GetProcessHeap () returned 0xfd0000 [0170.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.619] GetProcessHeap () returned 0xfd0000 [0170.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.619] GetProcessHeap () returned 0xfd0000 [0170.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.619] GetProcessHeap () returned 0xfd0000 [0170.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.620] GetProcessHeap () returned 0xfd0000 [0170.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.621] GetProcessHeap () returned 0xfd0000 [0170.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.737] GetProcessHeap () returned 0xfd0000 [0170.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0170.738] GetProcessHeap () returned 0xfd0000 [0170.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.741] GetProcessHeap () returned 0xfd0000 [0170.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.742] GetProcessHeap () returned 0xfd0000 [0170.742] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.743] GetProcessHeap () returned 0xfd0000 [0170.743] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0170.744] GetProcessHeap () returned 0xfd0000 [0170.744] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.745] GetProcessHeap () returned 0xfd0000 [0170.745] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.746] GetProcessHeap () returned 0xfd0000 [0170.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.746] GetProcessHeap () returned 0xfd0000 [0170.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.746] GetProcessHeap () returned 0xfd0000 [0170.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.747] GetProcessHeap () returned 0xfd0000 [0170.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.759] GetProcessHeap () returned 0xfd0000 [0170.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.763] GetProcessHeap () returned 0xfd0000 [0170.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.765] GetProcessHeap () returned 0xfd0000 [0170.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.765] GetProcessHeap () returned 0xfd0000 [0170.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.765] GetProcessHeap () returned 0xfd0000 [0170.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.766] GetProcessHeap () returned 0xfd0000 [0170.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.767] GetProcessHeap () returned 0xfd0000 [0170.767] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.768] GetProcessHeap () returned 0xfd0000 [0170.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0170.768] GetProcessHeap () returned 0xfd0000 [0170.768] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.768] GetProcessHeap () returned 0xfd0000 [0170.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.769] GetProcessHeap () returned 0xfd0000 [0170.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.770] GetProcessHeap () returned 0xfd0000 [0170.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.771] GetProcessHeap () returned 0xfd0000 [0170.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.772] GetProcessHeap () returned 0xfd0000 [0170.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.772] GetProcessHeap () returned 0xfd0000 [0170.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.773] GetProcessHeap () returned 0xfd0000 [0170.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.773] GetProcessHeap () returned 0xfd0000 [0170.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.774] GetProcessHeap () returned 0xfd0000 [0170.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.775] GetProcessHeap () returned 0xfd0000 [0170.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0170.784] GetProcessHeap () returned 0xfd0000 [0170.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.785] GetProcessHeap () returned 0xfd0000 [0170.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.785] GetProcessHeap () returned 0xfd0000 [0170.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.786] GetProcessHeap () returned 0xfd0000 [0170.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.787] GetProcessHeap () returned 0xfd0000 [0170.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.788] GetProcessHeap () returned 0xfd0000 [0170.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.789] GetProcessHeap () returned 0xfd0000 [0170.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.790] GetProcessHeap () returned 0xfd0000 [0170.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.790] GetProcessHeap () returned 0xfd0000 [0170.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.790] GetProcessHeap () returned 0xfd0000 [0170.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.791] GetProcessHeap () returned 0xfd0000 [0170.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.792] GetProcessHeap () returned 0xfd0000 [0170.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0170.793] GetProcessHeap () returned 0xfd0000 [0170.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0170.795] GetProcessHeap () returned 0xfd0000 [0170.795] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.796] GetProcessHeap () returned 0xfd0000 [0170.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.796] GetProcessHeap () returned 0xfd0000 [0170.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.797] GetProcessHeap () returned 0xfd0000 [0170.797] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0170.927] GetProcessHeap () returned 0xfd0000 [0170.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.929] GetProcessHeap () returned 0xfd0000 [0170.929] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.930] GetProcessHeap () returned 0xfd0000 [0170.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.930] GetProcessHeap () returned 0xfd0000 [0170.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.930] GetProcessHeap () returned 0xfd0000 [0170.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.931] GetProcessHeap () returned 0xfd0000 [0170.931] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0170.932] GetProcessHeap () returned 0xfd0000 [0170.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.933] GetProcessHeap () returned 0xfd0000 [0170.933] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0170.934] GetProcessHeap () returned 0xfd0000 [0170.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.934] GetProcessHeap () returned 0xfd0000 [0170.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.934] GetProcessHeap () returned 0xfd0000 [0170.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.935] GetProcessHeap () returned 0xfd0000 [0170.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0170.936] GetProcessHeap () returned 0xfd0000 [0170.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0170.937] GetProcessHeap () returned 0xfd0000 [0170.937] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.938] GetProcessHeap () returned 0xfd0000 [0170.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0170.938] GetProcessHeap () returned 0xfd0000 [0170.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0170.938] GetProcessHeap () returned 0xfd0000 [0170.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0170.939] GetProcessHeap () returned 0xfd0000 [0170.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0170.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0170.944] GetProcessHeap () returned 0xfd0000 [0170.944] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0170.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0170.945] GetProcessHeap () returned 0xfd0000 [0170.945] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0170.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0171.462] GetProcessHeap () returned 0xfd0000 [0171.462] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.471] GetProcessHeap () returned 0xfd0000 [0171.471] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.471] GetProcessHeap () returned 0xfd0000 [0171.471] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.472] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0171.472] GetProcessHeap () returned 0xfd0000 [0171.472] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.473] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.473] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0171.473] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0171.473] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0171.473] GetProcessHeap () returned 0xfd0000 [0171.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0171.474] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.475] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0171.475] GetProcessHeap () returned 0xfd0000 [0171.475] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.475] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.475] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f19b66, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f19b66, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0171.476] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f19b66, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f19b66, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0171.476] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.476] GetProcessHeap () returned 0xfd0000 [0171.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.476] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0171.476] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0171.476] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0171.476] GetProcessHeap () returned 0xfd0000 [0171.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.476] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0171.476] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.476] GetProcessHeap () returned 0xfd0000 [0171.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.477] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0171.477] GetProcessHeap () returned 0xfd0000 [0171.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0171.478] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.478] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6a449, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6a449, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6a449, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0171.479] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0171.479] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0171.479] GetProcessHeap () returned 0xfd0000 [0171.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0171.480] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.480] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0171.480] GetProcessHeap () returned 0xfd0000 [0171.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.481] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.481] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef7d10, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef7d10, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0171.481] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef7d10, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef7d10, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0171.481] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.481] GetProcessHeap () returned 0xfd0000 [0171.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.481] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0171.481] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0171.481] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0171.481] GetProcessHeap () returned 0xfd0000 [0171.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.481] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0171.481] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0171.481] GetProcessHeap () returned 0xfd0000 [0171.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.482] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0171.482] GetProcessHeap () returned 0xfd0000 [0171.482] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0171.485] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.485] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560ed25a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x560ed25a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x560ed25a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x6274, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0171.485] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d0d528, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55d0d528, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55d0d528, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0171.485] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0171.485] GetProcessHeap () returned 0xfd0000 [0171.485] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0171.486] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.486] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0171.486] GetProcessHeap () returned 0xfd0000 [0171.486] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0171.488] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.488] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c4e960, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c4e960, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55c4e960, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x93d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1 [0171.488] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c74bbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c74bbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55c74bbc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1018, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c9ae14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c9ae14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55c9ae14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x0, dwReserved1=0x0, cFileName="2__Power_Policy.provxml", cAlternateFileName="2__POW~1.PRO")) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55cc1070, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x0, dwReserved1=0x0, cFileName="3__Power_Policy.provxml", cAlternateFileName="3__POW~1.PRO")) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55cc1070, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="4__Power_Policy.provxml", cAlternateFileName="4__POW~1.PRO")) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55cc1070, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="5__Power_Policy.provxml", cAlternateFileName="5__POW~1.PRO")) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x93f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6__Power_Policy.provxml", cAlternateFileName="6__POW~1.PRO")) returned 1 [0171.489] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x93f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6__Power_Policy.provxml", cAlternateFileName="6__POW~1.PRO")) returned 0 [0171.489] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0171.490] GetProcessHeap () returned 0xfd0000 [0171.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.490] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0171.490] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0171.490] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0171.490] GetProcessHeap () returned 0xfd0000 [0171.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.490] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0171.490] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0171.490] GetProcessHeap () returned 0xfd0000 [0171.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.491] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0171.491] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0171.491] GetProcessHeap () returned 0xfd0000 [0171.491] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.491] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0171.492] GetProcessHeap () returned 0xfd0000 [0171.492] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.492] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.492] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0171.492] GetProcessHeap () returned 0xfd0000 [0171.492] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.494] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.494] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0171.494] GetProcessHeap () returned 0xfd0000 [0171.494] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0171.495] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.495] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0171.495] GetProcessHeap () returned 0xfd0000 [0171.495] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x2010, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="咊\x97þ巠Ă{")) returned 0xffffffff [0171.496] GetProcessHeap () returned 0xfd0000 [0171.496] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.496] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0171.496] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0171.496] GetProcessHeap () returned 0xfd0000 [0171.496] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.496] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0171.496] GetProcessHeap () returned 0xfd0000 [0171.496] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="咊\x97þ巠Ă|")) returned 0xffffffff [0171.501] GetProcessHeap () returned 0xfd0000 [0171.501] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.501] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0171.501] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.501] GetProcessHeap () returned 0xfd0000 [0171.501] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.502] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0171.502] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0171.502] GetProcessHeap () returned 0xfd0000 [0171.502] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.502] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0171.502] GetProcessHeap () returned 0xfd0000 [0171.502] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Settings\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.503] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.503] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 1 [0171.503] GetProcessHeap () returned 0xfd0000 [0171.503] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Settings\\Accounts\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0171.504] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.504] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.504] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0171.504] GetProcessHeap () returned 0xfd0000 [0171.504] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.504] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 0 [0171.504] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.504] GetProcessHeap () returned 0xfd0000 [0171.504] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.504] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0171.504] GetProcessHeap () returned 0xfd0000 [0171.504] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\SmsRouter\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="咊\x97þ巠Ă~")) returned 0xffffffff [0171.505] GetProcessHeap () returned 0xfd0000 [0171.505] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.505] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0171.505] GetProcessHeap () returned 0xfd0000 [0171.505] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Spectrum\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.505] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.505] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.505] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.505] GetProcessHeap () returned 0xfd0000 [0171.505] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.505] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0171.505] GetProcessHeap () returned 0xfd0000 [0171.505] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0171.506] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.506] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.506] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0171.506] GetProcessHeap () returned 0xfd0000 [0171.506] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.506] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0171.506] GetProcessHeap () returned 0xfd0000 [0171.506] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Storage Health\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.507] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x165f3a8f, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0 [0171.507] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.507] GetProcessHeap () returned 0xfd0000 [0171.507] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0171.507] GetProcessHeap () returned 0xfd0000 [0171.507] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0171.658] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.658] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1 [0171.658] GetProcessHeap () returned 0xfd0000 [0171.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0171.660] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1 [0171.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 0 [0171.663] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0171.664] GetProcessHeap () returned 0xfd0000 [0171.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.664] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1 [0171.664] GetProcessHeap () returned 0xfd0000 [0171.664] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0171.664] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 0 [0171.665] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0171.665] GetProcessHeap () returned 0xfd0000 [0171.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0171.665] GetProcessHeap () returned 0xfd0000 [0171.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0171.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1 [0171.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 0 [0171.666] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0171.666] GetProcessHeap () returned 0xfd0000 [0171.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0171.666] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0171.666] GetProcessHeap () returned 0xfd0000 [0171.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0171.666] GetProcessHeap () returned 0xfd0000 [0171.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0171.666] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 0 [0171.667] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0171.667] GetProcessHeap () returned 0xfd0000 [0171.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.667] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0171.667] GetProcessHeap () returned 0xfd0000 [0171.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0171.667] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1 [0171.668] GetProcessHeap () returned 0xfd0000 [0171.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.668] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 0 [0171.668] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.668] GetProcessHeap () returned 0xfd0000 [0171.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.668] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0171.668] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0171.669] GetProcessHeap () returned 0xfd0000 [0171.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.669] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0171.669] GetProcessHeap () returned 0xfd0000 [0171.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WDF\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.669] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.669] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.669] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.669] GetProcessHeap () returned 0xfd0000 [0171.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.669] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0171.669] GetProcessHeap () returned 0xfd0000 [0171.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0171.669] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.669] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc9faaa23, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc9faaa23, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppRepository", cAlternateFileName="APPREP~1")) returned 1 [0171.670] GetProcessHeap () returned 0xfd0000 [0171.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0171.670] GetProcessHeap () returned 0xfd0000 [0171.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.670] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4e338, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc9b08d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xadc74e2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4317, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxProvisioning.xml", cAlternateFileName="APPXPR~1.XML")) returned 1 [0171.670] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e238740, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xf60bd162, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf60bd162, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0171.670] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x7dc6c35, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClipSVC", cAlternateFileName="")) returned 1 [0171.670] GetProcessHeap () returned 0xfd0000 [0171.670] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x7dc6c35, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0171.672] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x7dc6c35, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x7dc6c35, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.672] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17cbb4ff, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Archive", cAlternateFileName="")) returned 1 [0171.672] GetProcessHeap () returned 0xfd0000 [0171.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17cbb4ff, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x7d7457cd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0171.673] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17cbb4ff, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x7d7457cd, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.673] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0171.673] GetProcessHeap () returned 0xfd0000 [0171.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0171.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9246834, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xd9246834, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x11f29520, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x0, dwReserved1=0x0, cFileName="02305155-8ac1-1189-ff55-b7119a53887c.xml", cAlternateFileName="023051~1.XML")) returned 1 [0171.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8bd085, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfb8bd085, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfb8bd085, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml", cAlternateFileName="03F897~1.XML")) returned 1 [0171.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdc841a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xcdc841a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcdc841a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc81, dwReserved0=0x0, dwReserved1=0x0, cFileName="0890ad2f-b74f-c384-f684-9c33f8f67924.xml", cAlternateFileName="0890AD~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2c2ce9, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f2c2ce9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe4e92946, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xaea, dwReserved0=0x0, dwReserved1=0x0, cFileName="08961e67-fd90-a888-a0c1-ffdc19a3386f.xml", cAlternateFileName="08961E~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e6060f7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e6060f7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe698b3f0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x0, dwReserved1=0x0, cFileName="0a8c1492-65ca-6a01-de25-0e183559d10d.xml", cAlternateFileName="0A8C14~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7956cf0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe7956cf0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe7956cf0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xad9, dwReserved0=0x0, dwReserved1=0x0, cFileName="0cb4ef12-226b-0a51-6930-2dbfb63f3e7d.xml", cAlternateFileName="0CB4EF~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4548ff6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x4548ff6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x4548ff6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml", cAlternateFileName="13BA87~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7cb078, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xea7cb078, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xea7cb078, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1659a225-428e-84f0-ba52-5fb2b85d55b3.xml", cAlternateFileName="1659A2~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7331f5, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xec7331f5, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xec759452, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x0, dwReserved1=0x0, cFileName="1dae14df-4c42-28af-691e-10cc07a990b4.xml", cAlternateFileName="1DAE14~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e20015d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e20015d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8863ab4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml", cAlternateFileName="1E2259~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dedefe5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dedefe5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe98259ba, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xade, dwReserved0=0x0, dwReserved1=0x0, cFileName="215f9712-9fca-a3f8-5b11-660eefc73b96.xml", cAlternateFileName="215F97~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8863ab4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe8863ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe8863ab4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2657f7c0-8294-58c3-f394-15fe18ba174a.xml", cAlternateFileName="2657F7~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91532c3, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf91532c3, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf91532c3, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="26943e1f-42ed-f190-2895-3bc2b8c4176d.xml", cAlternateFileName="26943E~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7eb90, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfd7eb90, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfd7eb90, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="280b97f1-1f94-1458-c842-d18e2d1e05f9.xml", cAlternateFileName="280B97~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd3f7c, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7ddd3f7c, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xea7cb078, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="28502d06-9d29-8514-1e5d-64447116d798.xml", cAlternateFileName="28502D~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcef153, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dcef153, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xeb796a75, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="28748306-9f02-a5d7-6ded-4459fddadc31.xml", cAlternateFileName="287483~1.XML")) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7457cd, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xec759452, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa45, dwReserved0=0x0, dwReserved1=0x0, cFileName="2a3adcd0-4ddc-f3d2-6bcb-f11f9cbc1e2c.xml", cAlternateFileName="2A3ADC~1.XML")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1b4b95, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee1b4b95, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee1b4b95, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x0, dwReserved1=0x0, cFileName="2cb4947b-9a24-70fc-387f-98cfa7cd7461.xml", cAlternateFileName="2CB494~1.XML")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d0cfd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x23d0cfd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x23d0cfd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xdb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml", cAlternateFileName="38AE35~1.XML")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb5d6de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfcb5d6de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfcb5d6de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="3bef1b80-1939-62a0-48e8-4b25b157e940.xml", cAlternateFileName="3BEF1B~1.XML")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e9efd0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10e9efd0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10e9efd0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml", cAlternateFileName="3C8C7E~1.XML")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1688d1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee1688d1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee1688d1, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x0, dwReserved1=0x0, cFileName="3d4098b6-679e-0d7e-f478-ee96ebcb42ff.xml", cAlternateFileName="3D4098~1.XML")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f73b48e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f73b48e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f8201b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xfc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="3e260c8e-54e8-d0b9-02ab-2d0faa9743f8.xml", cAlternateFileName="3E260C~1.XML")) returned 1 [0171.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf116af2a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf116af2a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf116af2a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ebdb897-991b-934f-ee13-2ca21ed81938.xml", cAlternateFileName="3EBDB8~1.XML")) returned 1 [0171.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe97ff772, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe97ff772, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe97ff772, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc87, dwReserved0=0x0, dwReserved1=0x0, cFileName="41a63518-8ec4-f58c-c5ed-313ea0fb2820.xml", cAlternateFileName="41A635~1.XML")) returned 1 [0171.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b836c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x56b836c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x56b836c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xdb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="46a9b648-161a-6393-bdaf-a6ccb77a570d.xml", cAlternateFileName="46A9B6~1.XML")) returned 1 [0171.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf014be5b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf014be5b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf014be5b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x0, dwReserved1=0x0, cFileName="4ad5b311-485b-15cc-97e9-9adb84427d7b.xml", cAlternateFileName="4AD5B3~1.XML")) returned 1 [0171.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5f72a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xed5f72a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xed5f72a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc81, dwReserved0=0x0, dwReserved1=0x0, cFileName="4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml", cAlternateFileName="4C4ECB~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7de131, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7de131, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf17ba2b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="517cfcaf-138b-1796-2cea-62892204250a.xml", cAlternateFileName="517CFC~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf286a9f1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf286a9f1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf286a9f1, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa41, dwReserved0=0x0, dwReserved1=0x0, cFileName="5390be10-79b5-dc50-bb32-91842c76e607.xml", cAlternateFileName="5390BE~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf385c53a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf385c53a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf385c53a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="54a30ac2-1ccf-60a8-6672-380af6008f3d.xml", cAlternateFileName="54A30A~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf388279b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf388279b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf388279b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="59e31519-5400-7696-2a00-b5fca5ba8904.xml", cAlternateFileName="59E315~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d8c2f73, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d8c2f73, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf4afcc60, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x0, dwReserved1=0x0, cFileName="5b0a39aa-16e0-a938-f694-656664c7be15.xml", cAlternateFileName="5B0A39~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd7b5b8, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfdd7b5b8, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfdd7b5b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="5dd8bcf1-73af-cff8-d142-0ca7feade752.xml", cAlternateFileName="5DD8BC~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7930a89, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe7930a89, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe7930a89, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="5f3c8956-0358-1f87-eb47-697e265d6aa9.xml", cAlternateFileName="5F3C89~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf49f1b92, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf49f1b92, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf49f1b92, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x0, dwReserved1=0x0, cFileName="600364a7-e11c-efda-2c12-eac40e75f19a.xml", cAlternateFileName="600364~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cb83c7, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf5cb83c7, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5cb83c7, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="61b5bd89-4cb0-db77-6622-cb63b5a58080.xml", cAlternateFileName="61B5BD~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffedc521, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xffedc521, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xffedc521, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml", cAlternateFileName="630A70~1.XML")) returned 1 [0171.680] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df516f3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7df516f3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf5cb83c7, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x0, dwReserved1=0x0, cFileName="67447b0c-05cf-6740-5f7b-391ab440c42d.xml", cAlternateFileName="67447B~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e0cee88, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e0cee88, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf7e4055d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml", cAlternateFileName="71C8F3~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac64cd3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xac64cd3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xac64cd3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="71ef3df1-f4b1-69cd-793a-48e165e282aa.xml", cAlternateFileName="71EF3D~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d850833, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d850833, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xf917951d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x0, dwReserved1=0x0, cFileName="7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml", cAlternateFileName="730908~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1302615f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7646fa0f-b52c-71a8-3aed-950dd1668c09.xml", cAlternateFileName="7646FA~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1677f3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e1677f3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfb8e32db, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x0, dwReserved1=0x0, cFileName="8292682a-6850-c06c-9b6d-9646f16d4ed0.xml", cAlternateFileName="829268~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e4fb076, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e4fb076, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfcdbfc63, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xb00, dwReserved0=0x0, dwReserved1=0x0, cFileName="865e8f30-20a1-9528-bb48-42999b5b2aa8.xml", cAlternateFileName="865E8F~1.XML")) returned 1 [0171.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc0a322, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dc0a322, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfdda1820, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml", cAlternateFileName="8CE3D3~1.XML")) returned 1 [0171.682] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db254f9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7db254f9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfeec46de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8d56e57b-8663-136d-ff69-a004e217825a.xml", cAlternateFileName="8D56E5~1.XML")) returned 1 [0171.682] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9cdfc2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d9cdfc2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfff0277e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa67, dwReserved0=0x0, dwReserved1=0x0, cFileName="8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml", cAlternateFileName="8E383E~1.XML")) returned 1 [0171.682] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9f5f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x66a9f5f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x66a9f5f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc81, dwReserved0=0x0, dwReserved1=0x0, cFileName="91edce6b-d93b-f186-c4e2-d38502cc520e.xml", cAlternateFileName="91EDCE~1.XML")) returned 1 [0171.682] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb24dd5d, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xdb24dd5d, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xdb24dd5d, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0xcc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="92c2558b-5247-7fec-0ec0-79f2583ab410.xml", cAlternateFileName="92C255~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da406e3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7da406e3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x1071af7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml", cAlternateFileName="9D3AD2~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104b893, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x104b893, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x104b893, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xcc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="a1bac04c-582b-d37d-069c-13f17a799e18.xml", cAlternateFileName="A1BAC0~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db97c1a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7db97c1a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x23f6f61, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xac2, dwReserved0=0x0, dwReserved1=0x0, cFileName="a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml", cAlternateFileName="A1E5B1~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7e4055d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7e4055d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7e4055d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml", cAlternateFileName="A7E08B~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf284473b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf284473b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf284473b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml", cAlternateFileName="AA4E72~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e272861, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e272861, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x355740d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ac116a72-b6b1-d558-23f6-10796e634d41.xml", cAlternateFileName="AC116A~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e37d943, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e37d943, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x456f261, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml", cAlternateFileName="B34B19~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de4668d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7de4668d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x56b836c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xac2, dwReserved0=0x0, dwReserved1=0x0, cFileName="b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml", cAlternateFileName="B81D7E~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9f5f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x66a9f5f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x66a9f5f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa51, dwReserved0=0x0, dwReserved1=0x0, cFileName="babc0ea4-dabb-04f7-1017-a11af9b29344.xml", cAlternateFileName="BABC0E~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca2d62, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbca2d62, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbca2d62, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xdd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml", cAlternateFileName="BBC7A1~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd6185e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dd6185e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x78b1c3c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa41, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml", cAlternateFileName="BBFBE8~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dfea066, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dfea066, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x893c171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml", cAlternateFileName="BCDA97~1.XML")) returned 1 [0171.683] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb373f2, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xfb373f2, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0xfb373f2, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x1aa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="be7366a7-9d6c-ef6d-2f6b-fe59a23f007c.xml", cAlternateFileName="BE7366~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e488974, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e488974, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xac8af30, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml", cAlternateFileName="C3D42A~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893c171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x893c171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x893c171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc91, dwReserved0=0x0, dwReserved1=0x0, cFileName="c94a6c18-d496-da1c-8a02-fc6976e0145e.xml", cAlternateFileName="C94A6C~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x355740d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x355740d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x355740d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca947da2-7e9a-7249-8095-bceb379c6f74.xml", cAlternateFileName="CA947D~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfee9e48b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfee9e48b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfee9e48b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb692946-a9f3-639d-1064-a6d75a01b9c3.xml", cAlternateFileName="CB6929~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb770a25, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeb770a25, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeb770a25, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml", cAlternateFileName="D1ECFC~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde2c70d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xde2c70d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xde2c70d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="d445d1cd-ecdf-2830-df9e-3f187e431898.xml", cAlternateFileName="D445D1~1.XML")) returned 1 [0171.684] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc7ca36, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7dc7ca36, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbcc9055, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xace, dwReserved0=0x0, dwReserved1=0x0, cFileName="d508ba05-d8aa-2836-484d-3833d22fe185.xml", cAlternateFileName="D508BA~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0125c0b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0125c0b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0125c0b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="dc5bc54e-ee99-04c5-63a5-669bf0666354.xml", cAlternateFileName="DC5BC5~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e05c76e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e05c76e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcdee677, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x0, dwReserved1=0x0, cFileName="e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml", cAlternateFileName="E2A686~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8eb3d8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xda8eb3d8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe69651bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc76, dwReserved0=0x0, dwReserved1=0x0, cFileName="e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml", cAlternateFileName="E335BA~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde52960, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xde52960, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xde52960, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xad4, dwReserved0=0x0, dwReserved1=0x0, cFileName="e603fcd0-9cde-3f41-875c-5cc396d927ce.xml", cAlternateFileName="E603FC~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e30b1b9, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e30b1b9, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xed5f72a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa51, dwReserved0=0x0, dwReserved1=0x0, cFileName="e64ffef1-e246-b632-595b-56076a3fa776.xml", cAlternateFileName="E64FFE~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d95b8ca, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d95b8ca, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xfda4de9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xaea, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml", cAlternateFileName="E8AC93~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3efff1, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e3efff1, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x10ec523b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8fff2df-6041-8f21-3df7-db31661aa09b.xml", cAlternateFileName="E8FFF2~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78192ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x78192ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x78192ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml", cAlternateFileName="ECBC26~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5939ec, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7e5939ec, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x11f4f803, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x0, dwReserved1=0x0, cFileName="eee47229-947d-2ac7-e8a3-49bafee251d1.xml", cAlternateFileName="EEE472~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e92946, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe4e92946, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe4e92946, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xc92, dwReserved0=0x0, dwReserved1=0x0, cFileName="f428c4e6-787a-08fa-4d5a-e12a3034aa02.xml", cAlternateFileName="F428C4~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b7edb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7b7edb, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x1304c3c7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fc93b452-8a84-dede-3b7a-0fc9413c4592.xml", cAlternateFileName="FC93B4~1.XML")) returned 1 [0171.685] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b7edb, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x7d7b7edb, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x1304c3c7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fc93b452-8a84-dede-3b7a-0fc9413c4592.xml", cAlternateFileName="FC93B4~1.XML")) returned 0 [0171.685] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0171.686] GetProcessHeap () returned 0xfd0000 [0171.686] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.686] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 0 [0171.688] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0171.688] GetProcessHeap () returned 0xfd0000 [0171.688] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.688] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GenuineTicket", cAlternateFileName="GENUIN~1")) returned 1 [0171.688] GetProcessHeap () returned 0xfd0000 [0171.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\GenuineTicket\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.688] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.688] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.688] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.688] GetProcessHeap () returned 0xfd0000 [0171.688] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.688] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Import", cAlternateFileName="")) returned 1 [0171.688] GetProcessHeap () returned 0xfd0000 [0171.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Import\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.689] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.689] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InApp", cAlternateFileName="")) returned 1 [0171.689] GetProcessHeap () returned 0xfd0000 [0171.689] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Import\\InApp\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.690] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.690] GetProcessHeap () returned 0xfd0000 [0171.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.690] GetProcessHeap () returned 0xfd0000 [0171.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.691] GetProcessHeap () returned 0xfd0000 [0171.691] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f20423e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.691] GetProcessHeap () returned 0xfd0000 [0171.691] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install\\Apps\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249ea1e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7e6eaf16, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x7e6eaf16, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0171.691] GetProcessHeap () returned 0xfd0000 [0171.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.691] GetProcessHeap () returned 0xfd0000 [0171.691] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install\\Device\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.692] GetProcessHeap () returned 0xfd0000 [0171.692] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.692] GetProcessHeap () returned 0xfd0000 [0171.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install\\KeyHolder\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.692] GetProcessHeap () returned 0xfd0000 [0171.692] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.692] GetProcessHeap () returned 0xfd0000 [0171.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Install\\Migration\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0171.693] GetProcessHeap () returned 0xfd0000 [0171.693] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.693] GetProcessHeap () returned 0xfd0000 [0171.693] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.693] GetProcessHeap () returned 0xfd0000 [0171.693] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.694] GetProcessHeap () returned 0xfd0000 [0171.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccc6a2b9, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xccc6a2b9, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.696] GetProcessHeap () returned 0xfd0000 [0171.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrccache\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0171.697] GetProcessHeap () returned 0xfd0000 [0171.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\dmrccache\\downloads\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0171.698] GetProcessHeap () returned 0xfd0000 [0171.813] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.813] GetProcessHeap () returned 0xfd0000 [0171.813] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.813] GetProcessHeap () returned 0xfd0000 [0171.813] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.815] GetProcessHeap () returned 0xfd0000 [0171.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.815] GetProcessHeap () returned 0xfd0000 [0171.815] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a24b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8fdd8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.816] GetProcessHeap () returned 0xfd0000 [0171.816] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.816] GetProcessHeap () returned 0xfd0000 [0171.816] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.816] GetProcessHeap () returned 0xfd0000 [0171.816] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0171.816] GetProcessHeap () returned 0xfd0000 [0171.816] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.817] GetProcessHeap () returned 0xfd0000 [0171.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\LfSvc\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0171.817] GetProcessHeap () returned 0xfd0000 [0171.817] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.817] GetProcessHeap () returned 0xfd0000 [0171.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\PackagedEventProviders\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0171.817] GetProcessHeap () returned 0xfd0000 [0171.817] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.817] GetProcessHeap () returned 0xfd0000 [0171.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0171.818] GetProcessHeap () returned 0xfd0000 [0171.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Parental Controls\\settings\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.818] GetProcessHeap () returned 0xfd0000 [0171.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.818] GetProcessHeap () returned 0xfd0000 [0171.818] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.818] GetProcessHeap () returned 0xfd0000 [0171.818] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0171.819] GetProcessHeap () returned 0xfd0000 [0171.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.819] GetProcessHeap () returned 0xfd0000 [0171.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.819] GetProcessHeap () returned 0xfd0000 [0171.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.819] GetProcessHeap () returned 0xfd0000 [0171.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SleepStudy\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.819] GetProcessHeap () returned 0xfd0000 [0171.819] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.819] GetProcessHeap () returned 0xfd0000 [0171.819] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.820] GetProcessHeap () returned 0xfd0000 [0171.820] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0171.820] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.821] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.821] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0171.821] GetProcessHeap () returned 0xfd0000 [0171.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.821] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0171.821] GetProcessHeap () returned 0xfd0000 [0171.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0171.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.821] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.821] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0171.821] GetProcessHeap () returned 0xfd0000 [0171.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.821] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0171.821] GetProcessHeap () returned 0xfd0000 [0171.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0171.822] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.822] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.822] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0171.822] GetProcessHeap () returned 0xfd0000 [0171.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.822] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0171.822] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.822] GetProcessHeap () returned 0xfd0000 [0171.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.822] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0171.822] GetProcessHeap () returned 0xfd0000 [0171.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0171.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f43b93, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.822] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0171.823] GetProcessHeap () returned 0xfd0000 [0171.823] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.823] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.823] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ae4bfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ae4bfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ae4bfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 1 [0171.823] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0171.823] GetProcessHeap () returned 0xfd0000 [0171.823] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0171.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 0 [0171.824] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0171.824] GetProcessHeap () returned 0xfd0000 [0171.824] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0171.824] GetProcessHeap () returned 0xfd0000 [0171.824] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0171.824] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98a4376e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98a4376e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630c736a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x630c736a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x630c736a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6e8df9, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9e26238d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x9c706000, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Assist.lnk", cAlternateFileName="")) returned 1 [0171.824] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c555e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x67c555e4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x67c555e4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="")) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8ce781, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8ce781, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="")) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378897b7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x378897b7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x378897b7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="Steps Recorder.lnk", cAlternateFileName="")) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0171.825] GetProcessHeap () returned 0xfd0000 [0171.825] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0171.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.825] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655bc768, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x655bc768, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x655bc768, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="")) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0171.825] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.825] GetProcessHeap () returned 0xfd0000 [0171.825] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0171.825] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0171.826] GetProcessHeap () returned 0xfd0000 [0171.826] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0171.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.826] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.826] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.826] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.826] GetProcessHeap () returned 0xfd0000 [0171.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0171.826] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="")) returned 1 [0171.826] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xf78d700, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="")) returned 1 [0171.826] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653f2a91, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x653f2a91, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x653f2a91, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0171.826] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96ce7e01, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96ce7e01, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="")) returned 0 [0171.827] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0171.827] GetProcessHeap () returned 0xfd0000 [0171.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0171.827] GetProcessHeap () returned 0xfd0000 [0171.827] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0171.827] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1db61d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c1db61d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c1db61d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33042a24, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x33042a24, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x33042a24, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399c4fa7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x399c4fa7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x399c4fa7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0171.827] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64367fd2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x64367fd2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x64367fd2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dc802b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dc802b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dc802b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39893c6e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x39893c6e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x39893c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2782ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2782ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2782ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC Data Sources (32-bit).lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC Data Sources (64-bit).lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8822b6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8822b6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8822b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c66c10d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c66c10d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c66c10d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f116ee, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x32f116ee, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x32f116ee, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b498035, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b498035, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b498035, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34d51ec6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34d51ec6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34d51ec6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="")) returned 1 [0171.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dee28b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dee28b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dee28b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="")) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4e2f6c78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="")) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4e2f6c78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="")) returned 0 [0171.829] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0171.829] GetProcessHeap () returned 0xfd0000 [0171.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b0ade7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4b0ade7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x97a9db13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97a9db13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97a9db13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x92d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Immersive Control Panel.lnk", cAlternateFileName="")) returned 1 [0171.829] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0171.829] GetProcessHeap () returned 0xfd0000 [0171.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x830, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x842, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac326e8c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac326e8c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cf99e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac1cf99e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac1cf99e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.url", cAlternateFileName="GETHEL~1.URL")) returned 1 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac15d256, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.url", cAlternateFileName="VISITJ~1.URL")) returned 1 [0171.830] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac15d256, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.url", cAlternateFileName="VISITJ~1.URL")) returned 0 [0171.831] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0171.831] GetProcessHeap () returned 0xfd0000 [0171.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.831] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0171.831] GetProcessHeap () returned 0xfd0000 [0171.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0171.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0171.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0171.832] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0171.832] GetProcessHeap () returned 0xfd0000 [0171.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.832] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0171.832] GetProcessHeap () returned 0xfd0000 [0171.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0171.833] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.833] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 1 [0171.833] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c88562, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c88562, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c88562, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 1 [0171.833] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cfac8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cfac8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cfac8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 1 [0171.833] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x8eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Server 2016 Accounts.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0171.833] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0171.834] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 1 [0171.834] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 1 [0171.834] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 1 [0171.834] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0 [0171.834] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0171.835] GetProcessHeap () returned 0xfd0000 [0171.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef80377f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x96d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x567be970, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x567be970, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x567be970, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x897, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintDialog.lnk", cAlternateFileName="")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project 2016.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 1 [0171.835] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0171.836] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0171.836] GetProcessHeap () returned 0xfd0000 [0171.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.836] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.836] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc340447f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc340447f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xa4704c00, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xde00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cAlternateFileName="CUSERS~1.EXE")) returned 1 [0171.836] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.836] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0171.836] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0171.836] GetProcessHeap () returned 0xfd0000 [0171.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.836] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0171.836] GetProcessHeap () returned 0xfd0000 [0171.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.836] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.836] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c6d05b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34c6d05b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34c6d05b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Manager.lnk", cAlternateFileName="")) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender.lnk", cAlternateFileName="")) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender.lnk", cAlternateFileName="")) returned 0 [0171.837] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.837] GetProcessHeap () returned 0xfd0000 [0171.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0171.837] GetProcessHeap () returned 0xfd0000 [0171.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0171.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0171.837] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.837] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0171.837] GetProcessHeap () returned 0xfd0000 [0171.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0171.837] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea725d67, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea725d67, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea725d67, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows 10 Update Assistant.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0171.838] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e664927, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e664927, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e664927, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0171.838] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 1 [0171.838] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0171.838] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.838] GetProcessHeap () returned 0xfd0000 [0171.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.838] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0171.838] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0171.838] GetProcessHeap () returned 0xfd0000 [0171.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.839] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu Places", cAlternateFileName="STARTM~2")) returned 1 [0171.839] GetProcessHeap () returned 0xfd0000 [0171.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - File Explorer.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Documents.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Downloads.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Music.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - Pictures.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Videos.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Homegroup.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Network.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - UserProfile.lnk", cAlternateFileName="")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0171.841] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0171.841] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0171.841] GetProcessHeap () returned 0xfd0000 [0171.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.841] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe349c49, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xbe349c49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbe349c49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemData", cAlternateFileName="SYSTEM~1")) returned 1 [0171.841] GetProcessHeap () returned 0xfd0000 [0171.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\SystemData\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0171.841] GetProcessHeap () returned 0xfd0000 [0171.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.841] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0171.841] GetProcessHeap () returned 0xfd0000 [0171.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.842] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.842] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.842] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.842] GetProcessHeap () returned 0xfd0000 [0171.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.842] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0171.842] GetProcessHeap () returned 0xfd0000 [0171.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0171.842] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.842] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0171.843] GetProcessHeap () returned 0xfd0000 [0171.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0171.843] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.843] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d2e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.843] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0171.843] GetProcessHeap () returned 0xfd0000 [0171.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.843] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0171.844] GetProcessHeap () returned 0xfd0000 [0171.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0171.844] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.844] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.844] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0171.844] GetProcessHeap () returned 0xfd0000 [0171.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.844] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x56c668bc, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0171.844] GetProcessHeap () returned 0xfd0000 [0171.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0171.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xd3073804, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0171.844] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xd3073804, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.844] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xd3073804, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.844] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0171.845] GetProcessHeap () returned 0xfd0000 [0171.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0171.845] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x56c668bc, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0171.845] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0171.845] GetProcessHeap () returned 0xfd0000 [0171.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.845] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfp", cAlternateFileName="")) returned 1 [0171.845] GetProcessHeap () returned 0xfd0000 [0171.845] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0171.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\wfp\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x56c668bc, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x56c668bc, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0171.845] GetProcessHeap () returned 0xfd0000 [0171.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0171.845] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfp", cAlternateFileName="")) returned 0 [0171.845] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0171.845] GetProcessHeap () returned 0xfd0000 [0171.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0171.846] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0171.846] GetProcessHeap () returned 0xfd0000 [0171.846] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0171.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0171.848] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.848] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d5968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clean Store", cAlternateFileName="CLEANS~1")) returned 1 [0171.848] GetProcessHeap () returned 0xfd0000 [0171.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Clean Store\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.033] GetProcessHeap () returned 0xfd0000 [0172.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.033] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0172.034] GetProcessHeap () returned 0xfd0000 [0172.034] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.041] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.041] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0172.041] GetProcessHeap () returned 0xfd0000 [0172.041] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.042] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.042] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.042] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.042] GetProcessHeap () returned 0xfd0000 [0172.042] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.042] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0172.042] GetProcessHeap () returned 0xfd0000 [0172.042] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0172.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11d0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GapaEngine.dll", cAlternateFileName="")) returned 1 [0172.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26b66370, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22f6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsBase.vdm", cAlternateFileName="")) returned 1 [0172.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDlta.vdm", cAlternateFileName="")) returned 1 [0172.045] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b66370, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26b66370, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x563cd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAvBase.vdm", cAlternateFileName="")) returned 1 [0172.045] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15910, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAvDlta.vdm", cAlternateFileName="")) returned 1 [0172.045] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c4b1e3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc11740, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEngine.dll", cAlternateFileName="")) returned 1 [0172.045] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e318, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBase.vdm", cAlternateFileName="")) returned 1 [0172.045] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisFull.vdm", cAlternateFileName="")) returned 1 [0172.045] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisFull.vdm", cAlternateFileName="")) returned 0 [0172.045] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0172.046] GetProcessHeap () returned 0xfd0000 [0172.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.046] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0172.046] GetProcessHeap () returned 0xfd0000 [0172.046] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0172.070] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.070] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.070] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0172.070] GetProcessHeap () returned 0xfd0000 [0172.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.070] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0172.070] GetProcessHeap () returned 0xfd0000 [0172.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.071] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.071] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.071] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.071] GetProcessHeap () returned 0xfd0000 [0172.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.071] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 0 [0172.071] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.071] GetProcessHeap () returned 0xfd0000 [0172.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.071] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Features", cAlternateFileName="")) returned 1 [0172.071] GetProcessHeap () returned 0xfd0000 [0172.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Features\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.072] GetProcessHeap () returned 0xfd0000 [0172.072] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.072] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0172.072] GetProcessHeap () returned 0xfd0000 [0172.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.073] GetProcessHeap () returned 0xfd0000 [0172.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.073] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0172.073] GetProcessHeap () returned 0xfd0000 [0172.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Network Inspection System\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.073] GetProcessHeap () returned 0xfd0000 [0172.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.073] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Platform", cAlternateFileName="")) returned 1 [0172.074] GetProcessHeap () returned 0xfd0000 [0172.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.074] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.074] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.074] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.074] GetProcessHeap () returned 0xfd0000 [0172.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.074] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0172.074] GetProcessHeap () returned 0xfd0000 [0172.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.076] GetProcessHeap () returned 0xfd0000 [0172.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.076] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0172.076] GetProcessHeap () returned 0xfd0000 [0172.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.076] GetProcessHeap () returned 0xfd0000 [0172.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.076] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0172.076] GetProcessHeap () returned 0xfd0000 [0172.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.077] GetProcessHeap () returned 0xfd0000 [0172.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.077] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0172.077] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.077] GetProcessHeap () returned 0xfd0000 [0172.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.078] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0172.078] GetProcessHeap () returned 0xfd0000 [0172.078] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.079] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.079] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a9166d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0172.079] GetProcessHeap () returned 0xfd0000 [0172.079] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.080] GetProcessHeap () returned 0xfd0000 [0172.080] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.080] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0172.080] GetProcessHeap () returned 0xfd0000 [0172.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0172.081] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.081] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.081] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0172.081] GetProcessHeap () returned 0xfd0000 [0172.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.081] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0172.081] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.081] GetProcessHeap () returned 0xfd0000 [0172.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.081] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0172.081] GetProcessHeap () returned 0xfd0000 [0172.081] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Live\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0172.082] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.082] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 1 [0172.082] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 0 [0172.082] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0172.082] GetProcessHeap () returned 0xfd0000 [0172.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.082] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0172.082] GetProcessHeap () returned 0xfd0000 [0172.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.082] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.082] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0172.082] GetProcessHeap () returned 0xfd0000 [0172.083] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x10, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="咊\x97þ巠Ă}")) returned 0xffffffff [0172.083] GetProcessHeap () returned 0xfd0000 [0172.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.083] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0172.083] GetProcessHeap () returned 0xfd0000 [0172.083] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.088] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.088] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0172.088] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0172.088] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.089] GetProcessHeap () returned 0xfd0000 [0172.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.089] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0172.089] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.089] GetProcessHeap () returned 0xfd0000 [0172.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.089] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0172.089] GetProcessHeap () returned 0xfd0000 [0172.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Security Health\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="咊\x97þ巠Ă~")) returned 0xffffffff [0172.089] GetProcessHeap () returned 0xfd0000 [0172.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.089] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0172.089] GetProcessHeap () returned 0xfd0000 [0172.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0172.090] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.090] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0172.090] GetProcessHeap () returned 0xfd0000 [0172.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0172.091] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.091] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.091] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0172.091] GetProcessHeap () returned 0xfd0000 [0172.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.091] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0172.091] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0172.092] GetProcessHeap () returned 0xfd0000 [0172.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.092] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0172.092] GetProcessHeap () returned 0xfd0000 [0172.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0172.093] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.093] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1 [0172.093] GetProcessHeap () returned 0xfd0000 [0172.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0172.093] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.093] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.093] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0172.093] GetProcessHeap () returned 0xfd0000 [0172.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.093] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0172.094] GetProcessHeap () returned 0xfd0000 [0172.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0172.094] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.094] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.094] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0172.094] GetProcessHeap () returned 0xfd0000 [0172.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.095] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0172.095] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0172.095] GetProcessHeap () returned 0xfd0000 [0172.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.095] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0172.095] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0172.095] GetProcessHeap () returned 0xfd0000 [0172.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.096] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0172.096] GetProcessHeap () returned 0xfd0000 [0172.096] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft OneDrive\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0172.097] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.097] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0172.097] GetProcessHeap () returned 0xfd0000 [0172.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0172.098] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.098] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0172.098] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0172.098] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0172.098] GetProcessHeap () returned 0xfd0000 [0172.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.098] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0172.098] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.098] GetProcessHeap () returned 0xfd0000 [0172.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.099] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Oracle", cAlternateFileName="")) returned 1 [0172.099] GetProcessHeap () returned 0xfd0000 [0172.099] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.102] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.103] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0172.103] GetProcessHeap () returned 0xfd0000 [0172.103] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\Java\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.264] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.264] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0172.264] GetProcessHeap () returned 0xfd0000 [0172.264] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0172.265] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.265] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1 [0172.265] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 0 [0172.265] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.265] GetProcessHeap () returned 0xfd0000 [0172.265] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.265] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0172.265] GetProcessHeap () returned 0xfd0000 [0172.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.266] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.266] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0172.266] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0 [0172.266] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.266] GetProcessHeap () returned 0xfd0000 [0172.266] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.266] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1 [0172.266] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0172.266] GetProcessHeap () returned 0xfd0000 [0172.267] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.267] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.267] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0172.267] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0172.267] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0172.267] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0172.267] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.267] GetProcessHeap () returned 0xfd0000 [0172.267] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.267] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0172.268] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.268] GetProcessHeap () returned 0xfd0000 [0172.268] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.268] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0172.268] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.268] GetProcessHeap () returned 0xfd0000 [0172.268] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.269] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0172.269] GetProcessHeap () returned 0xfd0000 [0172.269] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0172.271] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.271] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0172.271] GetProcessHeap () returned 0xfd0000 [0172.271] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.273] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.273] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.273] GetProcessHeap () returned 0xfd0000 [0172.273] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0172.274] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.274] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0172.275] GetProcessHeap () returned 0xfd0000 [0172.275] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.275] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.275] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.275] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.275] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.275] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.276] GetProcessHeap () returned 0xfd0000 [0172.276] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.276] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0172.276] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.276] GetProcessHeap () returned 0xfd0000 [0172.276] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.276] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.276] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.276] GetProcessHeap () returned 0xfd0000 [0172.276] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.277] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0172.277] GetProcessHeap () returned 0xfd0000 [0172.277] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.278] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.278] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0172.278] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0172.278] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0172.278] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.278] GetProcessHeap () returned 0xfd0000 [0172.278] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.278] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0172.281] GetProcessHeap () returned 0xfd0000 [0172.281] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0172.282] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.282] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.282] GetProcessHeap () returned 0xfd0000 [0172.282] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0172.283] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.283] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0172.283] GetProcessHeap () returned 0xfd0000 [0172.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0172.284] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.284] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.284] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.284] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.284] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0172.284] GetProcessHeap () returned 0xfd0000 [0172.284] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.284] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0172.284] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0172.284] GetProcessHeap () returned 0xfd0000 [0172.284] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.284] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.285] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0172.285] GetProcessHeap () returned 0xfd0000 [0172.285] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.286] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0172.286] GetProcessHeap () returned 0xfd0000 [0172.286] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0172.287] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.287] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0172.287] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0172.287] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0172.287] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.287] GetProcessHeap () returned 0xfd0000 [0172.287] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.287] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0172.287] GetProcessHeap () returned 0xfd0000 [0172.287] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.288] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.288] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.288] GetProcessHeap () returned 0xfd0000 [0172.288] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.289] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.289] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0172.289] GetProcessHeap () returned 0xfd0000 [0172.289] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.290] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.290] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.290] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.290] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.290] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.290] GetProcessHeap () returned 0xfd0000 [0172.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.290] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0172.290] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.290] GetProcessHeap () returned 0xfd0000 [0172.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.290] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.290] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.290] GetProcessHeap () returned 0xfd0000 [0172.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.291] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0172.291] GetProcessHeap () returned 0xfd0000 [0172.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.292] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.292] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.293] GetProcessHeap () returned 0xfd0000 [0172.293] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.293] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.293] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0172.293] GetProcessHeap () returned 0xfd0000 [0172.293] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0172.294] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.294] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.294] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.294] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.294] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0172.294] GetProcessHeap () returned 0xfd0000 [0172.294] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.294] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0172.294] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.295] GetProcessHeap () returned 0xfd0000 [0172.295] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.295] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.295] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.295] GetProcessHeap () returned 0xfd0000 [0172.295] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.296] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0172.296] GetProcessHeap () returned 0xfd0000 [0172.296] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.297] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.297] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.297] GetProcessHeap () returned 0xfd0000 [0172.297] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0172.298] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.298] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0172.298] GetProcessHeap () returned 0xfd0000 [0172.298] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.299] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.299] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.299] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.299] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.299] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.299] GetProcessHeap () returned 0xfd0000 [0172.299] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.299] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0172.299] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0172.299] GetProcessHeap () returned 0xfd0000 [0172.299] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.299] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.300] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.300] GetProcessHeap () returned 0xfd0000 [0172.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.310] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0172.310] GetProcessHeap () returned 0xfd0000 [0172.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.311] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.311] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.311] GetProcessHeap () returned 0xfd0000 [0172.312] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0172.312] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.312] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0172.312] GetProcessHeap () returned 0xfd0000 [0172.312] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.313] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.313] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.313] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.313] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.313] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.313] GetProcessHeap () returned 0xfd0000 [0172.313] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.313] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0172.313] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0172.313] GetProcessHeap () returned 0xfd0000 [0172.313] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.314] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.428] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.428] GetProcessHeap () returned 0xfd0000 [0172.428] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.429] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0172.429] GetProcessHeap () returned 0xfd0000 [0172.429] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0172.661] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.661] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.661] GetProcessHeap () returned 0xfd0000 [0172.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0172.662] GetProcessHeap () returned 0xfd0000 [0172.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0172.662] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.662] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.662] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.663] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.663] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0172.663] GetProcessHeap () returned 0xfd0000 [0172.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.663] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0172.663] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.663] GetProcessHeap () returned 0xfd0000 [0172.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.663] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.663] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0172.663] GetProcessHeap () returned 0xfd0000 [0172.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.664] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0172.664] GetProcessHeap () returned 0xfd0000 [0172.664] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0172.665] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.665] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.665] GetProcessHeap () returned 0xfd0000 [0172.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.666] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.666] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0172.666] GetProcessHeap () returned 0xfd0000 [0172.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.667] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.668] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.668] GetProcessHeap () returned 0xfd0000 [0172.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0172.668] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.668] GetProcessHeap () returned 0xfd0000 [0172.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.668] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.668] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0172.668] GetProcessHeap () returned 0xfd0000 [0172.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.672] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0172.672] GetProcessHeap () returned 0xfd0000 [0172.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.673] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.673] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.673] GetProcessHeap () returned 0xfd0000 [0172.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.674] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.674] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0172.674] GetProcessHeap () returned 0xfd0000 [0172.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.675] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.675] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.675] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.675] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.675] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.675] GetProcessHeap () returned 0xfd0000 [0172.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.675] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0172.675] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.675] GetProcessHeap () returned 0xfd0000 [0172.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.675] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.675] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.675] GetProcessHeap () returned 0xfd0000 [0172.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.676] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0172.676] GetProcessHeap () returned 0xfd0000 [0172.676] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0172.677] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.677] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0172.677] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0172.677] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0172.677] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0172.677] GetProcessHeap () returned 0xfd0000 [0172.677] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.677] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0172.677] GetProcessHeap () returned 0xfd0000 [0172.677] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0172.678] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.678] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.678] GetProcessHeap () returned 0xfd0000 [0172.678] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0172.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.679] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0172.679] GetProcessHeap () returned 0xfd0000 [0172.679] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0172.680] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.680] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.680] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.680] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.680] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0172.680] GetProcessHeap () returned 0xfd0000 [0172.681] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.681] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0172.681] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0172.681] GetProcessHeap () returned 0xfd0000 [0172.681] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.681] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.681] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0172.681] GetProcessHeap () returned 0xfd0000 [0172.681] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.682] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0172.682] GetProcessHeap () returned 0xfd0000 [0172.682] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.683] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.683] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.683] GetProcessHeap () returned 0xfd0000 [0172.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0172.683] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.684] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0172.684] GetProcessHeap () returned 0xfd0000 [0172.684] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.684] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.684] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.684] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.684] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.685] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.685] GetProcessHeap () returned 0xfd0000 [0172.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.685] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0172.685] FindClose (in: hFindFile=0x10b7b40 | out: hFindFile=0x10b7b40) returned 1 [0172.685] GetProcessHeap () returned 0xfd0000 [0172.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.685] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.685] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.685] GetProcessHeap () returned 0xfd0000 [0172.685] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.685] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0172.685] GetProcessHeap () returned 0xfd0000 [0172.685] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0172.685] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.685] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0172.686] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0172.686] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0172.686] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0172.690] GetProcessHeap () returned 0xfd0000 [0172.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.691] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0172.691] GetProcessHeap () returned 0xfd0000 [0172.691] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.691] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.691] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0172.692] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0172.692] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0172.692] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.692] GetProcessHeap () returned 0xfd0000 [0172.692] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.692] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0172.692] GetProcessHeap () returned 0xfd0000 [0172.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.693] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0172.693] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.693] GetProcessHeap () returned 0xfd0000 [0172.693] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0172.693] GetProcessHeap () returned 0xfd0000 [0172.693] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.693] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0172.694] GetProcessHeap () returned 0xfd0000 [0172.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0172.694] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.694] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0172.694] GetProcessHeap () returned 0xfd0000 [0172.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0172.695] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.695] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0172.695] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0172.695] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0172.695] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0172.695] GetProcessHeap () returned 0xfd0000 [0172.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.695] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0172.695] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0172.695] GetProcessHeap () returned 0xfd0000 [0172.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.695] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0172.695] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0172.695] GetProcessHeap () returned 0xfd0000 [0172.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.696] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0172.696] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0172.696] GetProcessHeap () returned 0xfd0000 [0172.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.697] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0172.697] GetProcessHeap () returned 0xfd0000 [0172.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0172.706] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.706] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0172.706] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0172.706] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1 [0172.706] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0172.706] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0172.706] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0172.707] GetProcessHeap () returned 0xfd0000 [0172.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.707] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0172.707] GetProcessHeap () returned 0xfd0000 [0172.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\SoftwareDistribution\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0172.708] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.708] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.708] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0172.708] GetProcessHeap () returned 0xfd0000 [0172.708] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.708] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0172.708] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0172.708] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0172.708] GetProcessHeap () returned 0xfd0000 [0172.708] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\USOPrivate\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="咊\x97þ巠Ă\x7f")) returned 0xffffffff [0172.708] GetProcessHeap () returned 0xfd0000 [0172.708] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.708] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0172.708] GetProcessHeap () returned 0xfd0000 [0172.708] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\USOShared\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0172.709] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.709] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcffda611, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcffda611, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0172.709] GetProcessHeap () returned 0xfd0000 [0172.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\USOShared\\Logs\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcffda611, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcffda611, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.711] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcffda611, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcffda611, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.828] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1 [0172.828] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1 [0172.828] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.001.etl", cAlternateFileName="NO604C~1.ETL")) returned 1 [0172.829] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.002.etl", cAlternateFileName="NO8BA4~1.ETL")) returned 1 [0172.829] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.003.etl", cAlternateFileName="NO3670~1.ETL")) returned 1 [0172.829] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.004.etl", cAlternateFileName="NO2FB3~1.ETL")) returned 1 [0172.838] GetProcessHeap () returned 0xfd0000 [0172.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.838] GetProcessHeap () returned 0xfd0000 [0172.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.839] GetProcessHeap () returned 0xfd0000 [0172.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\WindowsHolographicDevices\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0172.839] GetProcessHeap () returned 0xfd0000 [0172.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\WindowsHolographicDevices\\SpatialStore\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0172.839] GetProcessHeap () returned 0xfd0000 [0172.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0172.840] GetProcessHeap () returned 0xfd0000 [0172.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0172.840] GetProcessHeap () returned 0xfd0000 [0172.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0172.841] GetProcessHeap () returned 0xfd0000 [0172.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0172.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="WindowsHolographicDevices", cAlternateFileName="咊\x97þ巠Ă\x80")) returned 0xffffffff [0172.844] GetProcessHeap () returned 0xfd0000 [0172.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0172.844] GetProcessHeap () returned 0xfd0000 [0172.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0172.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="WindowsHolographicDevices", cAlternateFileName="咊\x97þ巠Ă\x80")) returned 0xffffffff [0172.844] GetProcessHeap () returned 0xfd0000 [0172.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0172.844] GetProcessHeap () returned 0xfd0000 [0172.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x1045df0 [0172.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName=".", cAlternateFileName="")) returned 0x10b7b40 [0172.845] GetProcessHeap () returned 0xfd0000 [0172.845] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0172.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0172.846] GetProcessHeap () returned 0xfd0000 [0172.846] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0172.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0172.847] GetProcessHeap () returned 0xfd0000 [0172.847] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0172.847] GetProcessHeap () returned 0xfd0000 [0172.847] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3af063e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.848] GetProcessHeap () returned 0xfd0000 [0172.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0172.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa27e7c13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa27e7c13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.849] GetProcessHeap () returned 0xfd0000 [0172.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc49d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xc3b53c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fc49d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0172.851] GetProcessHeap () returned 0xfd0000 [0172.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.851] GetProcessHeap () returned 0xfd0000 [0172.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0172.851] GetProcessHeap () returned 0xfd0000 [0172.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0172.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0172.852] GetProcessHeap () returned 0xfd0000 [0172.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\CloudStore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55059, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0172.852] GetProcessHeap () returned 0xfd0000 [0172.852] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.852] GetProcessHeap () returned 0xfd0000 [0172.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b55a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0172.853] GetProcessHeap () returned 0xfd0000 [0172.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.853] GetProcessHeap () returned 0xfd0000 [0172.853] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b5650c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.853] GetProcessHeap () returned 0xfd0000 [0172.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.853] GetProcessHeap () returned 0xfd0000 [0172.853] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b56b05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.854] GetProcessHeap () returned 0xfd0000 [0172.854] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.854] GetProcessHeap () returned 0xfd0000 [0172.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b570a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0172.855] GetProcessHeap () returned 0xfd0000 [0172.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.855] GetProcessHeap () returned 0xfd0000 [0172.855] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3b57759, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.855] GetProcessHeap () returned 0xfd0000 [0172.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.855] GetProcessHeap () returned 0xfd0000 [0172.855] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.856] GetProcessHeap () returned 0xfd0000 [0172.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0172.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3bc20b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0172.857] GetProcessHeap () returned 0xfd0000 [0172.857] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0172.857] GetProcessHeap () returned 0xfd0000 [0172.857] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0172.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c33bd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0172.860] GetProcessHeap () returned 0xfd0000 [0172.860] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0172.860] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 1 [0172.860] GetProcessHeap () returned 0xfd0000 [0172.860] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0172.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0172.861] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.861] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda244, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61dda244, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61dda244, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e, dwReserved0=0x0, dwReserved1=0x0, cFileName="04-1 - NetworkStatus.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - SystemAbout.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - PowerAndSleep.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 1 [0172.862] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62a, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - AppsAndFeatures.lnk", cAlternateFileName="")) returned 1 [0172.863] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.863] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.863] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.864] GetProcessHeap () returned 0xfd0000 [0172.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0172.864] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c88c0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 0 [0172.864] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.864] GetProcessHeap () returned 0xfd0000 [0172.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.864] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3b58244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 0 [0172.864] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0172.864] GetProcessHeap () returned 0xfd0000 [0172.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0172.865] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0172.865] GetProcessHeap () returned 0xfd0000 [0172.865] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0172.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.866] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c89cf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9e2bf1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.867] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0172.867] GetProcessHeap () returned 0xfd0000 [0172.867] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0172.867] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.867] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8a984, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.867] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0172.867] GetProcessHeap () returned 0xfd0000 [0172.867] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.867] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0172.867] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 0 [0172.867] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.867] GetProcessHeap () returned 0xfd0000 [0172.867] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0172.867] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 1 [0172.867] GetProcessHeap () returned 0xfd0000 [0172.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0172.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\WindowsApps\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.868] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.868] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.868] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.868] GetProcessHeap () returned 0xfd0000 [0172.868] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0172.868] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8af60, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WINDOW~2")) returned 0 [0172.868] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.868] GetProcessHeap () returned 0xfd0000 [0172.868] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.868] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0172.868] GetProcessHeap () returned 0xfd0000 [0172.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0172.868] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.869] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8b6f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0172.869] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0172.869] GetProcessHeap () returned 0xfd0000 [0172.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0172.869] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0172.869] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0172.869] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0172.869] GetProcessHeap () returned 0xfd0000 [0172.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0172.870] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0172.870] GetProcessHeap () returned 0xfd0000 [0172.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0172.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0172.871] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.871] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0172.871] GetProcessHeap () returned 0xfd0000 [0172.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0172.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0172.872] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.872] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0172.872] GetProcessHeap () returned 0xfd0000 [0172.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0172.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0172.873] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3c8d333, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.873] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0172.873] GetProcessHeap () returned 0xfd0000 [0172.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0172.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0172.873] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.873] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.873] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67afb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d67afb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 1 [0172.873] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 1 [0172.874] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 0 [0172.874] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0172.874] GetProcessHeap () returned 0xfd0000 [0172.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0172.874] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ce02fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0172.874] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0172.874] GetProcessHeap () returned 0xfd0000 [0172.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0172.874] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0172.874] GetProcessHeap () returned 0xfd0000 [0172.874] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0172.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0173.026] GetProcessHeap () returned 0xfd0000 [0173.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.027] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cm", cAlternateFileName="")) returned 1 [0173.027] GetProcessHeap () returned 0xfd0000 [0173.027] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0173.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0173.028] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.028] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.028] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0173.028] GetProcessHeap () returned 0xfd0000 [0173.028] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0173.028] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddencm", cAlternateFileName="_HIDDE~1")) returned 1 [0173.028] GetProcessHeap () returned 0xfd0000 [0173.028] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0173.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0173.028] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.029] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.029] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0173.029] GetProcessHeap () returned 0xfd0000 [0173.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0173.029] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddencm", cAlternateFileName="_HIDDE~1")) returned 0 [0173.029] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.029] GetProcessHeap () returned 0xfd0000 [0173.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.029] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2bc7808, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0173.029] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0173.029] GetProcessHeap () returned 0xfd0000 [0173.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.030] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0173.030] GetProcessHeap () returned 0xfd0000 [0173.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0173.039] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.039] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CloudStore", cAlternateFileName="CLOUDS~1")) returned 1 [0173.040] GetProcessHeap () returned 0xfd0000 [0173.040] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0173.040] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.040] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5adeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.040] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0173.040] GetProcessHeap () returned 0xfd0000 [0173.040] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.040] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0173.040] GetProcessHeap () returned 0xfd0000 [0173.040] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0173.040] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.040] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b2cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.041] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0173.041] GetProcessHeap () returned 0xfd0000 [0173.041] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.041] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0173.041] GetProcessHeap () returned 0xfd0000 [0173.041] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.041] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.041] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3d5b98f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.041] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.041] GetProcessHeap () returned 0xfd0000 [0173.041] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.041] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0173.041] GetProcessHeap () returned 0xfd0000 [0173.041] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.048] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.048] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db82df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.048] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0173.048] GetProcessHeap () returned 0xfd0000 [0173.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.048] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0173.048] GetProcessHeap () returned 0xfd0000 [0173.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x24d775e4, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x24d775e4, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 1 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0173.060] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x70adb4e3, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0173.060] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0173.061] GetProcessHeap () returned 0xfd0000 [0173.061] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.061] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0173.061] GetProcessHeap () returned 0xfd0000 [0173.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.062] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3db9a99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.062] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0173.062] GetProcessHeap () returned 0xfd0000 [0173.062] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0173.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.178] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.178] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e055fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0173.178] GetProcessHeap () returned 0xfd0000 [0173.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e055fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0173.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e055fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0173.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0173.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0173.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4382ea4e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4382ea4e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 1 [0173.179] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4382ea4e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4382ea4e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 0 [0173.179] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0173.179] GetProcessHeap () returned 0xfd0000 [0173.180] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.180] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0173.180] GetProcessHeap () returned 0xfd0000 [0173.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0173.180] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e05ef6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.180] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9e2bf1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f90064, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0173.180] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543ef5f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6543ef5f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0173.180] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543ef5f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6543ef5f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0173.180] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0173.180] GetProcessHeap () returned 0xfd0000 [0173.180] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.180] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0173.180] GetProcessHeap () returned 0xfd0000 [0173.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0173.181] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3e068f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.181] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0173.181] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0173.181] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0173.181] GetProcessHeap () returned 0xfd0000 [0173.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.181] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0173.181] GetProcessHeap () returned 0xfd0000 [0173.181] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0173.181] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.181] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b27991, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc3e074f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70b27991, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.181] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0173.181] GetProcessHeap () returned 0xfd0000 [0173.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.181] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0173.182] GetProcessHeap () returned 0xfd0000 [0173.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0173.187] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3eac6fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.187] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c063ed7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c063ed7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk", cAlternateFileName="")) returned 1 [0173.187] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dd66, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61d8dd66, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0173.187] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="")) returned 1 [0173.187] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0173.188] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="File Explorer.lnk", cAlternateFileName="")) returned 1 [0173.188] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0173.188] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61db3fcd, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x61db3fcd, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0173.188] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0173.189] GetProcessHeap () returned 0xfd0000 [0173.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.189] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0173.189] GetProcessHeap () returned 0xfd0000 [0173.189] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7900 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96df2ecc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96df2ecc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="")) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="")) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0173.191] FindNextFileW (in: hFindFile=0x10b7900, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0173.191] FindClose (in: hFindFile=0x10b7900 | out: hFindFile=0x10b7900) returned 1 [0173.192] GetProcessHeap () returned 0xfd0000 [0173.192] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.192] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef6e5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0173.192] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.192] GetProcessHeap () returned 0xfd0000 [0173.192] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0173.192] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3e04402, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0173.193] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0173.193] GetProcessHeap () returned 0xfd0000 [0173.193] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.194] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0173.194] GetProcessHeap () returned 0xfd0000 [0173.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.194] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.194] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.195] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0173.195] GetProcessHeap () returned 0xfd0000 [0173.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.195] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3ef80b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0173.195] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0173.195] GetProcessHeap () returned 0xfd0000 [0173.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.195] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2c416743, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c416743, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0173.195] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0173.195] GetProcessHeap () returned 0xfd0000 [0173.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa2bc7808, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa2bc7808, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0173.196] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0173.196] GetProcessHeap () returned 0xfd0000 [0173.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3c8c01f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0173.196] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.196] GetProcessHeap () returned 0xfd0000 [0173.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0173.196] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0173.196] GetProcessHeap () returned 0xfd0000 [0173.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0173.197] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.197] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.197] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0173.197] GetProcessHeap () returned 0xfd0000 [0173.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.197] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0173.197] GetProcessHeap () returned 0xfd0000 [0173.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0173.341] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.341] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0173.341] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0173.341] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0173.341] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0173.341] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0173.342] GetProcessHeap () returned 0xfd0000 [0173.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.342] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0173.342] GetProcessHeap () returned 0xfd0000 [0173.342] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0173.342] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.342] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.342] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0173.342] GetProcessHeap () returned 0xfd0000 [0173.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.342] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0173.343] GetProcessHeap () returned 0xfd0000 [0173.343] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.343] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.343] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.343] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0173.343] GetProcessHeap () returned 0xfd0000 [0173.343] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.344] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0173.344] GetProcessHeap () returned 0xfd0000 [0173.344] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Links\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0173.344] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.344] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.344] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0173.344] GetProcessHeap () returned 0xfd0000 [0173.344] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.345] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0173.345] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0173.345] GetProcessHeap () returned 0xfd0000 [0173.345] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Music\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.346] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.346] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0173.346] GetProcessHeap () returned 0xfd0000 [0173.346] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x19fa8eb, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x19fa8eb, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0173.346] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0173.347] GetProcessHeap () returned 0xfd0000 [0173.347] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0173.347] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.347] FindClose (in: hFindFile=0x10b7c80 | out: hFindFile=0x10b7c80) returned 1 [0173.347] GetProcessHeap () returned 0xfd0000 [0173.347] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0173.348] GetProcessHeap () returned 0xfd0000 [0173.348] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.348] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.348] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.348] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.348] GetProcessHeap () returned 0xfd0000 [0173.348] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.348] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0173.348] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0173.348] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0173.348] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0173.349] GetProcessHeap () returned 0xfd0000 [0173.349] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0173.349] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.349] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.349] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0173.349] GetProcessHeap () returned 0xfd0000 [0173.349] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.349] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0173.349] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0173.349] GetProcessHeap () returned 0xfd0000 [0173.349] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0173.351] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0173.351] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0173.351] GetProcessHeap () returned 0xfd0000 [0173.351] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0173.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0173.353] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.353] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0173.353] GetProcessHeap () returned 0xfd0000 [0173.353] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.354] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.354] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0173.354] GetProcessHeap () returned 0xfd0000 [0173.354] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0173.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0173.355] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.355] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0173.355] GetProcessHeap () returned 0xfd0000 [0173.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0173.355] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.355] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0173.356] GetProcessHeap () returned 0xfd0000 [0173.356] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.358] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.358] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0173.358] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0173.358] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0173.359] GetProcessHeap () returned 0xfd0000 [0173.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.359] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0173.359] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0173.359] GetProcessHeap () returned 0xfd0000 [0173.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.359] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0173.359] FindClose (in: hFindFile=0x10b7840 | out: hFindFile=0x10b7840) returned 1 [0173.359] GetProcessHeap () returned 0xfd0000 [0173.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0173.361] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0173.361] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0173.361] GetProcessHeap () returned 0xfd0000 [0173.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.361] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0173.361] GetProcessHeap () returned 0xfd0000 [0173.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.363] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0173.364] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.365] GetProcessHeap () returned 0xfd0000 [0173.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0173.365] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0173.365] FindClose (in: hFindFile=0x10b7dc0 | out: hFindFile=0x10b7dc0) returned 1 [0173.365] GetProcessHeap () returned 0xfd0000 [0173.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0173.365] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0173.366] FindNextFileW (in: hFindFile=0x10b7b40, lpFindFileData=0x349f568 | out: lpFindFileData=0x349f568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x714, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0173.366] GetProcessHeap () returned 0xfd0000 [0173.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x10a7708 [0173.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\*", lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7dc0 [0173.366] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.366] FindNextFileW (in: hFindFile=0x10b7dc0, lpFindFileData=0x349f2e0 | out: lpFindFileData=0x349f2e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0173.366] GetProcessHeap () returned 0xfd0000 [0173.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f20048 [0173.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7840 [0173.367] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.367] FindNextFileW (in: hFindFile=0x10b7840, lpFindFileData=0x349f058 | out: lpFindFileData=0x349f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc05c0a4f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc05c0a4f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0173.367] GetProcessHeap () returned 0xfd0000 [0173.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3ff28c0 [0173.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc05c0a4f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc05c0a4f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c80 [0173.368] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc05c0a4f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc05c0a4f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.368] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0173.368] GetProcessHeap () returned 0xfd0000 [0173.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0173.369] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.369] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.369] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0173.369] GetProcessHeap () returned 0xfd0000 [0173.369] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.369] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0173.369] GetProcessHeap () returned 0xfd0000 [0173.369] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.370] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.370] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0173.370] GetProcessHeap () returned 0xfd0000 [0173.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.371] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.371] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 1 [0173.371] GetProcessHeap () returned 0xfd0000 [0173.371] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0173.373] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.373] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt15.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0173.374] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x24c57, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt15.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0173.374] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0173.374] GetProcessHeap () returned 0xfd0000 [0173.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0173.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.375] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.375] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x255e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt15.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0173.375] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x255e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt15.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0173.375] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.375] GetProcessHeap () returned 0xfd0000 [0173.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0173.375] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7e48a8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7e48a8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x63727ff2, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCacheRdr.dat", cAlternateFileName="ICONCA~1.DAT")) returned 1 [0173.375] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8995a87, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8995a87, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8995a87, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1aaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCacheRdr65536.dat", cAlternateFileName="ICONCA~2.DAT")) returned 1 [0173.375] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76642b27, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76642b27, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe8aecfcb, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0173.375] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolsSearchCacheRdr", cAlternateFileName="TOOLSS~1")) returned 1 [0173.375] GetProcessHeap () returned 0xfd0000 [0173.375] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0173.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.375] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.376] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.376] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0173.376] GetProcessHeap () returned 0xfd0000 [0173.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0173.376] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0173.376] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0173.376] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0173.376] GetProcessHeap () returned 0xfd0000 [0173.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.376] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0173.376] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0173.376] GetProcessHeap () returned 0xfd0000 [0173.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.551] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroCef", cAlternateFileName="")) returned 1 [0173.551] GetProcessHeap () returned 0xfd0000 [0173.551] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0173.559] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.559] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 1 [0173.559] GetProcessHeap () returned 0xfd0000 [0173.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.560] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.560] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0173.560] GetProcessHeap () returned 0xfd0000 [0173.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0173.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6a51047, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.560] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd6a51047, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.560] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd780dd5d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0173.560] GetProcessHeap () returned 0xfd0000 [0173.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd781529a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd781529a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd781529a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78179b2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78179b2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8c1e26a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1", cAlternateFileName="")) returned 1 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78215d4, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78215d4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd78215d4, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2", cAlternateFileName="")) returned 1 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7823d0a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd7823d0a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3", cAlternateFileName="")) returned 1 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1 [0173.563] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 0 [0173.563] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0173.563] GetProcessHeap () returned 0xfd0000 [0173.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.563] GetProcessHeap () returned 0xfd0000 [0173.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0173.564] GetProcessHeap () returned 0xfd0000 [0173.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.564] GetProcessHeap () returned 0xfd0000 [0173.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0173.564] GetProcessHeap () returned 0xfd0000 [0173.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.566] GetProcessHeap () returned 0xfd0000 [0173.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.567] GetProcessHeap () returned 0xfd0000 [0173.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0173.567] GetProcessHeap () returned 0xfd0000 [0173.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0173.574] GetProcessHeap () returned 0xfd0000 [0173.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.574] GetProcessHeap () returned 0xfd0000 [0173.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.575] GetProcessHeap () returned 0xfd0000 [0173.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.575] GetProcessHeap () returned 0xfd0000 [0173.575] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0173.585] GetProcessHeap () returned 0xfd0000 [0173.585] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0173.587] GetProcessHeap () returned 0xfd0000 [0173.587] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\Dictionaries\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.588] GetProcessHeap () returned 0xfd0000 [0173.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.588] GetProcessHeap () returned 0xfd0000 [0173.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.588] GetProcessHeap () returned 0xfd0000 [0173.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.589] GetProcessHeap () returned 0xfd0000 [0173.589] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.599] GetProcessHeap () returned 0xfd0000 [0173.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Temp\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0173.603] GetProcessHeap () returned 0xfd0000 [0173.603] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.603] GetProcessHeap () returned 0xfd0000 [0173.603] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.603] GetProcessHeap () returned 0xfd0000 [0173.603] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0173.604] GetProcessHeap () returned 0xfd0000 [0173.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0173.606] GetProcessHeap () returned 0xfd0000 [0173.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.606] GetProcessHeap () returned 0xfd0000 [0173.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x1a672446, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.616] GetProcessHeap () returned 0xfd0000 [0173.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0173.616] GetProcessHeap () returned 0xfd0000 [0173.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.616] GetProcessHeap () returned 0xfd0000 [0173.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0173.616] GetProcessHeap () returned 0xfd0000 [0173.616] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0173.616] GetProcessHeap () returned 0xfd0000 [0173.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0173.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0173.617] GetProcessHeap () returned 0xfd0000 [0173.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0173.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0173.619] GetProcessHeap () returned 0xfd0000 [0173.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0173.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0173.620] GetProcessHeap () returned 0xfd0000 [0173.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0173.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0173.621] GetProcessHeap () returned 0xfd0000 [0173.621] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0173.621] GetProcessHeap () returned 0xfd0000 [0173.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0173.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0173.621] GetProcessHeap () returned 0xfd0000 [0173.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0173.623] GetProcessHeap () returned 0xfd0000 [0173.623] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.623] GetProcessHeap () returned 0xfd0000 [0173.623] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0173.623] GetProcessHeap () returned 0xfd0000 [0173.623] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0173.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c2e339, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa82ac98, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa82ac98, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0173.628] GetProcessHeap () returned 0xfd0000 [0173.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5172d381, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5172d381, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x517321bc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.628] GetProcessHeap () returned 0xfd0000 [0173.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.628] GetProcessHeap () returned 0xfd0000 [0173.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5179d880, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe76dafa5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe76dafa5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0173.817] GetProcessHeap () returned 0xfd0000 [0173.817] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.817] GetProcessHeap () returned 0xfd0000 [0173.817] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52964a42, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe8bc8e63, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bc8e63, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.820] GetProcessHeap () returned 0xfd0000 [0173.820] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.820] GetProcessHeap () returned 0xfd0000 [0173.820] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b52d0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeb6ec148, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb6ec148, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0173.822] GetProcessHeap () returned 0xfd0000 [0173.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0173.822] GetProcessHeap () returned 0xfd0000 [0173.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0173.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9458ec6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9458ec6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0173.824] GetProcessHeap () returned 0xfd0000 [0173.824] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0173.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5574507e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5574507e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5574507e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0173.825] GetProcessHeap () returned 0xfd0000 [0173.825] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0173.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551a1ac1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4a5bd1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0173.827] GetProcessHeap () returned 0xfd0000 [0173.827] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0173.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551c64bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a0b75, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a0b75, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0173.829] GetProcessHeap () returned 0xfd0000 [0173.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551cd9ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551d0100, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551d0100, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.829] GetProcessHeap () returned 0xfd0000 [0173.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.830] GetProcessHeap () returned 0xfd0000 [0173.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551dc455, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551deb68, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551deb68, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.830] GetProcessHeap () returned 0xfd0000 [0173.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.830] GetProcessHeap () returned 0xfd0000 [0173.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551eaeb6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551efcd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551efcd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.831] GetProcessHeap () returned 0xfd0000 [0173.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.831] GetProcessHeap () returned 0xfd0000 [0173.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551f991d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x551fe740, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x551fe740, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.831] GetProcessHeap () returned 0xfd0000 [0173.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.832] GetProcessHeap () returned 0xfd0000 [0173.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5520aa75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5520f8cf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5520f8cf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0173.832] GetProcessHeap () returned 0xfd0000 [0173.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.832] GetProcessHeap () returned 0xfd0000 [0173.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5521bc05, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5521e318, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5521e318, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.833] GetProcessHeap () returned 0xfd0000 [0173.833] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.833] GetProcessHeap () returned 0xfd0000 [0173.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5522cd72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55231ba1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55231ba1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0173.833] GetProcessHeap () returned 0xfd0000 [0173.833] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.833] GetProcessHeap () returned 0xfd0000 [0173.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5523b7c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55240602, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55240602, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0173.834] GetProcessHeap () returned 0xfd0000 [0173.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.834] GetProcessHeap () returned 0xfd0000 [0173.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5524a244, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5524f067, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5524f067, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.834] GetProcessHeap () returned 0xfd0000 [0173.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.834] GetProcessHeap () returned 0xfd0000 [0173.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5525b3bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5525dacb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5525dacb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.835] GetProcessHeap () returned 0xfd0000 [0173.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.835] GetProcessHeap () returned 0xfd0000 [0173.835] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5526c52f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5526ec42, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5526ec42, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.835] GetProcessHeap () returned 0xfd0000 [0173.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.835] GetProcessHeap () returned 0xfd0000 [0173.835] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5527af93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5527fdb5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5527fdb5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.836] GetProcessHeap () returned 0xfd0000 [0173.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.836] GetProcessHeap () returned 0xfd0000 [0173.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552899f4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5528e81a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5528e81a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.836] GetProcessHeap () returned 0xfd0000 [0173.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.836] GetProcessHeap () returned 0xfd0000 [0173.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5529845b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5529d27e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5529d27e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.837] GetProcessHeap () returned 0xfd0000 [0173.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.837] GetProcessHeap () returned 0xfd0000 [0173.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552a95cf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552abcd6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552abcd6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.838] GetProcessHeap () returned 0xfd0000 [0173.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.838] GetProcessHeap () returned 0xfd0000 [0173.838] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552b591e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552ba743, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552ba743, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.838] GetProcessHeap () returned 0xfd0000 [0173.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.838] GetProcessHeap () returned 0xfd0000 [0173.838] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552c91c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552cdfe6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552cdfe6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.838] GetProcessHeap () returned 0xfd0000 [0173.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.839] GetProcessHeap () returned 0xfd0000 [0173.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552da308, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552df141, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552df141, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.839] GetProcessHeap () returned 0xfd0000 [0173.839] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.839] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552e8d7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552edba8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552edba8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0173.839] GetProcessHeap () returned 0xfd0000 [0173.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552e8d7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552edba8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552edba8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.839] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552e8d7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552edba8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552edba8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.839] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552edba8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552f0258, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.840] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552edba8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552f0258, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573661d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.840] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.840] GetProcessHeap () returned 0xfd0000 [0173.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.840] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552f9ef6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fed19, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552fed19, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0173.840] GetProcessHeap () returned 0xfd0000 [0173.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552f9ef6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fed19, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552fed19, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.840] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552f9ef6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fed19, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x552fed19, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.840] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552fed19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fecb8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.840] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552fed19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x552fecb8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.840] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.840] GetProcessHeap () returned 0xfd0000 [0173.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.840] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5530895a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5530d780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0173.840] GetProcessHeap () returned 0xfd0000 [0173.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5530895a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5530d780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.842] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5530895a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5530d780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.842] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5530d780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d718, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.842] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5530d780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5530d718, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.842] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.842] GetProcessHeap () returned 0xfd0000 [0173.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.842] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553173b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5531c1d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5531c1d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0173.842] GetProcessHeap () returned 0xfd0000 [0173.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553173b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5531c1d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5531c1d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.842] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553173b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5531c1d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5531c1d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.843] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5531c1d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55320f98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.843] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5531c1d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55320f98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.843] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0173.843] GetProcessHeap () returned 0xfd0000 [0173.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.843] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5532ac3c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5533217d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5533217d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0173.843] GetProcessHeap () returned 0xfd0000 [0173.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5532ac3c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5533217d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5533217d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.843] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5532ac3c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5533217d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5533217d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.843] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5532fa64, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55332108, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.843] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5532fa64, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55332108, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.843] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.843] GetProcessHeap () returned 0xfd0000 [0173.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.843] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5533e4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55340bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55340bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0173.844] GetProcessHeap () returned 0xfd0000 [0173.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5533e4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55340bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55340bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.844] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5533e4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55340bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55340bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.844] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55340bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55343278, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.844] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55340bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55343278, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.844] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.844] GetProcessHeap () returned 0xfd0000 [0173.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.844] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5534cf30, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5534f643, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5534f643, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0173.844] GetProcessHeap () returned 0xfd0000 [0173.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5534cf30, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5534f643, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5534f643, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.845] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5534cf30, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5534f643, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5534f643, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.845] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5534f643, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55351cd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.845] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5534f643, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55351cd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.845] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.845] GetProcessHeap () returned 0xfd0000 [0173.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.845] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5535b994, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553607b6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553607b6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0173.845] GetProcessHeap () returned 0xfd0000 [0173.845] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5535b994, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553607b6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553607b6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.846] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5535b994, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553607b6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553607b6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.846] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553607b6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55362e48, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.846] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553607b6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55362e48, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.846] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.846] GetProcessHeap () returned 0xfd0000 [0173.846] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.846] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5536f21e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5537402a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5537402a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0173.846] GetProcessHeap () returned 0xfd0000 [0173.846] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5536f21e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5537402a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5537402a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.847] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5536f21e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5537402a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5537402a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.847] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5537402a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553766c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.847] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5537402a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553766c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.847] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.847] GetProcessHeap () returned 0xfd0000 [0173.847] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.847] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538038e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55382aa1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55382aa1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0173.847] GetProcessHeap () returned 0xfd0000 [0173.847] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538038e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55382aa1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55382aa1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.848] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538038e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55382aa1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55382aa1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.848] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55382aa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55385128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.848] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55382aa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55385128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55738d29, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.848] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.848] GetProcessHeap () returned 0xfd0000 [0173.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.848] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538ede3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55393c15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55393c15, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0173.848] GetProcessHeap () returned 0xfd0000 [0173.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538ede3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55393c15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55393c15, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0173.849] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5538ede3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55393c15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55393c15, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.849] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55393c15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55396298, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.849] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55393c15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55396298, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.849] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0173.849] GetProcessHeap () returned 0xfd0000 [0173.849] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.849] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539d857, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a2679, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553a2679, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0173.849] GetProcessHeap () returned 0xfd0000 [0173.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539d857, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a2679, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553a2679, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.849] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539d857, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a2679, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553a2679, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.849] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a2679, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a4cf8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.849] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a2679, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553a4cf8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.849] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.849] GetProcessHeap () returned 0xfd0000 [0173.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.850] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553b37e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553b860f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553b860f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0173.850] GetProcessHeap () returned 0xfd0000 [0173.850] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553b37e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553b860f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553b860f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0173.850] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553b37e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553b860f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553b860f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.850] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553b860f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553bac88, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.850] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553b860f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553bac88, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.850] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0173.850] GetProcessHeap () returned 0xfd0000 [0173.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.850] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553c2245, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c7077, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553c7077, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0173.851] GetProcessHeap () returned 0xfd0000 [0173.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553c2245, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c7077, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553c7077, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.851] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553c2245, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c7077, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553c7077, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.851] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553c7077, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c6fd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.851] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553c7077, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553c6fd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.851] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.851] GetProcessHeap () returned 0xfd0000 [0173.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.851] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553d2122, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5bbe, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553d5bbe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0173.851] GetProcessHeap () returned 0xfd0000 [0173.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553d2122, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5bbe, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553d5bbe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.851] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553d2122, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5bbe, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553d5bbe, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.851] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553d5bbe, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5a38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.852] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553d5bbe, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553d5a38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.852] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.852] GetProcessHeap () returned 0xfd0000 [0173.852] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.852] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553e6d3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553ea7d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553ea7d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0173.852] GetProcessHeap () returned 0xfd0000 [0173.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553e6d3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553ea7d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553ea7d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.930] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553e6d3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553ea7d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553ea7d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.930] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553ea7d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553eb9c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.930] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553ea7d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553eb9c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.930] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.930] GetProcessHeap () returned 0xfd0000 [0173.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.930] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553f6fa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fd14a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553fd14a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0173.930] GetProcessHeap () returned 0xfd0000 [0173.930] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553f6fa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fd14a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553fd14a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.931] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553f6fa1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fd14a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x553fd14a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.931] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553fd14a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fcb38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.931] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553fd14a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x553fcb38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.931] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.932] GetProcessHeap () returned 0xfd0000 [0173.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.932] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5541a6c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55429128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55429128, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0173.933] GetProcessHeap () returned 0xfd0000 [0173.933] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5541a6c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55429128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55429128, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.933] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5541a6c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55429128, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55429128, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.933] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55429128, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5542b168, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.934] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55429128, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5542b168, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.934] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.934] GetProcessHeap () returned 0xfd0000 [0173.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.934] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5543548c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543c9c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5543c9c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0173.934] GetProcessHeap () returned 0xfd0000 [0173.934] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5543548c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543c9c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5543c9c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.934] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5543548c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543c9c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5543c9c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.934] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543c9c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543e9e8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.934] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543c9c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5543e9e8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573b43c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.934] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.935] GetProcessHeap () returned 0xfd0000 [0173.935] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.935] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55452973, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457773, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55457773, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0173.935] GetProcessHeap () returned 0xfd0000 [0173.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55452973, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457773, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55457773, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.936] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55452973, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457773, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x55457773, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55457773, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457088, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55457773, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55457088, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.936] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.936] GetProcessHeap () returned 0xfd0000 [0173.936] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55463ac8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554661d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554661d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0173.936] GetProcessHeap () returned 0xfd0000 [0173.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55463ac8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554661d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554661d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.936] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55463ac8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554661d8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554661d8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554661d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554681f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554661d8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554681f8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.936] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.937] GetProcessHeap () returned 0xfd0000 [0173.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.937] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55479a4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5547e881, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5547e881, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0173.937] GetProcessHeap () returned 0xfd0000 [0173.937] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55479a4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5547e881, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5547e881, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.937] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55479a4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5547e881, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5547e881, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.937] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5547e881, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55482fa8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.937] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5547e881, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55482fa8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.937] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.937] GetProcessHeap () returned 0xfd0000 [0173.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.937] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5548d2e2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5549481a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5549481a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0173.937] GetProcessHeap () returned 0xfd0000 [0173.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5548d2e2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5549481a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5549481a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.938] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5548d2e2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5549481a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5549481a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.938] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5549481a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55494118, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.938] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5549481a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x55494118, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.938] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.938] GetProcessHeap () returned 0xfd0000 [0173.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.938] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554a0b75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a598b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a598b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0173.938] GetProcessHeap () returned 0xfd0000 [0173.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0173.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554a0b75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a598b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a598b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0173.938] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554a0b75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a598b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a598b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.939] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554a598b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a7998, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0173.939] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554a598b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a7998, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5573db4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0173.939] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0173.939] GetProcessHeap () returned 0xfd0000 [0173.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0173.939] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554a0b75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554a598b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554a598b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0173.939] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0173.939] GetProcessHeap () returned 0xfd0000 [0173.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0173.939] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554f148f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554f148f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554f148f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0173.939] GetProcessHeap () returned 0xfd0000 [0173.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0173.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554f148f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554f148f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5577fa0f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0173.940] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554f148f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554f148f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5577fa0f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.940] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5577fa0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5577fa0f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5577fa0f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0173.940] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554f148f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554f3488, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0173.940] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554f148f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554f3488, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb5c41700, ftLastWriteTime.dwHighDateTime=0x1d03fb2, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0173.940] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0173.940] GetProcessHeap () returned 0xfd0000 [0173.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0173.940] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x554f148f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x554f148f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x554f148f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0173.940] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0173.940] GetProcessHeap () returned 0xfd0000 [0173.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0173.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x551a1ac1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4a5bd1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5572f0cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0173.940] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0173.941] GetProcessHeap () returned 0xfd0000 [0173.941] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0173.942] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf92b561a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf92b561a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1 [0173.942] GetProcessHeap () returned 0xfd0000 [0173.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0173.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf92b561a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf92b561a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0173.944] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5270720f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf92b561a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf92b561a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.944] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x560632d7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4c7a488, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x56c9d490, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0173.944] GetProcessHeap () returned 0xfd0000 [0173.944] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0173.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x560632d7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4c7a488, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x56c9d490, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x560632d7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc4c7a488, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x56c9d490, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566803c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56c9d490, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9d490, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566851e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56c9d490, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9d490, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5668ee19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56693a76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xcfb12a00, ftLastWriteTime.dwHighDateTime=0x1d03fb1, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56698a6a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56698896, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xcfb12a00, ftLastWriteTime.dwHighDateTime=0x1d03fb1, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5606810f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x566a4be6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c8ea44, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0174.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5608f216, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5667195d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5667195d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0174.028] GetProcessHeap () returned 0xfd0000 [0174.028] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5608f216, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5667195d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5667195d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.164] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5608f216, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5667195d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5667195d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.164] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x560a9fcc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x560dad1e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x560dad1e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0174.164] GetProcessHeap () returned 0xfd0000 [0174.164] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x560a9fcc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x560dad1e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x560dad1e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.165] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x560a9fcc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x560dad1e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x560dad1e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.165] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560dad1e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x560dd406, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.165] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560dad1e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x560dd406, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.165] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.165] GetProcessHeap () returned 0xfd0000 [0174.165] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.165] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5611a4d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561219ea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x561219ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0174.165] GetProcessHeap () returned 0xfd0000 [0174.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5611a4d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561219ea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x561219ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.165] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5611a4d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561219ea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x561219ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.165] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561219ea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561240d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.165] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561219ea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561240d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.166] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.166] GetProcessHeap () returned 0xfd0000 [0174.166] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.166] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56137987, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5613c7ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5613c7ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0174.166] GetProcessHeap () returned 0xfd0000 [0174.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56137987, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5613c7ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5613c7ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.166] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56137987, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5613c7ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5613c7ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.166] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5613c7ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5613ee86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.166] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5613c7ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5613ee86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.166] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.166] GetProcessHeap () returned 0xfd0000 [0174.166] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.166] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56174a36, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5618f7e3, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5618f7e3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0174.166] GetProcessHeap () returned 0xfd0000 [0174.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56174a36, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5618f7e3, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5618f7e3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.167] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56174a36, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5618f7e3, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5618f7e3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.167] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5618f7e3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561af366, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.167] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5618f7e3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561af366, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.167] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.167] GetProcessHeap () returned 0xfd0000 [0174.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.167] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561cc89c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561d64d7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x561d64d7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0174.167] GetProcessHeap () returned 0xfd0000 [0174.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561cc89c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561d64d7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x561d64d7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.168] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561cc89c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561d64d7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x561d64d7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.168] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561d64d7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561d8b76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.168] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561d64d7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x561d8b76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.168] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.168] GetProcessHeap () returned 0xfd0000 [0174.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.168] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562246ef, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5622e32d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5622e32d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0174.168] GetProcessHeap () returned 0xfd0000 [0174.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562246ef, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5622e32d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5622e32d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.168] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562246ef, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5622e32d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5622e32d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.168] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5622e32d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5622e2a6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.168] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5622e32d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5622e2a6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.168] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.169] GetProcessHeap () returned 0xfd0000 [0174.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.169] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5623cd95, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5624b7fc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5624b7fc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0174.169] GetProcessHeap () returned 0xfd0000 [0174.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5623cd95, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5624b7fc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5624b7fc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.169] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5623cd95, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5624b7fc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5624b7fc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.169] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5624b7fc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5624de76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.169] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5624b7fc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5624de76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56c9fbb2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.169] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.169] GetProcessHeap () returned 0xfd0000 [0174.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.169] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56263e9f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56272906, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56272906, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0174.170] GetProcessHeap () returned 0xfd0000 [0174.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56263e9f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56272906, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56272906, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.170] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56263e9f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56272906, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56272906, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.170] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56272906, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56277686, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.170] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56272906, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56277686, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.170] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.170] GetProcessHeap () returned 0xfd0000 [0174.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.170] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56286189, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5628fdcb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5628fdcb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0174.170] GetProcessHeap () returned 0xfd0000 [0174.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56286189, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5628fdcb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5628fdcb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.170] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56286189, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5628fdcb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5628fdcb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5628fdcb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5628fd26, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5628fdcb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5628fd26, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.171] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.171] GetProcessHeap () returned 0xfd0000 [0174.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562ad293, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x562b20b9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x562b20b9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0174.171] GetProcessHeap () returned 0xfd0000 [0174.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562ad293, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x562b20b9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x562b20b9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562ad293, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x562b20b9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x562b20b9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x562b20b9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x562b2006, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x562b20b9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x562b2006, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.171] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.171] GetProcessHeap () returned 0xfd0000 [0174.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562f8d9b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563002cd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563002cd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0174.172] GetProcessHeap () returned 0xfd0000 [0174.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562f8d9b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563002cd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563002cd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.172] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562f8d9b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563002cd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563002cd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.172] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563002cd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56300206, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.172] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563002cd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56300206, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.172] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.173] GetProcessHeap () returned 0xfd0000 [0174.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.173] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5630c622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56316267, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56316267, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0174.173] GetProcessHeap () returned 0xfd0000 [0174.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5630c622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56316267, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56316267, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.173] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5630c622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56316267, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56316267, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.173] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56316267, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5631d6c6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.173] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56316267, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5631d6c6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.173] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.173] GetProcessHeap () returned 0xfd0000 [0174.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.173] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5632e909, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56333738, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56333738, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0174.173] GetProcessHeap () returned 0xfd0000 [0174.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5632e909, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56333738, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56333738, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.182] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5632e909, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56333738, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56333738, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.182] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56333738, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5633ab86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.182] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56333738, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5633ab86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca22c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.182] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.182] GetProcessHeap () returned 0xfd0000 [0174.182] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.182] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563496bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5634e4de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5634e4de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0174.182] GetProcessHeap () returned 0xfd0000 [0174.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563496bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5634e4de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5634e4de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.182] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563496bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5634e4de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5634e4de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.183] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5634e4de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5634e406, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca97d1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.183] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5634e4de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5634e406, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca97d1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.183] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.183] GetProcessHeap () returned 0xfd0000 [0174.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.183] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635a83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56361d71, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56361d71, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0174.183] GetProcessHeap () returned 0xfd0000 [0174.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635a83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56361d71, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56361d71, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.184] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635a83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56361d71, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56361d71, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56361d71, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5636dfd6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca97d1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56361d71, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5636dfd6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56ca97d1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.185] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.185] GetProcessHeap () returned 0xfd0000 [0174.185] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563755ef, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5637cb1d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5637cb1d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0174.185] GetProcessHeap () returned 0xfd0000 [0174.185] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563755ef, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5637cb1d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5637cb1d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.185] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563755ef, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5637cb1d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5637cb1d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5637cb1d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5637ca36, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5637cb1d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5637ca36, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.185] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.186] GetProcessHeap () returned 0xfd0000 [0174.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.186] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56384050, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56392aa4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56392aa4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0174.186] GetProcessHeap () returned 0xfd0000 [0174.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56384050, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56392aa4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56392aa4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.186] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56384050, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56392aa4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56392aa4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.186] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56392aa4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563950d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.186] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56392aa4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563950d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.186] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.186] GetProcessHeap () returned 0xfd0000 [0174.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.186] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5639c6fc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563a151b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563a151b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0174.186] GetProcessHeap () returned 0xfd0000 [0174.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5639c6fc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563a151b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563a151b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.188] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5639c6fc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563a151b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563a151b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.188] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563a151b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563a1426, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.188] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563a151b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563a1426, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.188] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.188] GetProcessHeap () returned 0xfd0000 [0174.188] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.188] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563a8a4d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563ad873, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563ad873, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0174.189] GetProcessHeap () returned 0xfd0000 [0174.189] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563a8a4d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563ad873, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563ad873, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.189] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563a8a4d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563ad873, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563ad873, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.189] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563ad873, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563ad776, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.189] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563ad873, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563ad776, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.189] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.189] GetProcessHeap () returned 0xfd0000 [0174.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.189] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563c3806, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563cad35, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563cad35, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0174.190] GetProcessHeap () returned 0xfd0000 [0174.190] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563c3806, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563cad35, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563cad35, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.190] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563c3806, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563cad35, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563cad35, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.191] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563cad35, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563cac36, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.191] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563cad35, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563cac36, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.191] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.191] GetProcessHeap () returned 0xfd0000 [0174.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.191] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563d2264, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563d708c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563d708c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0174.191] GetProcessHeap () returned 0xfd0000 [0174.191] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563d2264, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563d708c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563d708c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0174.191] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563d2264, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563d708c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563d708c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.191] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563d708c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563d6f86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.191] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563d708c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563d6f86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.191] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0174.191] GetProcessHeap () returned 0xfd0000 [0174.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.191] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ed029, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563f4555, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563f4555, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0174.192] GetProcessHeap () returned 0xfd0000 [0174.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ed029, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563f4555, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563f4555, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.192] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563ed029, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563f4555, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x563f4555, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.192] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563f4555, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563f4446, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.192] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563f4555, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x563f4446, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.192] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.192] GetProcessHeap () returned 0xfd0000 [0174.192] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.192] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563fba87, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5640a4eb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5640a4eb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0174.192] GetProcessHeap () returned 0xfd0000 [0174.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563fba87, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5640a4eb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5640a4eb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.193] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563fba87, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5640a4eb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5640a4eb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.193] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5640a4eb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5640cae6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.193] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5640a4eb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5640cae6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cabf03, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.193] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.193] GetProcessHeap () returned 0xfd0000 [0174.193] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.193] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56418f4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5641b678, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5641b678, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0174.194] GetProcessHeap () returned 0xfd0000 [0174.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56418f4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5641b678, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5641b678, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.194] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56418f4f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5641b678, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5641b678, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.194] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5641b678, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5641dc56, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.194] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5641b678, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5641dc56, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.194] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.194] GetProcessHeap () returned 0xfd0000 [0174.194] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.194] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564252a4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56438b24, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56438b24, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0174.194] GetProcessHeap () returned 0xfd0000 [0174.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564252a4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56438b24, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56438b24, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564252a4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56438b24, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56438b24, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56438b24, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5643b116, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56438b24, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5643b116, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.195] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.195] GetProcessHeap () returned 0xfd0000 [0174.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.195] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56442769, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5644758b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5644758b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0174.195] GetProcessHeap () returned 0xfd0000 [0174.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56442769, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5644758b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5644758b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.195] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56442769, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5644758b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5644758b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.195] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5644758b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56447466, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.195] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5644758b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56447466, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.195] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.196] GetProcessHeap () returned 0xfd0000 [0174.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.196] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5644eaba, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5646bf7f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5646bf7f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0174.196] GetProcessHeap () returned 0xfd0000 [0174.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5644eaba, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5646bf7f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5646bf7f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.196] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5644eaba, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5646bf7f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5646bf7f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.197] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5646bf7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5646e566, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xcfb12a00, ftLastWriteTime.dwHighDateTime=0x1d03fb1, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.197] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5646bf7f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5646e566, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xcfb12a00, ftLastWriteTime.dwHighDateTime=0x1d03fb1, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.197] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.197] GetProcessHeap () returned 0xfd0000 [0174.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.197] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56475bc7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5647d0e1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5647d0e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0174.197] GetProcessHeap () returned 0xfd0000 [0174.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56475bc7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5647d0e1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5647d0e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.198] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56475bc7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5647d0e1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5647d0e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.198] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647d0e1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5647cfc6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.198] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647d0e1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5647cfc6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.198] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.198] GetProcessHeap () returned 0xfd0000 [0174.198] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.198] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564ba19d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564bc8b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x564bc8b0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0174.198] GetProcessHeap () returned 0xfd0000 [0174.198] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564ba19d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564bc8b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x564bc8b0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.198] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564ba19d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564bc8b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x564bc8b0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.198] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x564bc8b0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564bee76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x564bc8b0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564bee76, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.199] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.199] GetProcessHeap () returned 0xfd0000 [0174.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.199] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564c64ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564cda1a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x564cda1a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0174.199] GetProcessHeap () returned 0xfd0000 [0174.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564c64ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564cda1a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x564cda1a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x564c64ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564cda1a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x564cda1a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x564cda1a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564cffe6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x564cda1a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x564cffe6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.199] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.200] GetProcessHeap () returned 0xfd0000 [0174.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.200] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565b805d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565bce86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565bce86, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0174.200] GetProcessHeap () returned 0xfd0000 [0174.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565b805d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565bce86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565bce86, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0174.200] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565b805d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565bce86, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565bce86, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.200] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565bce86, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565bccf6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.200] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565bce86, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565bccf6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.200] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0174.200] GetProcessHeap () returned 0xfd0000 [0174.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.200] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565cb8ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565d070f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565d070f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0174.200] GetProcessHeap () returned 0xfd0000 [0174.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565cb8ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565d070f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565d070f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.201] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565cb8ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565d070f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565d070f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.201] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d070f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565d0576, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.201] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d070f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565d0576, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.202] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.202] GetProcessHeap () returned 0xfd0000 [0174.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.202] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565dca51, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565e1886, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565e1886, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0174.202] GetProcessHeap () returned 0xfd0000 [0174.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565dca51, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565e1886, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565e1886, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.202] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565dca51, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565e1886, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565e1886, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.202] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565e1886, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565e16e6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.202] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565e1886, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565e16e6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cae613, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.202] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.202] GetProcessHeap () returned 0xfd0000 [0174.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.202] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565e8db2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565f29fa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565f29fa, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0174.202] GetProcessHeap () returned 0xfd0000 [0174.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565e8db2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565f29fa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565f29fa, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.203] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565e8db2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565f29fa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565f29fa, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.203] GetProcessHeap () returned 0xfd0000 [0174.203] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.203] GetProcessHeap () returned 0xfd0000 [0174.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x565f9f2c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x565fed4f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x565fed4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.205] GetProcessHeap () returned 0xfd0000 [0174.205] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.205] GetProcessHeap () returned 0xfd0000 [0174.205] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5660d7b3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56614ce8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56614ce8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.206] GetProcessHeap () returned 0xfd0000 [0174.206] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.206] GetProcessHeap () returned 0xfd0000 [0174.206] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56621036, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56625e59, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56625e59, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.206] GetProcessHeap () returned 0xfd0000 [0174.206] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.206] GetProcessHeap () returned 0xfd0000 [0174.206] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5662fa97, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x566348bd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x566348bd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.207] GetProcessHeap () returned 0xfd0000 [0174.207] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.207] GetProcessHeap () returned 0xfd0000 [0174.207] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5663bdec, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56645a2e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56645a2e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.212] GetProcessHeap () returned 0xfd0000 [0174.212] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.212] GetProcessHeap () returned 0xfd0000 [0174.212] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5664cf56, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x566592b7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x566592b7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.214] GetProcessHeap () returned 0xfd0000 [0174.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.214] GetProcessHeap () returned 0xfd0000 [0174.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x566607e6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56667d12, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56667d12, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.214] GetProcessHeap () returned 0xfd0000 [0174.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.214] GetProcessHeap () returned 0xfd0000 [0174.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5667195d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56678e80, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56678e80, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.215] GetProcessHeap () returned 0xfd0000 [0174.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.215] GetProcessHeap () returned 0xfd0000 [0174.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0174.215] GetProcessHeap () returned 0xfd0000 [0174.216] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x566ac2f1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x566ac2f1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56dbfd60, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.216] GetProcessHeap () returned 0xfd0000 [0174.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0174.216] GetProcessHeap () returned 0xfd0000 [0174.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0174.216] GetProcessHeap () returned 0xfd0000 [0174.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0174.217] GetProcessHeap () returned 0xfd0000 [0174.217] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0174.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53090b6a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9327c4a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9327c4a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.367] GetProcessHeap () returned 0xfd0000 [0174.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0174.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe921ba6c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4daa349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe973370f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.375] GetProcessHeap () returned 0xfd0000 [0174.375] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe922cbef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9535296, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9535296, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0174.377] GetProcessHeap () returned 0xfd0000 [0174.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9231a0e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9238f40, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9238f40, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.378] GetProcessHeap () returned 0xfd0000 [0174.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.378] GetProcessHeap () returned 0xfd0000 [0174.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9240472, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9245297, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9245297, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.378] GetProcessHeap () returned 0xfd0000 [0174.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.379] GetProcessHeap () returned 0xfd0000 [0174.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe924c7c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe924eed6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe924eed6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.379] GetProcessHeap () returned 0xfd0000 [0174.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.380] GetProcessHeap () returned 0xfd0000 [0174.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9256407, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9258b1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9258b1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.380] GetProcessHeap () returned 0xfd0000 [0174.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.380] GetProcessHeap () returned 0xfd0000 [0174.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9264e5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9267584, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9267584, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.380] GetProcessHeap () returned 0xfd0000 [0174.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.380] GetProcessHeap () returned 0xfd0000 [0174.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9275fe2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe927ae01, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe927ae01, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.381] GetProcessHeap () returned 0xfd0000 [0174.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.381] GetProcessHeap () returned 0xfd0000 [0174.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe928985b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe928e687, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe928e687, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.381] GetProcessHeap () returned 0xfd0000 [0174.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.381] GetProcessHeap () returned 0xfd0000 [0174.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92982b2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe929d0ea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe929d0ea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.382] GetProcessHeap () returned 0xfd0000 [0174.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.382] GetProcessHeap () returned 0xfd0000 [0174.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92a6d26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92abb48, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92abb48, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.383] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92a6d26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92abb48, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92abb48, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.383] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92abb48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ae232, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.383] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92abb48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ae232, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.383] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.383] GetProcessHeap () returned 0xfd0000 [0174.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.383] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92b7e99, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ba5b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92ba5b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0174.383] GetProcessHeap () returned 0xfd0000 [0174.383] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92b7e99, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ba5b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92ba5b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.384] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92b7e99, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ba5b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92ba5b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.384] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ba5b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92bcc92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.384] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ba5b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92bcc92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.384] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.384] GetProcessHeap () returned 0xfd0000 [0174.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.384] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92c9015, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92cb728, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92cb728, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0174.384] GetProcessHeap () returned 0xfd0000 [0174.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92c9015, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92cb728, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92cb728, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.384] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92c9015, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92cb728, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92cb728, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.384] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92cb728, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92cde02, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.385] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92cb728, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92cde02, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.385] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.385] GetProcessHeap () returned 0xfd0000 [0174.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.385] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92da18c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92defab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92defab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0174.385] GetProcessHeap () returned 0xfd0000 [0174.385] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92da18c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92defab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92defab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.385] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92da18c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92defab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92defab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.385] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92defab, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92e1682, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.385] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92defab, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92e1682, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9735e41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.385] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.385] GetProcessHeap () returned 0xfd0000 [0174.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.385] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92e8bec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92eb302, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92eb302, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0174.385] GetProcessHeap () returned 0xfd0000 [0174.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92e8bec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92eb302, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92eb302, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.386] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92e8bec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92eb302, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92eb302, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.386] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92eb302, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ed9d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x43bd3f00, ftLastWriteTime.dwHighDateTime=0x1d10afb, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.386] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92eb302, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92ed9d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x43bd3f00, ftLastWriteTime.dwHighDateTime=0x1d10afb, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.386] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.386] GetProcessHeap () returned 0xfd0000 [0174.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.386] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92f4f41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92f9d59, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92f9d59, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0174.386] GetProcessHeap () returned 0xfd0000 [0174.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92f4f41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92f9d59, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92f9d59, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.387] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe92f4f41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92f9d59, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe92f9d59, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.387] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92f9d59, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92fc432, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.387] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92f9d59, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe92fc432, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.387] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.387] GetProcessHeap () returned 0xfd0000 [0174.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.387] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93039a4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93087c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93087c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0174.387] GetProcessHeap () returned 0xfd0000 [0174.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93039a4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93087c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93087c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0174.388] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93039a4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93087c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93087c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.388] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93087c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe930ae92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.388] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93087c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe930ae92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.388] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0174.388] GetProcessHeap () returned 0xfd0000 [0174.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.388] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe931721b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe931c04c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe931c04c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0174.388] GetProcessHeap () returned 0xfd0000 [0174.388] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe931721b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe931c04c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe931c04c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0174.389] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe931721b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe931c04c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe931c04c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.389] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe931c04c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe931c002, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.389] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe931c04c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe931c002, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.389] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0174.389] GetProcessHeap () returned 0xfd0000 [0174.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.389] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9328394, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe932d1c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe932d1c0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0174.389] GetProcessHeap () returned 0xfd0000 [0174.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9328394, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe932d1c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe932d1c0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0174.390] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9328394, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe932d1c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe932d1c0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.390] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe932d1c0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe932f882, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.390] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe932d1c0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe932f882, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.390] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0174.390] GetProcessHeap () returned 0xfd0000 [0174.390] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.390] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9336e01, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe933bc27, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe933bc27, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0174.390] GetProcessHeap () returned 0xfd0000 [0174.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9336e01, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe933bc27, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe933bc27, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0174.391] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9336e01, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe933bc27, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe933bc27, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.391] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe933bc27, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe933bbd2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.391] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe933bc27, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe933bbd2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.391] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0174.391] GetProcessHeap () returned 0xfd0000 [0174.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.391] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9347f74, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe934cd68, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe934cd68, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0174.391] GetProcessHeap () returned 0xfd0000 [0174.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9347f74, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe934cd68, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe934cd68, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.392] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9347f74, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe934cd68, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe934cd68, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.392] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe934cd68, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe934cd42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.392] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe934cd68, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe934cd42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.392] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.392] GetProcessHeap () returned 0xfd0000 [0174.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.392] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93569cf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe935b7fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe935b7fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0174.392] GetProcessHeap () returned 0xfd0000 [0174.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93569cf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe935b7fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe935b7fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.393] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93569cf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe935b7fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe935b7fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.393] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe935b7fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe935b7a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.393] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe935b7fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe935b7a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973854e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.393] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.393] GetProcessHeap () returned 0xfd0000 [0174.393] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.393] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe936543c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9367b4f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9367b4f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0174.393] GetProcessHeap () returned 0xfd0000 [0174.393] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe936543c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9367b4f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9367b4f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.394] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe936543c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9367b4f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9367b4f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.394] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9367b4f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe936c912, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.394] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9367b4f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe936c912, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.394] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.394] GetProcessHeap () returned 0xfd0000 [0174.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.394] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9373e93, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe937b3ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe937b3ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0174.394] GetProcessHeap () returned 0xfd0000 [0174.394] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9373e93, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe937b3ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe937b3ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.394] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9373e93, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe937b3ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe937b3ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.394] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe937b3ce, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe937da82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.394] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe937b3ce, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe937da82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.394] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.395] GetProcessHeap () returned 0xfd0000 [0174.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.395] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9387776, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9389e38, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9389e38, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0174.395] GetProcessHeap () returned 0xfd0000 [0174.395] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9387776, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9389e38, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9389e38, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.395] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9387776, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9389e38, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9389e38, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.396] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9389e38, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe938c4e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.396] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9389e38, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe938c4e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.396] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.396] GetProcessHeap () returned 0xfd0000 [0174.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.396] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9393a6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe939889c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe939889c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0174.396] GetProcessHeap () returned 0xfd0000 [0174.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9393a6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe939889c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe939889c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.396] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9393a6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe939889c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe939889c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.396] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe939889c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe939af42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.396] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe939889c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe939af42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.396] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.396] GetProcessHeap () returned 0xfd0000 [0174.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.396] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93a4be4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93a9a12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93a9a12, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0174.397] GetProcessHeap () returned 0xfd0000 [0174.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93a4be4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93a9a12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93a9a12, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.397] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93a4be4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93a9a12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93a9a12, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.397] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93a9a12, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93a99a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.397] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93a9a12, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93a99a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.397] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.397] GetProcessHeap () returned 0xfd0000 [0174.397] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.397] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93b3651, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93b8473, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93b8473, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0174.397] GetProcessHeap () returned 0xfd0000 [0174.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93b3651, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93b8473, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93b8473, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.398] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93b3651, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93b8473, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93b8473, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.398] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93b8473, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93bab12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.398] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93b8473, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93bab12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.398] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.398] GetProcessHeap () returned 0xfd0000 [0174.398] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.398] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93c47c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93c95e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93c95e6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0174.399] GetProcessHeap () returned 0xfd0000 [0174.399] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93c47c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93c95e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93c95e6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.399] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93c47c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93c95e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93c95e6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.399] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93c95e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93cbc82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.399] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93c95e6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93cbc82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.399] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.399] GetProcessHeap () returned 0xfd0000 [0174.399] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.399] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93d3215, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93d804d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93d804d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0174.399] GetProcessHeap () returned 0xfd0000 [0174.399] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93d3215, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93d804d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93d804d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.400] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93d3215, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93d804d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93d804d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.400] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93d804d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93d7fd2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.400] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93d804d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93d7fd2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.400] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.400] GetProcessHeap () returned 0xfd0000 [0174.400] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.400] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93df57c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93e6ab1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93e6ab1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0174.400] GetProcessHeap () returned 0xfd0000 [0174.400] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93df57c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93e6ab1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93e6ab1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.400] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93df57c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93e6ab1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93e6ab1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.400] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93e6ab1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93e9142, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x43bd3f00, ftLastWriteTime.dwHighDateTime=0x1d10afb, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.401] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93e6ab1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93e9142, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x43bd3f00, ftLastWriteTime.dwHighDateTime=0x1d10afb, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.401] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.401] GetProcessHeap () returned 0xfd0000 [0174.401] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.401] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93f54fc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93fa337, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93fa337, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0174.401] GetProcessHeap () returned 0xfd0000 [0174.401] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93f54fc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93fa337, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93fa337, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.402] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93f54fc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93fa337, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe93fa337, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.402] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93fa337, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93fc9c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.402] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93fa337, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe93fc9c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973ac60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.402] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.402] GetProcessHeap () returned 0xfd0000 [0174.402] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.402] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe940667e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe940b4a7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe940b4a7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0174.402] GetProcessHeap () returned 0xfd0000 [0174.402] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe940667e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe940b4a7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe940b4a7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.402] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe940667e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe940b4a7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe940b4a7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.402] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe940b4a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe940db32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973d36d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.402] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe940b4a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe940db32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973d36d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.402] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.403] GetProcessHeap () returned 0xfd0000 [0174.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.403] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94177f2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9419f0e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9419f0e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0174.403] GetProcessHeap () returned 0xfd0000 [0174.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94177f2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9419f0e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9419f0e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.403] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94177f2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9419f0e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9419f0e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.403] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9419f0e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe941eca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.403] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9419f0e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe941eca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.403] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.403] GetProcessHeap () returned 0xfd0000 [0174.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.403] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9426258, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe942b081, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe942b081, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0174.403] GetProcessHeap () returned 0xfd0000 [0174.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9426258, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe942b081, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe942b081, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9426258, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe942b081, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe942b081, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe942b081, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe942d702, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe942b081, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe942d702, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.404] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.404] GetProcessHeap () returned 0xfd0000 [0174.404] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.404] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94373c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe943c252, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe943c252, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0174.404] GetProcessHeap () returned 0xfd0000 [0174.404] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94373c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe943c252, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe943c252, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94373c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe943c252, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe943c252, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe943c252, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9456f12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe943c252, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9456f12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.404] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.405] GetProcessHeap () returned 0xfd0000 [0174.405] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.405] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94a9fe6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ac6f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94ac6f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0174.405] GetProcessHeap () returned 0xfd0000 [0174.405] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94a9fe6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ac6f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94ac6f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.405] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94a9fe6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ac6f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94ac6f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.405] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94ac6f3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94bfec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.406] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94ac6f3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94bfec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.406] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.406] GetProcessHeap () returned 0xfd0000 [0174.406] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.406] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94ce9dc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94d37ff, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94d37ff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0174.406] GetProcessHeap () returned 0xfd0000 [0174.406] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94ce9dc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94d37ff, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94d37ff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94ce9dc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94d37ff, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94d37ff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94d37ff, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94d3742, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94d37ff, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94d3742, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.407] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.407] GetProcessHeap () returned 0xfd0000 [0174.407] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.407] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94dad1b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94dfb49, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94dfb49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0174.407] GetProcessHeap () returned 0xfd0000 [0174.407] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94dad1b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94dfb49, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94dfb49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.407] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94dad1b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94dfb49, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94dfb49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.407] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94dfb49, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94dfa92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.407] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94dfb49, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94dfa92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.407] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.408] GetProcessHeap () returned 0xfd0000 [0174.408] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.408] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94e9797, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ee5b3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94ee5b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0174.408] GetProcessHeap () returned 0xfd0000 [0174.408] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94e9797, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ee5b3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94ee5b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.408] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94e9797, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ee5b3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94ee5b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.408] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94ee5b3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ee4f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.408] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94ee5b3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94ee4f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.408] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.409] GetProcessHeap () returned 0xfd0000 [0174.409] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.409] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f81f5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94fcfe8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94fcfe8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0174.409] GetProcessHeap () returned 0xfd0000 [0174.409] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f81f5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94fcfe8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94fcfe8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.410] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f81f5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94fcfe8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe94fcfe8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.410] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94fcfe8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94fcf52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.410] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94fcfe8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe94fcf52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.410] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.410] GetProcessHeap () returned 0xfd0000 [0174.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.410] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9501e36, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9506c5c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9506c5c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0174.410] GetProcessHeap () returned 0xfd0000 [0174.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9501e36, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9506c5c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9506c5c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.410] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9501e36, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9506c5c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9506c5c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.411] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9506c5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9506b92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.641] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9506c5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9506b92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe973fa79, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.641] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.642] GetProcessHeap () returned 0xfd0000 [0174.642] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.642] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe950e181, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9512fb0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9512fb0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0174.642] GetProcessHeap () returned 0xfd0000 [0174.642] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe950e181, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9512fb0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9512fb0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.644] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe950e181, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9512fb0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9512fb0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.644] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9512fb0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9512ee2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.644] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9512fb0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9512ee2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.644] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.644] GetProcessHeap () returned 0xfd0000 [0174.644] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.644] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe951cbeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9521a13, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9521a13, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0174.644] GetProcessHeap () returned 0xfd0000 [0174.644] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe951cbeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9521a13, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9521a13, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.644] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe951cbeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9521a13, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9521a13, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.644] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9521a13, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9521942, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.644] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9521a13, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9521942, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.644] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.644] GetProcessHeap () returned 0xfd0000 [0174.644] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.645] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9528f48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe952dd68, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe952dd68, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0174.645] GetProcessHeap () returned 0xfd0000 [0174.645] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9528f48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe952dd68, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe952dd68, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.645] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9528f48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe952dd68, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe952dd68, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.645] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe952dd68, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe952dc92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.645] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe952dd68, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe952dc92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.645] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0174.646] GetProcessHeap () returned 0xfd0000 [0174.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.646] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9535296, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe953a0b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe953a0b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0174.646] GetProcessHeap () returned 0xfd0000 [0174.646] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9535296, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe953a0b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe953a0b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.646] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9535296, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe953a0b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe953a0b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.646] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe953a0b9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9539fe2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.646] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe953a0b9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9539fe2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe974218f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.646] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.646] GetProcessHeap () returned 0xfd0000 [0174.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.646] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9535296, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe953a0b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe953a0b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0174.646] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0174.646] GetProcessHeap () returned 0xfd0000 [0174.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0174.646] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9548b1c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe954b22c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe954b22c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0174.647] GetProcessHeap () returned 0xfd0000 [0174.647] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9548b1c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe954b22c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe954b22c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.647] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9548b1c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe954b22c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe954b22c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.647] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe954b22c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe954b152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x43bd3f00, ftLastWriteTime.dwHighDateTime=0x1d10afb, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0174.647] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe954b22c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe954b152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x43bd3f00, ftLastWriteTime.dwHighDateTime=0x1d10afb, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0174.647] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.647] GetProcessHeap () returned 0xfd0000 [0174.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0174.648] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9548b1c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe954b22c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe954b22c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0174.648] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.648] GetProcessHeap () returned 0xfd0000 [0174.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0174.649] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe921ba6c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4daa349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe973370f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 0 [0174.649] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.649] GetProcessHeap () returned 0xfd0000 [0174.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0174.650] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5401c7d1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf939a341, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf939a341, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0174.650] GetProcessHeap () returned 0xfd0000 [0174.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0174.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5401c7d1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf939a341, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf939a341, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.650] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5401c7d1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf939a341, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf939a341, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.650] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe985d505, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4fc18fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0174.650] GetProcessHeap () returned 0xfd0000 [0174.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0174.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe985d505, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4fc18fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0174.653] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe985d505, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4fc18fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.653] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98734b0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9d5cb0c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0174.653] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe986233d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b8f306, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d555fa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0174.653] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe987a9d3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b7e26a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b7e26a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0174.653] GetProcessHeap () returned 0xfd0000 [0174.653] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe987a9d3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b7e26a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b7e26a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.655] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe987a9d3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b7e26a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b7e26a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.655] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9881f14, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9884624, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9884624, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0174.656] GetProcessHeap () returned 0xfd0000 [0174.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9881f14, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9884624, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9884624, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9881f14, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9884624, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9884624, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9884624, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9886d26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9884624, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9886d26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.656] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.656] GetProcessHeap () returned 0xfd0000 [0174.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.656] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9890978, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9897eaa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9897eaa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0174.656] GetProcessHeap () returned 0xfd0000 [0174.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9890978, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9897eaa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9897eaa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0174.657] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9890978, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9897eaa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9897eaa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.657] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9897eaa, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9897e96, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.657] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9897eaa, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9897e96, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.657] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0174.657] GetProcessHeap () returned 0xfd0000 [0174.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.657] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98a41ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98a9020, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98a9020, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0174.657] GetProcessHeap () returned 0xfd0000 [0174.657] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98a41ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98a9020, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98a9020, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.657] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98a41ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98a9020, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98a9020, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.658] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98a9020, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98a9006, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.658] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98a9020, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98a9006, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.658] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.658] GetProcessHeap () returned 0xfd0000 [0174.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.658] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98b2c52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98b7a81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98b7a81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0174.658] GetProcessHeap () returned 0xfd0000 [0174.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98b2c52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98b7a81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98b7a81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98b2c52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98b7a81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98b7a81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98b7a81, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98b7a66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98b7a81, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98b7a66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.659] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.659] GetProcessHeap () returned 0xfd0000 [0174.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.659] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98c16bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98c8bf7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98c8bf7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0174.659] GetProcessHeap () returned 0xfd0000 [0174.659] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98c16bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98c8bf7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98c8bf7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98c16bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98c8bf7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98c8bf7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98c8bf7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98cb2e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98c8bf7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98cb2e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.659] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.659] GetProcessHeap () returned 0xfd0000 [0174.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.660] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98d2842, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98d765b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98d765b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0174.660] GetProcessHeap () returned 0xfd0000 [0174.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98d2842, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98d765b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98d765b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.660] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98d2842, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98d765b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98d765b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.660] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98d765b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98d9d46, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.661] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98d765b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98d9d46, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.661] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.661] GetProcessHeap () returned 0xfd0000 [0174.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.661] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98e39ac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98e87c1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98e87c1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0174.661] GetProcessHeap () returned 0xfd0000 [0174.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98e39ac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98e87c1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98e87c1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.661] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98e39ac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98e87c1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98e87c1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.661] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98e87c1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98ed5c6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.661] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98e87c1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98ed5c6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.661] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.662] GetProcessHeap () returned 0xfd0000 [0174.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.662] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98f4b16, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98f9941, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98f9941, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0174.662] GetProcessHeap () returned 0xfd0000 [0174.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98f4b16, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98f9941, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98f9941, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.662] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98f4b16, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98f9941, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98f9941, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.662] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98f9941, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98fc026, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.663] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98f9941, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98fc026, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.663] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.663] GetProcessHeap () returned 0xfd0000 [0174.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.663] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9905c95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe990aaab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe990aaab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0174.663] GetProcessHeap () returned 0xfd0000 [0174.663] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9905c95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe990aaab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe990aaab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.663] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9905c95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe990aaab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe990aaab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.663] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe990aaab, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe990aa86, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.663] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe990aaab, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe990aa86, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.663] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.663] GetProcessHeap () returned 0xfd0000 [0174.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.664] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9916e05, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe991951b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe991951b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0174.664] GetProcessHeap () returned 0xfd0000 [0174.664] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9916e05, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe991951b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe991951b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.664] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9916e05, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe991951b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe991951b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.664] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe991951b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe991bbf6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.665] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe991951b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe991bbf6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.665] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.665] GetProcessHeap () returned 0xfd0000 [0174.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.665] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe992586f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9927f7f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9927f7f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0174.665] GetProcessHeap () returned 0xfd0000 [0174.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe992586f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9927f7f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9927f7f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.665] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe992586f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9927f7f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9927f7f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.665] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9927f7f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe992a656, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.665] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9927f7f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe992a656, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.665] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.665] GetProcessHeap () returned 0xfd0000 [0174.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.665] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99369e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99390ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99390ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0174.666] GetProcessHeap () returned 0xfd0000 [0174.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99369e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99390ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99390ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.666] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99369e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99390ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99390ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.666] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99390ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe993b7c6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.666] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99390ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe993b7c6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.666] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.666] GetProcessHeap () returned 0xfd0000 [0174.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.666] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9945446, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe994a266, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe994a266, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0174.666] GetProcessHeap () returned 0xfd0000 [0174.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9945446, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe994a266, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe994a266, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.667] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9945446, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe994a266, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe994a266, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe994a266, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe994a226, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe994a266, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe994a226, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d5f238, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.667] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.667] GetProcessHeap () returned 0xfd0000 [0174.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9953e94, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9958ce5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9958ce5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0174.667] GetProcessHeap () returned 0xfd0000 [0174.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9953e94, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9958ce5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9958ce5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.667] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9953e94, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9958ce5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9958ce5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9958ce5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9958c86, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.667] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9958ce5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9958c86, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.667] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.668] GetProcessHeap () returned 0xfd0000 [0174.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.668] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe996501a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9967730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9967730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0174.668] GetProcessHeap () returned 0xfd0000 [0174.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe996501a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9967730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9967730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.668] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe996501a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9967730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9967730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.668] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9967730, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9969df6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.668] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9967730, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9969df6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.669] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.669] GetProcessHeap () returned 0xfd0000 [0174.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.669] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9976194, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99788a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99788a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0174.669] GetProcessHeap () returned 0xfd0000 [0174.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9976194, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99788a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99788a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0174.669] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9976194, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99788a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99788a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.669] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99788a0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe997af66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.669] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99788a0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe997af66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.669] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0174.669] GetProcessHeap () returned 0xfd0000 [0174.669] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.669] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9984beb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9989a17, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9989a17, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0174.669] GetProcessHeap () returned 0xfd0000 [0174.669] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9984beb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9989a17, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9989a17, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.670] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9984beb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9989a17, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9989a17, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.670] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9989a17, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe998c0d6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.670] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9989a17, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe998c0d6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.670] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.670] GetProcessHeap () returned 0xfd0000 [0174.670] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.670] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9995d6b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe999ab81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe999ab81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0174.671] GetProcessHeap () returned 0xfd0000 [0174.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9995d6b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe999ab81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe999ab81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0174.671] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9995d6b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe999ab81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe999ab81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.671] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe999ab81, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe999ab36, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.671] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe999ab81, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe999ab36, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.671] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0174.671] GetProcessHeap () returned 0xfd0000 [0174.671] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.671] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99a47cb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99a6ee1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99a6ee1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0174.671] GetProcessHeap () returned 0xfd0000 [0174.671] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99a47cb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99a6ee1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99a6ee1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.672] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99a47cb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99a6ee1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99a6ee1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.672] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99a6ee1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99a9596, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.672] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99a6ee1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99a9596, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.672] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.672] GetProcessHeap () returned 0xfd0000 [0174.672] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.672] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99b5942, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99ba75e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99ba75e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0174.672] GetProcessHeap () returned 0xfd0000 [0174.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99b5942, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99ba75e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99ba75e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0174.673] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99b5942, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99ba75e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99ba75e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.673] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99ba75e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99bce16, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.673] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99ba75e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99bce16, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d61948, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.673] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0174.673] GetProcessHeap () returned 0xfd0000 [0174.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.673] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99c43c1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99c6ab8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99c6ab8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0174.673] GetProcessHeap () returned 0xfd0000 [0174.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99c43c1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99c6ab8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99c6ab8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.674] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99c43c1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99c6ab8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99c6ab8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.674] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99c6ab8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99cb876, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d64057, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.674] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99c6ab8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99cb876, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d64057, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.674] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.674] GetProcessHeap () returned 0xfd0000 [0174.674] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.674] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99d2dfd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99da338, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99da338, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0174.674] GetProcessHeap () returned 0xfd0000 [0174.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99d2dfd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99da338, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99da338, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.675] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99d2dfd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99da338, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99da338, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.675] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99da338, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99dc9e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d64057, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.675] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99da338, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99dc9e6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d64057, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.675] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.675] GetProcessHeap () returned 0xfd0000 [0174.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.675] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99e668f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99e8d95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99e8d95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0174.696] GetProcessHeap () returned 0xfd0000 [0174.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99e668f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99e8d95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99e8d95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.712] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99e668f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99e8d95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99e8d95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.712] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe99e8d95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99eb446, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d64057, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.712] GetProcessHeap () returned 0xfd0000 [0174.712] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.713] GetProcessHeap () returned 0xfd0000 [0174.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99f29e3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99f7802, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99f7802, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0174.713] GetProcessHeap () returned 0xfd0000 [0174.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.713] GetProcessHeap () returned 0xfd0000 [0174.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a03b57, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a0897c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a0897c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.714] GetProcessHeap () returned 0xfd0000 [0174.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.714] GetProcessHeap () returned 0xfd0000 [0174.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a125bd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a173dc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a173dc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.715] GetProcessHeap () returned 0xfd0000 [0174.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.715] GetProcessHeap () returned 0xfd0000 [0174.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a2372d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a28553, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a28553, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.715] GetProcessHeap () returned 0xfd0000 [0174.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.715] GetProcessHeap () returned 0xfd0000 [0174.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a3e4d9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a45a0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a45a0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.716] GetProcessHeap () returned 0xfd0000 [0174.716] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.716] GetProcessHeap () returned 0xfd0000 [0174.716] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a56b8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a5929d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a5929d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.884] GetProcessHeap () returned 0xfd0000 [0174.884] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.884] GetProcessHeap () returned 0xfd0000 [0174.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a67d01, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a6cb23, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a6cb23, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.901] GetProcessHeap () returned 0xfd0000 [0174.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.901] GetProcessHeap () returned 0xfd0000 [0174.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a8039a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a851ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a851ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.902] GetProcessHeap () returned 0xfd0000 [0174.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.902] GetProcessHeap () returned 0xfd0000 [0174.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ad0cc4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ad5aed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ad5aed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.902] GetProcessHeap () returned 0xfd0000 [0174.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.903] GetProcessHeap () returned 0xfd0000 [0174.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9af2f88, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af56c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9af56c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.903] GetProcessHeap () returned 0xfd0000 [0174.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.903] GetProcessHeap () returned 0xfd0000 [0174.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b06824, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b08f4d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b08f4d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.904] GetProcessHeap () returned 0xfd0000 [0174.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.904] GetProcessHeap () returned 0xfd0000 [0174.904] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.904] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.904] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b23d1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b26356, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.904] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b23d1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b26356, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.904] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.905] GetProcessHeap () returned 0xfd0000 [0174.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.905] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0174.905] GetProcessHeap () returned 0xfd0000 [0174.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.905] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.905] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b34e78, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b39bd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.906] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b34e78, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b39bd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.906] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.906] GetProcessHeap () returned 0xfd0000 [0174.906] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.906] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0174.906] GetProcessHeap () returned 0xfd0000 [0174.906] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.906] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.906] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b4ae0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4d456, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.906] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b4ae0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4d456, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.906] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.906] GetProcessHeap () returned 0xfd0000 [0174.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.907] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0174.907] GetProcessHeap () returned 0xfd0000 [0174.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.907] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.907] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b6a9e4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6f736, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.907] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b6a9e4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6f736, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.907] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.907] GetProcessHeap () returned 0xfd0000 [0174.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.907] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0174.907] GetProcessHeap () returned 0xfd0000 [0174.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.908] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.908] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b85796, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b87dd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.908] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b85796, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b87dd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9d66764, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.908] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.908] GetProcessHeap () returned 0xfd0000 [0174.908] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.908] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0174.908] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.908] GetProcessHeap () returned 0xfd0000 [0174.908] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0174.908] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b99028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9b703, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b9b703, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0174.908] GetProcessHeap () returned 0xfd0000 [0174.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b99028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9b703, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b9b703, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.909] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b99028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9b703, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b9b703, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.909] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b9b703, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9dd66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x70ae2d00, ftLastWriteTime.dwHighDateTime=0x1d0f5f5, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0174.909] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b9b703, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9dd66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x70ae2d00, ftLastWriteTime.dwHighDateTime=0x1d0f5f5, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0174.909] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0174.909] GetProcessHeap () returned 0xfd0000 [0174.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0174.909] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b99028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9b703, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b9b703, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0174.909] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0174.909] GetProcessHeap () returned 0xfd0000 [0174.909] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0174.911] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe985d505, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4fc18fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0174.911] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.911] GetProcessHeap () returned 0xfd0000 [0174.911] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0174.912] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54e5c35e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf940c9ea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf940c9ea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0174.912] GetProcessHeap () returned 0xfd0000 [0174.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0174.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54e5c35e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf940c9ea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf940c9ea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0174.912] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54e5c35e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf940c9ea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf940c9ea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.912] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8263f62, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc5168ad8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_1", cAlternateFileName="")) returned 1 [0174.912] GetProcessHeap () returned 0xfd0000 [0174.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0174.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8263f62, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc5168ad8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0174.914] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8263f62, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc5168ad8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.914] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82702b3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8b402ad, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0174.914] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87e24c5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87e4a72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1 [0174.915] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87ec116, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87ebfa2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1 [0174.915] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87f3645, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87f5be2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1 [0174.915] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8266675, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87fd112, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b3184c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0174.915] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe88047bb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8806d52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1 [0174.915] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8279eee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d134c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d134c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0174.915] GetProcessHeap () returned 0xfd0000 [0174.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0174.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8279eee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d134c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d134c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0174.917] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8279eee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d134c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d134c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.918] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0174.918] GetProcessHeap () returned 0xfd0000 [0174.918] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.918] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe827ed1a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8283b3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.918] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8283b3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.919] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8283b3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8283b32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.919] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.919] GetProcessHeap () returned 0xfd0000 [0174.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.919] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0174.919] GetProcessHeap () returned 0xfd0000 [0174.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.920] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829259d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82973c2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.920] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82973c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.920] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82973c2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82973b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.920] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.920] GetProcessHeap () returned 0xfd0000 [0174.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.920] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0174.920] GetProcessHeap () returned 0xfd0000 [0174.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.921] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe829c1de, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e26, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82a5e26, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.921] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82a5e26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.921] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82a5e26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82a5e12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.921] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.921] GetProcessHeap () returned 0xfd0000 [0174.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.921] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1 [0174.921] GetProcessHeap () returned 0xfd0000 [0174.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.922] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82ad358, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa67, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82afa67, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.922] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82afa67, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.922] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82afa67, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82afa52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.922] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.922] GetProcessHeap () returned 0xfd0000 [0174.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.922] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0174.922] GetProcessHeap () returned 0xfd0000 [0174.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.923] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82b6f8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82b96a9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82b96a9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.923] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82b96a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82bbda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.923] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82b96a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82bbda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.923] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.923] GetProcessHeap () returned 0xfd0000 [0174.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.923] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0174.923] GetProcessHeap () returned 0xfd0000 [0174.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82cf641, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d4479, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82d4479, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82d4479, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d6b52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82d4479, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82d6b52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.924] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.924] GetProcessHeap () returned 0xfd0000 [0174.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.924] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0174.924] GetProcessHeap () returned 0xfd0000 [0174.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82db992, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e07b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82e07b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82e07b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e0792, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.925] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82e07b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82e0792, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.925] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.925] GetProcessHeap () returned 0xfd0000 [0174.925] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.925] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0174.925] GetProcessHeap () returned 0xfd0000 [0174.925] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0174.925] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82e7ce6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe82ef21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.925] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ef21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef1f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.925] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ef21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe82ef1f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.925] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0174.925] GetProcessHeap () returned 0xfd0000 [0174.925] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.925] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0174.925] GetProcessHeap () returned 0xfd0000 [0174.925] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.926] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe82f8e1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe830037f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe830037f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.926] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe830037f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8300362, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.926] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe830037f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8300362, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.927] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.927] GetProcessHeap () returned 0xfd0000 [0174.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.927] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0174.927] GetProcessHeap () returned 0xfd0000 [0174.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.927] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83114cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe831ff69, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe831ff69, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.927] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe831ff69, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8322642, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.927] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe831ff69, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8322642, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.927] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.927] GetProcessHeap () returned 0xfd0000 [0174.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.927] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0174.927] GetProcessHeap () returned 0xfd0000 [0174.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0174.929] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe832e9a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83385fe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83385fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.929] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83385fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe833d3f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.929] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83385fe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe833d3f2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.929] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0174.929] GetProcessHeap () returned 0xfd0000 [0174.929] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.929] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0174.929] GetProcessHeap () returned 0xfd0000 [0174.929] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.930] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8355ac3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6df, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe835f6df, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.930] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe835f6df, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.930] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe835f6df, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe835f6d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.930] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.930] GetProcessHeap () returned 0xfd0000 [0174.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.930] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0174.930] GetProcessHeap () returned 0xfd0000 [0174.930] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.931] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8372f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe837f2eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe837f2eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.931] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe837f2eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83819b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.931] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe837f2eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83819b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.931] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.931] GetProcessHeap () returned 0xfd0000 [0174.931] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.931] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0174.931] GetProcessHeap () returned 0xfd0000 [0174.931] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.932] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe839526d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839eec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe839eec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.932] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe839eec2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839ee72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.932] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe839eec2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe839ee72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.932] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.932] GetProcessHeap () returned 0xfd0000 [0174.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.932] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0174.933] GetProcessHeap () returned 0xfd0000 [0174.933] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.933] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83b0041, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83bea73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83bea73, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.933] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83bea73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83c1152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.933] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83bea73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83c1152, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.933] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.933] GetProcessHeap () returned 0xfd0000 [0174.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.933] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0174.933] GetProcessHeap () returned 0xfd0000 [0174.934] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.934] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83d2325, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d7144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83d7144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.934] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83d7144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d70e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.934] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83d7144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83d70e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b450e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.935] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.935] GetProcessHeap () returned 0xfd0000 [0174.935] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.935] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0174.935] GetProcessHeap () returned 0xfd0000 [0174.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.935] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe83ed0a8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6d0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe83f6d0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.936] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83f6d0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.936] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83f6d0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe83f6cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.936] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.936] GetProcessHeap () returned 0xfd0000 [0174.936] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.936] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0174.936] GetProcessHeap () returned 0xfd0000 [0174.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.936] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8407e91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841900b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe841900b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.936] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe841900b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841b6a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.936] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe841900b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe841b6a2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.936] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.937] GetProcessHeap () returned 0xfd0000 [0174.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0174.937] GetProcessHeap () returned 0xfd0000 [0174.937] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.937] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe842c878, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84316cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84316cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84316cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8433d42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.938] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84316cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8433d42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.938] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.938] GetProcessHeap () returned 0xfd0000 [0174.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.938] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0174.938] GetProcessHeap () returned 0xfd0000 [0174.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.938] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8449d3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c461, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe844c461, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.938] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe844c461, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c3e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.938] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe844c461, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe844c3e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.939] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.939] GetProcessHeap () returned 0xfd0000 [0174.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.939] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0174.939] GetProcessHeap () returned 0xfd0000 [0174.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.939] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8469926, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8470e5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8470e5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8470e5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8475bf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8470e5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8475bf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.940] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.940] GetProcessHeap () returned 0xfd0000 [0174.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0174.940] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0174.940] GetProcessHeap () returned 0xfd0000 [0174.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0174.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0174.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe848e306, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8493144, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8493144, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8493144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84930b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0174.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8493144, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84930b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0174.940] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0174.940] GetProcessHeap () returned 0xfd0000 [0174.941] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.100] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0175.116] GetProcessHeap () returned 0xfd0000 [0175.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.130] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe849cd83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a42bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84a42bb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.130] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84a42bb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a4222, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.130] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84a42bb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84a4222, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.130] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.130] GetProcessHeap () returned 0xfd0000 [0175.130] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.130] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0175.130] GetProcessHeap () returned 0xfd0000 [0175.130] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84b7b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8cb7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84c8cb7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84c8cb7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8c12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84c8cb7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84c8c12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.131] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.131] GetProcessHeap () returned 0xfd0000 [0175.131] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.131] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0175.131] GetProcessHeap () returned 0xfd0000 [0175.131] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84d9e2e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e1327, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84e1327, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84e1327, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e39c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.132] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84e1327, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84e39c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.132] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.133] GetProcessHeap () returned 0xfd0000 [0175.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.133] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0175.133] GetProcessHeap () returned 0xfd0000 [0175.133] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.134] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84f24cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7304, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe84f7304, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.134] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84f7304, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7242, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.134] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84f7304, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe84f7242, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.134] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.134] GetProcessHeap () returned 0xfd0000 [0175.134] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.134] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0175.134] GetProcessHeap () returned 0xfd0000 [0175.134] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.135] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe84fe7ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe850363d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe850363d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.135] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe850363d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8505ca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.135] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe850363d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8505ca2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b477f5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.135] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.135] GetProcessHeap () returned 0xfd0000 [0175.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.135] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0175.135] GetProcessHeap () returned 0xfd0000 [0175.135] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.135] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe851bce8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520b0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8520b0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.136] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8520b0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.136] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8520b0d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8520a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.136] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.137] GetProcessHeap () returned 0xfd0000 [0175.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.137] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0175.138] GetProcessHeap () returned 0xfd0000 [0175.138] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.138] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85406eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545507, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8545507, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.138] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8545507, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.139] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8545507, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8545442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.139] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.139] GetProcessHeap () returned 0xfd0000 [0175.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.139] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1 [0175.139] GetProcessHeap () returned 0xfd0000 [0175.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.139] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8558d8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dbac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe855dbac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.140] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe855dbac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dae2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.140] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe855dbac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe855dae2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.140] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.140] GetProcessHeap () returned 0xfd0000 [0175.140] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.140] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0175.140] GetProcessHeap () returned 0xfd0000 [0175.140] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.141] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85650da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85677ed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85677ed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.141] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85677ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8569e32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.141] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85677ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8569e32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.141] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.141] GetProcessHeap () returned 0xfd0000 [0175.141] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.141] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0175.141] GetProcessHeap () returned 0xfd0000 [0175.141] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0175.142] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe856ed1f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573b41, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8573b41, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.142] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8573b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573a72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.142] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8573b41, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8573a72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.142] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0175.142] GetProcessHeap () returned 0xfd0000 [0175.142] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.142] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0175.142] GetProcessHeap () returned 0xfd0000 [0175.142] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.143] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe857b070, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fe95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe857fe95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.143] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe857fe95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fdc2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.143] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe857fe95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe857fdc2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.143] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.143] GetProcessHeap () returned 0xfd0000 [0175.143] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.143] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85873c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe858e8f6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe858e8f6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0175.143] GetProcessHeap () returned 0xfd0000 [0175.143] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85873c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe858e8f6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe858e8f6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0175.145] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85873c7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe858e8f6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe858e8f6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.145] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe858e8f6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe858e822, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.145] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe858e8f6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe858e822, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.145] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0175.145] GetProcessHeap () returned 0xfd0000 [0175.145] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.145] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8595e28, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85a4892, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85a4892, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km", cAlternateFileName="")) returned 1 [0175.145] GetProcessHeap () returned 0xfd0000 [0175.145] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8595e28, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85a4892, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85a4892, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8595e28, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85a4892, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85a4892, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85a4892, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85a6ec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85a4892, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85a6ec2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.146] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.146] GetProcessHeap () returned 0xfd0000 [0175.146] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.146] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85b59fc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85ba821, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85ba821, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0175.146] GetProcessHeap () returned 0xfd0000 [0175.146] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85b59fc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85ba821, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85ba821, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85b59fc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85ba821, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85ba821, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85ba821, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85bce52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85ba821, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85bce52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.146] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.147] GetProcessHeap () returned 0xfd0000 [0175.147] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85c1d53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85c6b72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85c6b72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0175.147] GetProcessHeap () returned 0xfd0000 [0175.147] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85c1d53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85c6b72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85c6b72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.147] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85c1d53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85c6b72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85c6b72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.147] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85c6b72, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85c6a92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.147] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85c6b72, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85c6a92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.147] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.147] GetProcessHeap () returned 0xfd0000 [0175.147] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85ce0a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85d2ebd, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85d2ebd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lo", cAlternateFileName="")) returned 1 [0175.147] GetProcessHeap () returned 0xfd0000 [0175.147] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85ce0a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85d2ebd, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85d2ebd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85ce0a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85d2ebd, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85d2ebd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85d2ebd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85d2de2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.148] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85d2ebd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85d2de2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.148] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.148] GetProcessHeap () returned 0xfd0000 [0175.148] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.148] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85da3f8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85e1930, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85e1930, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0175.148] GetProcessHeap () returned 0xfd0000 [0175.148] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85da3f8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85e1930, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85e1930, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.149] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85da3f8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85e1930, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85e1930, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.149] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85e1930, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85e1842, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.149] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85e1930, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85e1842, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b49f04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.149] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.149] GetProcessHeap () returned 0xfd0000 [0175.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.149] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85e8e5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85eb5c9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85eb5c9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0175.150] GetProcessHeap () returned 0xfd0000 [0175.150] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85e8e5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85eb5c9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85eb5c9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.150] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85e8e5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85eb5c9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe85eb5c9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.150] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85eb5c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85edb92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.150] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85eb5c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe85edb92, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.150] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.150] GetProcessHeap () returned 0xfd0000 [0175.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.150] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86014fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8608a39, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8608a39, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0175.150] GetProcessHeap () returned 0xfd0000 [0175.150] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86014fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8608a39, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8608a39, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.150] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86014fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8608a39, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8608a39, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.150] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8608a39, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8608942, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.151] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8608a39, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8608942, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.151] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.151] GetProcessHeap () returned 0xfd0000 [0175.151] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.151] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe861749a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8619ba9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8619ba9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0175.151] GetProcessHeap () returned 0xfd0000 [0175.151] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe861749a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8619ba9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8619ba9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.151] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe861749a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8619ba9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8619ba9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.151] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8619ba9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe861c1c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.151] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8619ba9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe861c1c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.151] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.152] GetProcessHeap () returned 0xfd0000 [0175.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.152] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86237ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe862ad20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe862ad20, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0175.152] GetProcessHeap () returned 0xfd0000 [0175.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86237ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe862ad20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe862ad20, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.152] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86237ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe862ad20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe862ad20, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.152] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe862ad20, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe862ac22, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.152] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe862ad20, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe862ac22, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.152] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.152] GetProcessHeap () returned 0xfd0000 [0175.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.152] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8632242, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8637077, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8637077, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0175.152] GetProcessHeap () returned 0xfd0000 [0175.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8632242, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8637077, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8637077, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.153] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8632242, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8637077, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8637077, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.153] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8634961, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8636f72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.153] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8634961, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8636f72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.153] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.153] GetProcessHeap () returned 0xfd0000 [0175.153] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.153] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe863e5a6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8640cb8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8640cb8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne", cAlternateFileName="")) returned 1 [0175.153] GetProcessHeap () returned 0xfd0000 [0175.153] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe863e5a6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8640cb8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8640cb8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0175.153] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe863e5a6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8640cb8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8640cb8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.154] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8640cb8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8640bb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.154] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8640cb8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8640bb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.154] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0175.154] GetProcessHeap () returned 0xfd0000 [0175.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.154] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86481e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8656c48, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8656c48, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0175.154] GetProcessHeap () returned 0xfd0000 [0175.154] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86481e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8656c48, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8656c48, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.154] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86481e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8656c48, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8656c48, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.154] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8656c48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8656b42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.154] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8656c48, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8656b42, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.154] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.154] GetProcessHeap () returned 0xfd0000 [0175.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.155] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8660880, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8667dbb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8667dbb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0175.155] GetProcessHeap () returned 0xfd0000 [0175.155] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8660880, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8667dbb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8667dbb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.155] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8660880, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8667dbb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8667dbb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.155] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8667dbb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8667cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.155] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8667dbb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8667cb2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.155] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.156] GetProcessHeap () returned 0xfd0000 [0175.156] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.156] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8674112, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8676822, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8676822, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0175.156] GetProcessHeap () returned 0xfd0000 [0175.156] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8674112, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8676822, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8676822, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.156] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8674112, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8676822, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8676822, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.156] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8676822, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8678e22, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.156] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8676822, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8678e22, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.156] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.156] GetProcessHeap () returned 0xfd0000 [0175.156] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.156] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe867dd53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8682b76, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8682b76, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0175.156] GetProcessHeap () returned 0xfd0000 [0175.156] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe867dd53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8682b76, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8682b76, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.157] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe867dd53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8682b76, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8682b76, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.157] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8682b76, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8685172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.157] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8682b76, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8685172, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.157] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.157] GetProcessHeap () returned 0xfd0000 [0175.157] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.157] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe868eeca, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8693cf9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8693cf9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0175.157] GetProcessHeap () returned 0xfd0000 [0175.157] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe868eeca, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8693cf9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8693cf9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.158] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe868eeca, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8693cf9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8693cf9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.158] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8693cf9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86962e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.158] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8693cf9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86962e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4c617, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.158] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.158] GetProcessHeap () returned 0xfd0000 [0175.158] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.158] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86a2743, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86a7572, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86a7572, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0175.158] GetProcessHeap () returned 0xfd0000 [0175.158] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86a2743, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86a7572, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86a7572, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.159] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86a2743, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86a7572, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86a7572, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86a7572, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86a9b62, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86a7572, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86a9b62, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.159] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.159] GetProcessHeap () returned 0xfd0000 [0175.159] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86b11a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86b5fd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86b5fd6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0175.159] GetProcessHeap () returned 0xfd0000 [0175.159] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86b11a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86b5fd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86b5fd6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.159] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86b11a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86b5fd6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86b5fd6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86b5fd6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86b85c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.160] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86b5fd6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86b85c2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.160] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.160] GetProcessHeap () returned 0xfd0000 [0175.160] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.160] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86bfc14, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86c7149, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86c7149, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0175.160] GetProcessHeap () returned 0xfd0000 [0175.160] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86bfc14, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86c7149, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86c7149, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.160] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86bfc14, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86c7149, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86c7149, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.160] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86c7149, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86c9732, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.161] GetProcessHeap () returned 0xfd0000 [0175.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.161] GetProcessHeap () returned 0xfd0000 [0175.161] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86d0d8b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86d349d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86d349d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.161] GetProcessHeap () returned 0xfd0000 [0175.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.161] GetProcessHeap () returned 0xfd0000 [0175.161] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86dd0c3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86e1f01, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86e1f01, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.162] GetProcessHeap () returned 0xfd0000 [0175.162] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.162] GetProcessHeap () returned 0xfd0000 [0175.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe86fa5a6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe86fccb9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe86fccb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.163] GetProcessHeap () returned 0xfd0000 [0175.163] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.163] GetProcessHeap () returned 0xfd0000 [0175.163] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8709007, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe870b716, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe870b716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.164] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8709007, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe870b716, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe870b716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.164] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe870b716, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe870dcf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.164] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe870b716, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe870dcf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.164] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.164] GetProcessHeap () returned 0xfd0000 [0175.164] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.164] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8717a6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe871c890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe871c890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0175.164] GetProcessHeap () returned 0xfd0000 [0175.164] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8717a6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe871c890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe871c890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.165] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8717a6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe871c890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe871c890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.165] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe871c890, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe871ee62, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.165] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe871c890, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe871ee62, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.165] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.165] GetProcessHeap () returned 0xfd0000 [0175.165] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.165] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8728be1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe872b2f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe872b2f0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0175.165] GetProcessHeap () returned 0xfd0000 [0175.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8728be1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe872b2f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe872b2f0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0175.166] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8728be1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe872b2f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe872b2f0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.166] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe872b2f0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87326e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.166] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe872b2f0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87326e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b4ed3c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.166] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0175.166] GetProcessHeap () returned 0xfd0000 [0175.166] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.166] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe873eb6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8743999, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8743999, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0175.166] GetProcessHeap () returned 0xfd0000 [0175.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe873eb6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8743999, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8743999, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.166] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe873eb6d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8743999, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8743999, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.166] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8743999, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8745f62, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.166] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8743999, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8745f62, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.166] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.167] GetProcessHeap () returned 0xfd0000 [0175.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.167] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe874d5da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe874fced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe874fced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0175.167] GetProcessHeap () returned 0xfd0000 [0175.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe874d5da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe874fced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe874fced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0175.167] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe874d5da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe874fced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe874fced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe874fced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87522b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe874fced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87522b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.168] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0175.168] GetProcessHeap () returned 0xfd0000 [0175.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe875c028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8760e60, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8760e60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0175.168] GetProcessHeap () returned 0xfd0000 [0175.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe875c028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8760e60, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8760e60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.168] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe875c028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8760e60, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8760e60, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8760e60, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8760d12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8760e60, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8760d12, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.168] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.168] GetProcessHeap () returned 0xfd0000 [0175.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe876d19b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8771fd3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8771fd3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0175.169] GetProcessHeap () returned 0xfd0000 [0175.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe876d19b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8771fd3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8771fd3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0175.169] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe876d19b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8771fd3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8771fd3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8771fd3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8771e82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8771fd3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8771e82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.169] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0175.169] GetProcessHeap () returned 0xfd0000 [0175.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe877bc0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8780a3a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8780a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1 [0175.169] GetProcessHeap () returned 0xfd0000 [0175.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe877bc0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8780a3a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8780a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.169] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe877bc0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8780a3a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8780a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8780a3a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87808e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8780a3a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87808e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.170] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.170] GetProcessHeap () returned 0xfd0000 [0175.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe878a67b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8791bad, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8791bad, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0175.170] GetProcessHeap () returned 0xfd0000 [0175.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe878a67b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8791bad, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8791bad, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.170] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe878a67b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8791bad, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8791bad, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8791bad, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8791a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8791bad, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8791a52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.170] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.170] GetProcessHeap () returned 0xfd0000 [0175.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe879b7e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87a0611, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87a0611, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0175.344] GetProcessHeap () returned 0xfd0000 [0175.344] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe879b7e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87a0611, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87a0611, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.352] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe879b7e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87a0611, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87a0611, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87a0611, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87a04b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87a0611, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87a04b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.359] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.366] GetProcessHeap () returned 0xfd0000 [0175.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.372] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87b1784, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87b65a7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87b65a7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_HK", cAlternateFileName="")) returned 1 [0175.375] GetProcessHeap () returned 0xfd0000 [0175.375] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87b1784, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87b65a7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87b65a7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0175.376] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87b1784, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87b65a7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87b65a7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.376] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87b65a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87b6442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.376] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87b65a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87b6442, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.376] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0175.376] GetProcessHeap () returned 0xfd0000 [0175.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.376] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87c01e8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87c28fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87c28fb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0175.376] GetProcessHeap () returned 0xfd0000 [0175.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87c01e8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87c28fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87c28fb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.377] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87c01e8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87c28fb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87c28fb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.377] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87c28fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87c75b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.377] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87c28fb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87c75b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8b51436, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.377] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.377] GetProcessHeap () returned 0xfd0000 [0175.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.377] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87cec26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d8890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d8890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 1 [0175.377] GetProcessHeap () returned 0xfd0000 [0175.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87cec26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d8890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d8890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.378] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87cec26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d8890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d8890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.378] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87d8890, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87dae32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.378] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe87d8890, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87dae32, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.378] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0175.378] GetProcessHeap () returned 0xfd0000 [0175.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.378] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe87cec26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe87d8890, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe87d8890, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 0 [0175.378] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0175.378] GetProcessHeap () returned 0xfd0000 [0175.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0175.378] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8813228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe881592f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe881592f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0175.378] GetProcessHeap () returned 0xfd0000 [0175.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0175.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8813228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe881592f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bb07be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.379] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8813228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe881592f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bb07be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.379] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8bb07be, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8bb07be, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8bb07be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0175.379] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe881592f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe88157b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0175.379] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe881592f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe88157b2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1981d900, ftLastWriteTime.dwHighDateTime=0x1d17872, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0175.379] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0175.379] GetProcessHeap () returned 0xfd0000 [0175.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0175.379] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8813228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe881592f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe881592f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0175.379] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.379] GetProcessHeap () returned 0xfd0000 [0175.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0175.381] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8263f62, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc5168ad8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8b429cf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_1", cAlternateFileName="")) returned 0 [0175.381] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0175.381] GetProcessHeap () returned 0xfd0000 [0175.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0175.382] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542fb674, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542fb674, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542fb674, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1 [0175.382] GetProcessHeap () returned 0xfd0000 [0175.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0175.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542fb674, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542fb674, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542fb674, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0175.382] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542fb674, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542fb674, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542fb674, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.382] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5399b568, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc54097cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53f878d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.3_0", cAlternateFileName="100~1.3_0")) returned 1 [0175.382] GetProcessHeap () returned 0xfd0000 [0175.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0175.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5399b568, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc54097cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53f878d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0175.402] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5399b568, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc54097cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53f878d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.402] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53da6913, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53db0410, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x83983900, ftLastWriteTime.dwHighDateTime=0x1d31a7a, nFileSizeHigh=0x0, nFileSizeLow=0x2b665, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 1 [0175.403] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dbef9d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e31a60, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7da25800, ftLastWriteTime.dwHighDateTime=0x1d31a7a, nFileSizeHigh=0x0, nFileSizeLow=0x3cac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 1 [0175.403] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53e84bdf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e90f40, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53e90f40, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0175.403] GetProcessHeap () returned 0xfd0000 [0175.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0175.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\css\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53e84bdf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e90f40, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53e90f40, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0175.403] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53e84bdf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e90f40, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53e90f40, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e90f40, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e9aa10, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1acc1600, ftLastWriteTime.dwHighDateTime=0x1cec347, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e90f40, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53e9aa10, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1acc1600, ftLastWriteTime.dwHighDateTime=0x1cec347, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0 [0175.404] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0175.404] GetProcessHeap () returned 0xfd0000 [0175.404] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53eabcf0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53eae409, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53eae409, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="html", cAlternateFileName="")) returned 1 [0175.404] GetProcessHeap () returned 0xfd0000 [0175.404] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0175.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\html\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53eabcf0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53eae409, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53eae409, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0175.404] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53eabcf0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53eae409, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53eae409, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eae409, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53eb57c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1 [0175.405] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eae409, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53eb57c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0 [0175.405] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0175.405] GetProcessHeap () returned 0xfd0000 [0175.405] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0175.405] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ec1c80, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542e7dd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542e7dd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0175.405] GetProcessHeap () returned 0xfd0000 [0175.405] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0175.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\images\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ec1c80, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542e7dd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542e7dd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0175.406] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ec1c80, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542e7dd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542e7dd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.406] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ec91b5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ed0570, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="flapper.gif", cAlternateFileName="")) returned 1 [0175.406] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53edca45, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542e7dd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542e7dd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef29db, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x542e7dd8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542e7dd8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f0143f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f060d0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f0d7a9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f31ff0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3bdd0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f40a50, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f4811e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f4f4b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f5b9ab, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f60620, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f5b9ab, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f60620, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xf57c5500, ftLastWriteTime.dwHighDateTime=0x1ce9361, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0175.407] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0175.408] GetProcessHeap () returned 0xfd0000 [0175.408] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0175.408] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539a78ad, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f765b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542e08b5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0175.408] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539fa8e3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d84635, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d84635, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0175.408] GetProcessHeap () returned 0xfd0000 [0175.408] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0175.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539fa8e3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d84635, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d84635, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0175.410] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539fa8e3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d84635, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d84635, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.410] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a10854, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a15699, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a15699, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0175.410] GetProcessHeap () returned 0xfd0000 [0175.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a10854, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a15699, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a15699, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.411] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a10854, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a15699, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a15699, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53a15699, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a2b600, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53a15699, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a2b600, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.411] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.411] GetProcessHeap () returned 0xfd0000 [0175.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a57552, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a5c375, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a5c375, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0175.411] GetProcessHeap () returned 0xfd0000 [0175.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a57552, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a5c375, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a5c375, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.411] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a57552, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a5c375, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a5c375, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53a5c375, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a63870, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53a5c375, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a63870, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.412] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.412] GetProcessHeap () returned 0xfd0000 [0175.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.412] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a79824, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a7e650, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a7e650, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0175.412] GetProcessHeap () returned 0xfd0000 [0175.412] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a79824, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a7e650, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a7e650, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.413] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a79824, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a7e650, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53a7e650, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53a7e650, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a8a970, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53a7e650, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53a8a970, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.413] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.415] GetProcessHeap () returned 0xfd0000 [0175.415] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aa094d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53aacc98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53aacc98, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0175.415] GetProcessHeap () returned 0xfd0000 [0175.415] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aa094d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53aacc98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53aacc98, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.415] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aa094d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53aacc98, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53aacc98, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53aacc98, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ab4180, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53aacc98, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ab4180, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.415] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.415] GetProcessHeap () returned 0xfd0000 [0175.415] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53acef89, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ad3dac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ad3dac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0175.416] GetProcessHeap () returned 0xfd0000 [0175.416] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53acef89, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ad3dac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ad3dac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0175.416] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53acef89, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ad3dac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ad3dac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.416] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ad3dac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53add990, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.416] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ad3dac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53add990, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ea500, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.416] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0175.416] GetProcessHeap () returned 0xfd0000 [0175.417] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.417] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aeeb5e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53af3974, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53af3974, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0175.417] GetProcessHeap () returned 0xfd0000 [0175.417] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aeeb5e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53af3974, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53af3974, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.417] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aeeb5e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53af3974, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53af3974, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53af3974, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53afd560, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53af3974, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53afd560, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.418] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.418] GetProcessHeap () returned 0xfd0000 [0175.418] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b13559, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b15c6b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b15c6b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0175.418] GetProcessHeap () returned 0xfd0000 [0175.418] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b13559, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b15c6b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b15c6b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0175.419] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b13559, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b15c6b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b15c6b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b15c6b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b29480, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b15c6b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b29480, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.419] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0175.419] GetProcessHeap () returned 0xfd0000 [0175.419] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b3cd6c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b68ca2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b68ca2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0175.419] GetProcessHeap () returned 0xfd0000 [0175.419] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\en_GB\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b3cd6c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b68ca2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b68ca2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.419] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b3cd6c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b68ca2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b68ca2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b68ca2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b68c20, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b68ca2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b68c20, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.420] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.420] GetProcessHeap () returned 0xfd0000 [0175.420] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b77706, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b7ec38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b7ec38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0175.420] GetProcessHeap () returned 0xfd0000 [0175.420] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b77706, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b7ec38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b7ec38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.420] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b77706, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b7ec38, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b7ec38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b7ec38, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b7ebb0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b7ec38, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b7ebb0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.420] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.420] GetProcessHeap () returned 0xfd0000 [0175.420] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b8af8d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b924bf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b924bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0175.421] GetProcessHeap () returned 0xfd0000 [0175.421] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\es_419\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b8af8d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b924bf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b924bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.421] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b8af8d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b924bf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b924bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.421] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b924bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b92430, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.421] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b924bf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53b92430, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.421] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.421] GetProcessHeap () returned 0xfd0000 [0175.421] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.421] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53bea31b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bef125, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53bef125, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0175.421] GetProcessHeap () returned 0xfd0000 [0175.421] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\et\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53bea31b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bef125, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53bef125, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0175.421] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53bea31b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bef125, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53bef125, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.421] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bef125, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bef090, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.422] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bef125, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bef090, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ecc16, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.422] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0175.422] GetProcessHeap () returned 0xfd0000 [0175.422] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.422] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53bf666c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bfb485, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53bfb485, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0175.422] GetProcessHeap () returned 0xfd0000 [0175.422] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53bf666c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bfb485, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53bfb485, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.422] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53bf666c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bfb485, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53bfb485, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.422] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bfb485, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bfb3e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.423] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bfb485, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53bfb3e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.423] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.423] GetProcessHeap () returned 0xfd0000 [0175.423] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.423] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c029c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c077e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c077e0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0175.423] GetProcessHeap () returned 0xfd0000 [0175.423] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c029c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c077e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c077e0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.423] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c029c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c077e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c077e0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.423] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c077e0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c07730, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.423] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c077e0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c07730, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.423] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.423] GetProcessHeap () returned 0xfd0000 [0175.423] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.423] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c0ed0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c13b35, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c13b35, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0175.423] GetProcessHeap () returned 0xfd0000 [0175.424] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c0ed0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c13b35, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c13b35, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.424] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c0ed0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c13b35, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c13b35, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.424] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c13b35, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c13a80, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.424] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c13b35, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c13a80, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.424] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.424] GetProcessHeap () returned 0xfd0000 [0175.424] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.425] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c1b064, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c1d77a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c1d77a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0175.425] GetProcessHeap () returned 0xfd0000 [0175.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c1b064, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c1d77a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c1d77a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0175.425] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c1b064, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c1d77a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c1d77a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.425] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c1d77a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c1fdd0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.425] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c1d77a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c1fdd0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.425] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0175.425] GetProcessHeap () returned 0xfd0000 [0175.425] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.425] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c273bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c2c1db, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c2c1db, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0175.425] GetProcessHeap () returned 0xfd0000 [0175.425] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c273bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c2c1db, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c2c1db, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.426] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c273bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c2c1db, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c2c1db, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.426] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c2c1db, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c2c120, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.426] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c2c1db, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c2c120, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.426] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.426] GetProcessHeap () returned 0xfd0000 [0175.426] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.426] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c35e19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c3852f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c3852f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0175.426] GetProcessHeap () returned 0xfd0000 [0175.426] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c35e19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c3852f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c3852f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.427] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c35e19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c3852f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c3852f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.427] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c3852f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c38470, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.427] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c3852f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c38470, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.427] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.427] GetProcessHeap () returned 0xfd0000 [0175.427] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.427] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c3fa5e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c44884, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c44884, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0175.427] GetProcessHeap () returned 0xfd0000 [0175.427] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c3fa5e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c44884, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c44884, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.428] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c3fa5e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c44884, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c44884, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.428] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c44884, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c447c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.428] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c44884, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c447c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542ef329, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.428] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.428] GetProcessHeap () returned 0xfd0000 [0175.428] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.428] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c4e4c5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c50bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c50bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0175.428] GetProcessHeap () returned 0xfd0000 [0175.428] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c4e4c5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c50bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c50bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.428] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c4e4c5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c50bdb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c50bdb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.429] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c50bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c53220, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.429] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c50bdb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c53220, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.429] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.429] GetProcessHeap () returned 0xfd0000 [0175.429] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.429] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c5a81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c5cf2a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c5cf2a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0175.429] GetProcessHeap () returned 0xfd0000 [0175.429] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c5a81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c5cf2a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c5cf2a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0175.430] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c5a81a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c5cf2a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c5cf2a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.430] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c5cf2a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c5f570, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.430] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c5cf2a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c5f570, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.430] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0175.430] GetProcessHeap () returned 0xfd0000 [0175.430] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.430] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c66b68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c69272, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c69272, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0175.430] GetProcessHeap () returned 0xfd0000 [0175.430] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c66b68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c69272, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c69272, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0175.430] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c66b68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c69272, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c69272, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.430] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c69272, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c6b8c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c69272, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c6b8c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.431] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0175.431] GetProcessHeap () returned 0xfd0000 [0175.431] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c707ad, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c755c6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c755c6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0175.431] GetProcessHeap () returned 0xfd0000 [0175.431] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c707ad, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c755c6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c755c6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0175.431] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c707ad, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c755c6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c755c6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c755c6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c75500, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c755c6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c75500, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.431] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0175.431] GetProcessHeap () returned 0xfd0000 [0175.431] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c81924, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c8675f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c8675f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0175.431] GetProcessHeap () returned 0xfd0000 [0175.431] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c81924, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c8675f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c8675f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0175.432] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c81924, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c8675f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c8675f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.432] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c8675f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c86670, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0175.432] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c8675f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c86670, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0175.432] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0175.432] GetProcessHeap () returned 0xfd0000 [0175.432] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0175.523] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c8dc75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c92a9e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c92a9e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0175.523] GetProcessHeap () returned 0xfd0000 [0175.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0175.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c8dc75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c92a9e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c92a9e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0176.034] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c8dc75, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c92a9e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c92a9e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.034] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c90388, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c929c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.034] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c90388, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c929c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.034] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0176.034] GetProcessHeap () returned 0xfd0000 [0176.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.034] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c99fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c9c6dd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c9c6dd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0176.034] GetProcessHeap () returned 0xfd0000 [0176.034] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c99fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c9c6dd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c9c6dd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0176.034] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53c99fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c9c6dd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53c9c6dd, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.035] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9c6dd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c9ed10, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.035] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9c6dd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53c9ed10, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f1a38, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.035] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0176.035] GetProcessHeap () returned 0xfd0000 [0176.035] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.035] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ca3bff, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cab13b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cab13b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0176.035] GetProcessHeap () returned 0xfd0000 [0176.035] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ca3bff, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cab13b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cab13b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.036] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ca3bff, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cab13b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cab13b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.036] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cab13b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cab060, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.036] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cab13b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cab060, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.036] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.036] GetProcessHeap () returned 0xfd0000 [0176.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.036] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cb2673, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cb4d83, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cb4d83, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0176.036] GetProcessHeap () returned 0xfd0000 [0176.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cb2673, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cb4d83, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cb4d83, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.036] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cb2673, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cb4d83, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cb4d83, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.036] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cb4d83, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cb73b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.037] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cb4d83, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cb73b0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.037] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.037] GetProcessHeap () returned 0xfd0000 [0176.037] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.037] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cbe9c4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cc37ea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cc37ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0176.037] GetProcessHeap () returned 0xfd0000 [0176.037] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cbe9c4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cc37ea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cc37ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.037] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cbe9c4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cc37ea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cc37ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.037] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cc37ea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cc3700, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.037] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cc37ea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cc3700, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.037] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.037] GetProcessHeap () returned 0xfd0000 [0176.037] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.037] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ccad19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ccfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ccfb3e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0176.038] GetProcessHeap () returned 0xfd0000 [0176.038] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ccad19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ccfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ccfb3e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.038] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ccad19, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ccfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ccfb3e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.038] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ccfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ccfa50, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.038] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ccfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ccfa50, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f4148, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.038] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.038] GetProcessHeap () returned 0xfd0000 [0176.038] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.038] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cd706d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cd9780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cd9780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0176.039] GetProcessHeap () returned 0xfd0000 [0176.039] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cd706d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cd9780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cd9780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.039] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cd706d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cd9780, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cd9780, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.039] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cd9780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cdbda0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.039] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cd9780, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cdbda0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.045] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.045] GetProcessHeap () returned 0xfd0000 [0176.045] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.045] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ce0ca9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ce5ac5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ce5ac5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0176.045] GetProcessHeap () returned 0xfd0000 [0176.045] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ce0ca9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ce5ac5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ce5ac5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.046] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53ce0ca9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ce5ac5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53ce5ac5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.046] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ce5ac5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ce59e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.046] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ce5ac5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53ce59e0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.046] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.046] GetProcessHeap () returned 0xfd0000 [0176.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.046] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cef720, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cf4536, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cf4536, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0176.046] GetProcessHeap () returned 0xfd0000 [0176.046] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cef720, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cf4536, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cf4536, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.046] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cef720, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cf4536, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53cf4536, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.046] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cf4536, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cf4440, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.046] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cf4536, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53cf4440, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.047] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.047] GetProcessHeap () returned 0xfd0000 [0176.047] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.047] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cfba68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0088a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d0088a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0176.047] GetProcessHeap () returned 0xfd0000 [0176.047] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cfba68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0088a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d0088a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.047] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53cfba68, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0088a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d0088a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.048] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d0088a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d00790, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.048] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d0088a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d00790, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.048] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.048] GetProcessHeap () returned 0xfd0000 [0176.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.048] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d07db6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0a4cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d0a4cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0176.048] GetProcessHeap () returned 0xfd0000 [0176.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d07db6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0a4cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d0a4cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.048] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d07db6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0a4cc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d0a4cc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.048] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d0a4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0cae0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.048] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d0a4cc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d0cae0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.049] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.049] GetProcessHeap () returned 0xfd0000 [0176.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.049] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d1410e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d18f33, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d18f33, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0176.049] GetProcessHeap () returned 0xfd0000 [0176.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d1410e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d18f33, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d18f33, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.049] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d1410e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d18f33, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d18f33, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.049] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d18f33, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d18e30, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.049] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d18f33, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d18e30, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f6858, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.049] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.049] GetProcessHeap () returned 0xfd0000 [0176.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.049] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d22b72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d27997, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d27997, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0176.049] GetProcessHeap () returned 0xfd0000 [0176.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d22b72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d27997, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d27997, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.050] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d22b72, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d27997, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d27997, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.050] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d27997, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d27890, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.050] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d27997, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d27890, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.050] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.051] GetProcessHeap () returned 0xfd0000 [0176.051] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.051] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d2eec6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d315d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d315d6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0176.051] GetProcessHeap () returned 0xfd0000 [0176.051] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d2eec6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d315d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d315d6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.051] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d2eec6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d315d6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d315d6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.051] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d315d6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d314d0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.051] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d315d6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d314d0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.051] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.051] GetProcessHeap () returned 0xfd0000 [0176.051] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.051] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d38b0b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d4c38f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d4c38f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0176.051] GetProcessHeap () returned 0xfd0000 [0176.051] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d38b0b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d4c38f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d4c38f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.052] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d38b0b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d4c38f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d4c38f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.052] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d4c38f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d4c280, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.052] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d4c38f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d4c280, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.052] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.052] GetProcessHeap () returned 0xfd0000 [0176.052] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.052] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d62328, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d6713b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d6713b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0176.053] GetProcessHeap () returned 0xfd0000 [0176.053] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d62328, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d6713b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d6713b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.053] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d62328, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d6713b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d6713b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.053] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d6713b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d6e560, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.053] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d6713b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d6e560, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.053] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.053] GetProcessHeap () returned 0xfd0000 [0176.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.053] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d84635, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d8944e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d8944e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0176.053] GetProcessHeap () returned 0xfd0000 [0176.053] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d84635, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d8944e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d8944e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.053] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d84635, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d8944e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d8944e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.054] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d8944e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d95660, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.054] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d8944e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d95660, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x542f8f6a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.054] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.054] GetProcessHeap () returned 0xfd0000 [0176.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.054] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d84635, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53d8944e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d8944e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0176.054] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.054] GetProcessHeap () returned 0xfd0000 [0176.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0176.054] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53f878d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f89fe7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53f89fe7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0176.054] GetProcessHeap () returned 0xfd0000 [0176.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0176.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.3_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53f878d4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x53f89fe7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53f89fe7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.055] GetProcessHeap () returned 0xfd0000 [0176.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0176.055] GetProcessHeap () returned 0xfd0000 [0176.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0176.056] GetProcessHeap () returned 0xfd0000 [0176.056] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0176.057] GetProcessHeap () returned 0xfd0000 [0176.057] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0176.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53e4c96b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf9458ec6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf9458ec6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.058] GetProcessHeap () returned 0xfd0000 [0176.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0176.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8d6a680, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc571c6f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe90f4380, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0176.060] GetProcessHeap () returned 0xfd0000 [0176.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0176.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8d9dadd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e65e31, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e65e31, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.084] GetProcessHeap () returned 0xfd0000 [0176.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e573ce, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f615e3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f615e3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0176.085] GetProcessHeap () returned 0xfd0000 [0176.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.085] GetProcessHeap () returned 0xfd0000 [0176.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e525ab, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f5a0a5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f5a0a5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.085] GetProcessHeap () returned 0xfd0000 [0176.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.085] GetProcessHeap () returned 0xfd0000 [0176.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd3646, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ea7cf2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ea7cf2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.087] GetProcessHeap () returned 0xfd0000 [0176.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.087] GetProcessHeap () returned 0xfd0000 [0176.087] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8daec53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e76fa8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e76fa8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.089] GetProcessHeap () returned 0xfd0000 [0176.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.089] GetProcessHeap () returned 0xfd0000 [0176.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e48961, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f4b64d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f4b64d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.090] GetProcessHeap () returned 0xfd0000 [0176.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.090] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dc9a0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e9b991, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e9b991, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0176.090] GetProcessHeap () returned 0xfd0000 [0176.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dc9a0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e9b991, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e9b991, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.091] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dc9a0b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e9b991, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e9b991, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.091] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e9b991, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e9e05c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.091] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e9b991, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e9e05c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.091] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.091] GetProcessHeap () returned 0xfd0000 [0176.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.091] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dfce5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ee4d94, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ee4d94, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0176.092] GetProcessHeap () returned 0xfd0000 [0176.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dfce5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ee4d94, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ee4d94, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.605] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dfce5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ee4d94, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ee4d94, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.605] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ee4d94, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ee4d2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.605] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ee4d94, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ee4d2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.612] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.612] GetProcessHeap () returned 0xfd0000 [0176.612] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.619] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e3ed25, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f4411c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f4411c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0176.625] GetProcessHeap () returned 0xfd0000 [0176.625] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e3ed25, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f4411c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f4411c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.632] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e3ed25, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f4411c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f4411c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.633] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f4411c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f4409c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.634] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f4411c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f4409c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.634] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.634] GetProcessHeap () returned 0xfd0000 [0176.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.634] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8db8895, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e859ff, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e859ff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0176.634] GetProcessHeap () returned 0xfd0000 [0176.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8db8895, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e859ff, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e859ff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.634] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8db8895, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e859ff, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e859ff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.634] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e859ff, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e859bc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.634] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e859ff, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e859bc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.634] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.634] GetProcessHeap () returned 0xfd0000 [0176.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.634] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8df3220, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ed3c20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ed3c20, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0176.634] GetProcessHeap () returned 0xfd0000 [0176.635] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8df3220, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ed3c20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ed3c20, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.635] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8df3220, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ed3c20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ed3c20, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.635] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ed3c20, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ed62cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.635] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ed3c20, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ed62cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.635] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0176.635] GetProcessHeap () returned 0xfd0000 [0176.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.635] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e1f145, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f15ad8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f15ad8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0176.636] GetProcessHeap () returned 0xfd0000 [0176.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e1f145, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f15ad8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f15ad8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.636] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e1f145, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f15ad8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f15ad8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.636] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f15ad8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f15a6c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.636] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f15ad8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f15a6c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.636] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.636] GetProcessHeap () returned 0xfd0000 [0176.637] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.637] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd846c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eaf21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eaf21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0176.637] GetProcessHeap () returned 0xfd0000 [0176.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd846c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eaf21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eaf21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.637] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd846c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eaf21b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eaf21b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.637] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eaf21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eaf1cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.637] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eaf21b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eaf1cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f6ab2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.637] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.637] GetProcessHeap () returned 0xfd0000 [0176.637] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.637] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8da9e34, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e72186, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e72186, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0176.637] GetProcessHeap () returned 0xfd0000 [0176.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8da9e34, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e72186, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e72186, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.638] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8da9e34, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e72186, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e72186, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.638] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e72186, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e7213c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.638] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e72186, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e7213c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.638] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.638] GetProcessHeap () returned 0xfd0000 [0176.638] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.638] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dfa723, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8edd862, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8edd862, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0176.638] GetProcessHeap () returned 0xfd0000 [0176.638] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dfa723, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8edd862, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8edd862, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.638] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dfa723, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8edd862, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8edd862, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.638] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8edd862, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8edd7fc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.638] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8edd862, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8edd7fc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.639] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.639] GetProcessHeap () returned 0xfd0000 [0176.639] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.639] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8db3a75, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e7e4d7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e7e4d7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0176.639] GetProcessHeap () returned 0xfd0000 [0176.639] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8db3a75, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e7e4d7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e7e4d7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.639] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8db3a75, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e7e4d7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e7e4d7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.639] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e7e4d7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e80b9c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.639] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e7e4d7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e80b9c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.639] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.639] GetProcessHeap () returned 0xfd0000 [0176.639] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.640] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e5c1e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f68b15, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f68b15, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0176.640] GetProcessHeap () returned 0xfd0000 [0176.640] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e5c1e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f68b15, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f68b15, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.640] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e5c1e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f68b15, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f68b15, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.640] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f68b15, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f68a8c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.640] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f68b15, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f68a8c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.640] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.640] GetProcessHeap () returned 0xfd0000 [0176.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.640] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e65e31, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f77575, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f77575, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0176.641] GetProcessHeap () returned 0xfd0000 [0176.641] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e65e31, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f77575, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f77575, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.641] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e65e31, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f77575, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f77575, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.641] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f77575, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f774ec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.641] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f77575, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f774ec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.641] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.641] GetProcessHeap () returned 0xfd0000 [0176.641] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.641] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e4d7a5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f5046d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f5046d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0176.641] GetProcessHeap () returned 0xfd0000 [0176.641] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e4d7a5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f5046d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f5046d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.641] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e4d7a5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f5046d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f5046d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.641] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f5046d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f52afc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.642] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f5046d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f52afc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.642] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.642] GetProcessHeap () returned 0xfd0000 [0176.642] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.642] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e06aac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef10e5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ef10e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0176.642] GetProcessHeap () returned 0xfd0000 [0176.642] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e06aac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef10e5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ef10e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.642] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e06aac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef10e5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ef10e5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.642] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ef10e5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef107c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.642] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ef10e5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef107c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.642] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.642] GetProcessHeap () returned 0xfd0000 [0176.642] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.642] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e1a32f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f0e5af, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f0e5af, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0176.642] GetProcessHeap () returned 0xfd0000 [0176.642] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e1a32f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f0e5af, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f0e5af, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.643] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e1a32f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f0e5af, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f0e5af, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.643] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f0e5af, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f10c4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.643] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f0e5af, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f10c4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90f91be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.643] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.643] GetProcessHeap () returned 0xfd0000 [0176.643] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.643] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e106eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8effb5e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8effb5e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0176.643] GetProcessHeap () returned 0xfd0000 [0176.643] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e106eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8effb5e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8effb5e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.643] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e106eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8effb5e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8effb5e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.643] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8effb5e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f021ec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.643] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8effb5e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f021ec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.643] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.644] GetProcessHeap () returned 0xfd0000 [0176.644] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.644] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dc4be9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e96b82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e96b82, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0176.644] GetProcessHeap () returned 0xfd0000 [0176.644] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dc4be9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e96b82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e96b82, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.644] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dc4be9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e96b82, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e96b82, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.644] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e9446c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e96b2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.644] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e9446c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e96b2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.644] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.644] GetProcessHeap () returned 0xfd0000 [0176.644] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.644] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e0b8cf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef8616, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ef8616, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0176.644] GetProcessHeap () returned 0xfd0000 [0176.645] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e0b8cf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef8616, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ef8616, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0176.645] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e0b8cf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef8616, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ef8616, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.645] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ef8616, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef85ac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x37179f00, ftLastWriteTime.dwHighDateTime=0x1cccb32, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.645] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ef8616, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ef85ac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x37179f00, ftLastWriteTime.dwHighDateTime=0x1cccb32, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.645] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0176.645] GetProcessHeap () returned 0xfd0000 [0176.645] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.645] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e154f7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f07071, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f07071, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0176.645] GetProcessHeap () returned 0xfd0000 [0176.645] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e154f7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f07071, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f07071, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.645] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e154f7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f07071, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f07071, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.645] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f07071, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f0971c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.645] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f07071, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f0971c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.646] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.646] GetProcessHeap () returned 0xfd0000 [0176.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.646] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e2dbb2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f2ba76, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f2ba76, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0176.646] GetProcessHeap () returned 0xfd0000 [0176.646] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e2dbb2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f2ba76, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f2ba76, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0176.646] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e2dbb2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f2ba76, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f2ba76, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.646] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f2ba76, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f2e10c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.646] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f2ba76, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f2e10c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.646] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0176.646] GetProcessHeap () returned 0xfd0000 [0176.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.646] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ddd291, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eb6756, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eb6756, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0176.646] GetProcessHeap () returned 0xfd0000 [0176.646] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ddd291, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eb6756, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eb6756, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.647] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ddd291, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eb6756, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eb6756, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.647] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eb6756, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eb66fc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.647] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eb6756, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eb66fc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.647] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.647] GetProcessHeap () returned 0xfd0000 [0176.647] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.647] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd0f2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ea2ed3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ea2ed3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0176.647] GetProcessHeap () returned 0xfd0000 [0176.647] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd0f2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ea2ed3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ea2ed3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.647] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dd0f2d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ea2ed3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ea2ed3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.647] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ea2ed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ea2e7c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.647] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ea2ed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ea2e7c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.647] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.647] GetProcessHeap () returned 0xfd0000 [0176.647] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.647] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8debcee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ecedcf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ecedcf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0176.648] GetProcessHeap () returned 0xfd0000 [0176.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8debcee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ecedcf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ecedcf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.648] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8debcee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ecedcf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ecedcf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.648] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ecedcf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eced9c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.648] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ecedcf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eced9c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.648] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.648] GetProcessHeap () returned 0xfd0000 [0176.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.648] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8de6ed2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ec51b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ec51b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1 [0176.648] GetProcessHeap () returned 0xfd0000 [0176.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8de6ed2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ec51b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ec51b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.649] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8de6ed2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ec51b9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ec51b9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.649] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec51b9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ec786c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x37179f00, ftLastWriteTime.dwHighDateTime=0x1cccb32, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.649] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec51b9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ec786c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x37179f00, ftLastWriteTime.dwHighDateTime=0x1cccb32, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.649] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.649] GetProcessHeap () returned 0xfd0000 [0176.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.649] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e01c8a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eec2c5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eec2c5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0176.649] GetProcessHeap () returned 0xfd0000 [0176.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e01c8a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eec2c5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eec2c5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.649] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e01c8a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eec2c5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8eec2c5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.649] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eec2c5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eec25c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.649] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eec2c5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8eec25c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fb8ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.649] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.649] GetProcessHeap () returned 0xfd0000 [0176.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.649] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dbd6b1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e8f64d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e8f64d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0176.650] GetProcessHeap () returned 0xfd0000 [0176.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dbd6b1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e8f64d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e8f64d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.650] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8dbd6b1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e8f64d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e8f64d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.650] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e8f64d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e8f5fc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.650] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e8f64d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e8f5fc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.650] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.650] GetProcessHeap () returned 0xfd0000 [0176.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.650] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e377ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3cbea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f3cbea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0176.650] GetProcessHeap () returned 0xfd0000 [0176.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e377ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3cbea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f3cbea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.651] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e377ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3cbea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f3cbea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.651] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f3cbea, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3cb6c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.651] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f3cbea, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3cb6c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.652] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.652] GetProcessHeap () returned 0xfd0000 [0176.653] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.653] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e5e903, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f6d937, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f6d937, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0176.653] GetProcessHeap () returned 0xfd0000 [0176.653] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e5e903, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f6d937, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f6d937, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.653] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e5e903, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f6d937, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f6d937, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.653] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f6d937, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f6d8ac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.653] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f6d937, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f6d8ac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.653] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.653] GetProcessHeap () returned 0xfd0000 [0176.653] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.653] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8da5008, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e6ac51, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e6ac51, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0176.653] GetProcessHeap () returned 0xfd0000 [0176.653] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8da5008, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e6ac51, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e6ac51, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.654] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8da5008, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e6ac51, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8e6ac51, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.654] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e6ac51, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e6ac0c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.654] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e6ac51, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8e6ac0c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.654] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.654] GetProcessHeap () returned 0xfd0000 [0176.654] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.654] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8de20b0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ebdc7e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ebdc7e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0176.654] GetProcessHeap () returned 0xfd0000 [0176.654] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8de20b0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ebdc7e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ebdc7e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0176.654] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8de20b0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ebdc7e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8ebdc7e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.654] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ebdc7e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ebdc2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.654] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ebdc7e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8ebdc2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.655] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0176.655] GetProcessHeap () returned 0xfd0000 [0176.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.655] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e28d90, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f24545, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f24545, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0176.655] GetProcessHeap () returned 0xfd0000 [0176.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e28d90, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f24545, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f24545, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.655] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e28d90, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f24545, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f24545, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.655] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f24545, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f26bdc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.655] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f24545, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f26bdc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.655] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0176.655] GetProcessHeap () returned 0xfd0000 [0176.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.655] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e23f71, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f1d013, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f1d013, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0176.655] GetProcessHeap () returned 0xfd0000 [0176.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e23f71, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f1d013, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f1d013, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e23f71, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f1d013, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f1d013, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f1d013, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f1cf9c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f1d013, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f1cf9c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.656] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.656] GetProcessHeap () returned 0xfd0000 [0176.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.656] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e350d8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f356b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f356b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0176.656] GetProcessHeap () returned 0xfd0000 [0176.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e350d8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f356b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f356b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e350d8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f356b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f356b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f356b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3563c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.656] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f356b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f3563c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe90fdfdd, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.656] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0176.656] GetProcessHeap () returned 0xfd0000 [0176.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.656] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8e350d8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f356b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f356b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0176.657] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.657] GetProcessHeap () returned 0xfd0000 [0176.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0176.657] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8f7ea98, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f811b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f811b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0176.657] GetProcessHeap () returned 0xfd0000 [0176.657] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0176.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8f7ea98, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f811b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f811b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.657] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8f7ea98, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f811b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f811b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.657] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f811b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f8383c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xaebed400, ftLastWriteTime.dwHighDateTime=0x1d06892, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0176.657] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f811b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f8383c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xaebed400, ftLastWriteTime.dwHighDateTime=0x1d06892, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0176.657] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.657] GetProcessHeap () returned 0xfd0000 [0176.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0176.657] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8f7ea98, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe8f811b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe8f811b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0176.657] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0176.657] GetProcessHeap () returned 0xfd0000 [0176.657] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0176.659] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8d6a680, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc571c6f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe90f4380, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 0 [0176.659] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.659] GetProcessHeap () returned 0xfd0000 [0176.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0176.660] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea61b99c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea61e0bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61e0bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0176.660] GetProcessHeap () returned 0xfd0000 [0176.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0176.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea61b99c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea61e0bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61e0bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0176.661] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea61b99c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea61e0bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61e0bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.661] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9e9a198, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc590e117, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea265d8a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6117.717.0.0_0", cAlternateFileName="611771~1.0_0")) returned 1 [0176.661] GetProcessHeap () returned 0xfd0000 [0176.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0176.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9e9a198, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc590e117, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea265d8a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0176.663] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9e9a198, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc590e117, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea265d8a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.663] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea18c8a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea196420, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x8edf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js", cAlternateFileName="")) returned 1 [0176.663] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea19b307, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea19b240, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0176.664] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1a2842, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1a7590, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x28d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0176.664] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1ac486, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1aeac0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x119b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0176.664] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1b39a9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1b5ff0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0176.664] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1bd638, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1bd520, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0xc114, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0176.664] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea1c7238, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1fa695, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1fa695, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0176.664] GetProcessHeap () returned 0xfd0000 [0176.664] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0176.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cast_setup\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea1c7238, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1fa695, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1fa695, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea1c7238, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1fa695, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1fa695, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1c994b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1cbf80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x21fe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.js", cAlternateFileName="")) returned 1 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1d0e76, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1d34b0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app_min.css", cAlternateFileName="CAST_A~1.CSS")) returned 1 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1d83ae, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1da9e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1df8e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1df800, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1e4703, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1e4620, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1 [0176.666] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1e9518, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1ebb50, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0176.667] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1f5879, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1f5790, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1 [0176.667] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1fa695, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1fccc0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1 [0176.667] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1fa695, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1fccc0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0176.667] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0176.667] GetProcessHeap () returned 0xfd0000 [0176.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0176.668] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea201bca, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea20df1b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea20df1b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0176.668] GetProcessHeap () returned 0xfd0000 [0176.668] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0176.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\cloud_route_details\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea201bca, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea20df1b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea20df1b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea201bca, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea20df1b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea20df1b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea2069e3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0176.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea20df1b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea20de30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 1 [0176.668] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea20df1b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea20de30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 0 [0176.668] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.668] GetProcessHeap () returned 0xfd0000 [0176.668] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0176.668] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea212d37, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea215360, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x4b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="common.js", cAlternateFileName="")) returned 1 [0176.668] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea21a26c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea21a180, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0176.669] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea21f088, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea2216b0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0176.669] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea2265c3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea2264d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x2919, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0176.669] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e9c8a7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea22b2f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5a8d8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0176.669] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea230205, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea234f30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x59fef, dwReserved0=0x0, dwReserved1=0x0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0176.669] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea23ec62, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea241280, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x78a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0176.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea24619a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea24aec0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3c13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0176.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea24fdd2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea257210, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x698b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0176.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea25c130, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea25e740, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x8a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0176.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ea8bf5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea182c8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea182c8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0176.831] GetProcessHeap () returned 0xfd0000 [0176.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0176.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ea8bf5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea182c8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea182c8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0176.838] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ea8bf5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea182c8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea182c8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.851] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eada1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9eb2843, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9eb2843, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0176.851] GetProcessHeap () returned 0xfd0000 [0176.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eada1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9eb2843, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9eb2843, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.852] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eada1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9eb2843, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9eb2843, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.852] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9eb2843, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9eb2830, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c6265, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.852] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9eb2843, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9eb2830, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c6265, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.852] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0176.852] GetProcessHeap () returned 0xfd0000 [0176.852] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.852] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eb9dbc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ebeb97, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ebeb97, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0176.852] GetProcessHeap () returned 0xfd0000 [0176.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eb9dbc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ebeb97, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ebeb97, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.852] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eb9dbc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ebeb97, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ebeb97, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.852] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ebeb97, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ec39a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c6265, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x45c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.852] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ebeb97, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ec39a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c6265, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x45c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.852] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.853] GetProcessHeap () returned 0xfd0000 [0176.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.853] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ec87d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ecd5eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ecd5eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0176.853] GetProcessHeap () returned 0xfd0000 [0176.853] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bg\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ec87d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ecd5eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ecd5eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.853] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ec87d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ecd5eb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ecd5eb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.853] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ecd5eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ecd5e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c6265, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.854] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ecd5eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ecd5e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c6265, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.854] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0176.854] GetProcessHeap () returned 0xfd0000 [0176.854] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.854] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ed4b26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ed9949, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ed9949, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0176.854] GetProcessHeap () returned 0xfd0000 [0176.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\bn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ed4b26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ed9949, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ed9949, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.855] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ed4b26, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ed9949, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ed9949, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.855] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ed9949, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ed9930, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c8988, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.855] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ed9949, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ed9930, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c8988, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.855] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.855] GetProcessHeap () returned 0xfd0000 [0176.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.855] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ee0e7a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ee5c9d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ee5c9d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0176.855] GetProcessHeap () returned 0xfd0000 [0176.855] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ca\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ee0e7a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ee5c9d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ee5c9d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.855] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ee0e7a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ee5c9d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ee5c9d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.855] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ee5c9d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ee5c80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c8988, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.856] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ee5c9d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ee5c80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c8988, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.856] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.856] GetProcessHeap () returned 0xfd0000 [0176.856] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.856] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eed1c8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ef4700, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ef4700, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0176.856] GetProcessHeap () returned 0xfd0000 [0176.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\cs\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eed1c8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ef4700, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ef4700, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.856] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eed1c8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ef4700, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ef4700, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.856] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ef4700, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ef46e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c8988, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.856] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ef4700, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ef46e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5c8988, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.856] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.856] GetProcessHeap () returned 0xfd0000 [0176.856] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.856] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9efbc32, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9efe33f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9efe33f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0176.856] GetProcessHeap () returned 0xfd0000 [0176.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\da\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9efbc32, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9efe33f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9efe33f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.857] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9efbc32, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9efe33f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9efe33f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.857] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9efe33f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f00a30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cb09d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.857] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9efe33f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f00a30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cb09d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.857] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.857] GetProcessHeap () returned 0xfd0000 [0176.857] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.857] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f07f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f0cda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f0cda2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0176.857] GetProcessHeap () returned 0xfd0000 [0176.857] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\de\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f07f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f0cda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f0cda2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.857] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f07f77, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f0cda2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f0cda2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.857] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f0cda2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f0f490, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cb09d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.857] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f0cda2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f0f490, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cb09d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.857] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.858] GetProcessHeap () returned 0xfd0000 [0176.858] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.858] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f142d1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f190f7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f190f7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0176.858] GetProcessHeap () returned 0xfd0000 [0176.858] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\el\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f142d1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f190f7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f190f7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.858] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f142d1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f190f7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f190f7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.858] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f190f7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f190d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cb09d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.858] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f190f7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f190d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cb09d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.858] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.858] GetProcessHeap () returned 0xfd0000 [0176.858] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.858] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f20644, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f2544b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f2544b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0176.858] GetProcessHeap () returned 0xfd0000 [0176.858] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\en\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f20644, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f2544b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f2544b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.860] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f20644, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f2544b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f2544b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.860] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f2544b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f25420, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cd7aa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.860] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f2544b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f25420, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cd7aa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.860] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.860] GetProcessHeap () returned 0xfd0000 [0176.860] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.860] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f2f08c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f31795, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f31795, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0176.860] GetProcessHeap () returned 0xfd0000 [0176.860] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\es\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f2f08c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f31795, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f31795, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.861] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f2f08c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f31795, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f31795, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.861] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f31795, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f33e80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cd7aa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.861] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f31795, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f33e80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cd7aa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.861] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.861] GetProcessHeap () returned 0xfd0000 [0176.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.861] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f38cd1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f40203, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f40203, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0176.861] GetProcessHeap () returned 0xfd0000 [0176.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\et\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f38cd1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f40203, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f40203, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.862] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f38cd1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f40203, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f40203, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.862] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f40203, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f401d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cd7aa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.862] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f40203, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f401d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cd7aa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.862] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0176.862] GetProcessHeap () returned 0xfd0000 [0176.862] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.862] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f49e47, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f4ec66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f4ec66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0176.862] GetProcessHeap () returned 0xfd0000 [0176.862] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fa\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f49e47, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f4ec66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f4ec66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.862] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f49e47, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f4ec66, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f4ec66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.863] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f4ec66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f4ec30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.863] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f4ec66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f4ec30, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.863] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.863] GetProcessHeap () returned 0xfd0000 [0176.863] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.863] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f56195, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f5afba, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f5afba, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0176.863] GetProcessHeap () returned 0xfd0000 [0176.863] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f56195, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f5afba, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f5afba, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.863] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f56195, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f5afba, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f5afba, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.863] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f5afba, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f5af80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.863] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f5afba, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f5af80, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.863] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.864] GetProcessHeap () returned 0xfd0000 [0176.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.864] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f624ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f64bfc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f64bfc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0176.864] GetProcessHeap () returned 0xfd0000 [0176.864] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fil\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f624ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f64bfc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f64bfc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.864] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f624ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f64bfc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f64bfc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.864] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f64bfc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f672d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.864] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f64bfc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f672d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.864] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.864] GetProcessHeap () returned 0xfd0000 [0176.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.864] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f6e83d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f70f53, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f70f53, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0176.864] GetProcessHeap () returned 0xfd0000 [0176.864] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\fr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f6e83d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f70f53, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f70f53, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.865] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f6e83d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f70f53, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f70f53, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.865] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f70f53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f73620, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.865] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f70f53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f73620, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5cfeb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.865] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.865] GetProcessHeap () returned 0xfd0000 [0176.865] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.865] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f7ab91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f7f9b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f7f9b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0176.865] GetProcessHeap () returned 0xfd0000 [0176.865] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\gu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f7ab91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f7f9b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f7f9b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.865] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f7ab91, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f7f9b4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f7f9b4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.865] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f7f9b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f7f970, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5d9b04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.865] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f7f9b4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f7f970, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5d9b04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.865] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.865] GetProcessHeap () returned 0xfd0000 [0176.865] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.865] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f895ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f8e417, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f8e417, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0176.866] GetProcessHeap () returned 0xfd0000 [0176.866] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f895ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f8e417, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f8e417, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.866] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f895ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f8e417, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f8e417, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.866] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f8e417, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f8e3d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5d9b04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.866] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f8e417, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f8e3d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5d9b04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.866] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.866] GetProcessHeap () returned 0xfd0000 [0176.866] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.866] GetProcessHeap () returned 0xfd0000 [0176.866] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9f95946, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9f9a730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9f9a730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.867] GetProcessHeap () returned 0xfd0000 [0176.867] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.867] GetProcessHeap () returned 0xfd0000 [0176.867] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\hu\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fa1c9d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fa6ac0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fa6ac0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.867] GetProcessHeap () returned 0xfd0000 [0176.867] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.868] GetProcessHeap () returned 0xfd0000 [0176.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\id\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fadfee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fb0701, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fb0701, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.868] GetProcessHeap () returned 0xfd0000 [0176.868] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.868] GetProcessHeap () returned 0xfd0000 [0176.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\it\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fba339, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fbca55, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fbca55, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0176.868] GetProcessHeap () returned 0xfd0000 [0176.868] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.868] GetProcessHeap () returned 0xfd0000 [0176.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\iw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fc3f84, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fcb4b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fcb4b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0176.869] GetProcessHeap () returned 0xfd0000 [0176.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.869] GetProcessHeap () returned 0xfd0000 [0176.869] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ja\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fd29eb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fd50fa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fd50fa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0176.870] GetProcessHeap () returned 0xfd0000 [0176.870] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.870] GetProcessHeap () returned 0xfd0000 [0176.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\kn\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fded3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fe3b58, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fe3b58, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0176.870] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9fded3c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fe3b58, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fe3b58, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.870] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9fe3b58, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fe3b00, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5e5e49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.870] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9fe3b58, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fe3b00, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5e5e49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.870] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0176.870] GetProcessHeap () returned 0xfd0000 [0176.870] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.870] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9feb090, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fefeb5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fefeb5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0176.870] GetProcessHeap () returned 0xfd0000 [0176.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ko\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9feb090, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fefeb5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fefeb5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.871] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9feb090, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9fefeb5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9fefeb5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.871] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9fefeb5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ff2560, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5e85ac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.871] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9fefeb5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ff2560, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5e85ac, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.871] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.871] GetProcessHeap () returned 0xfd0000 [0176.871] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.871] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ff73e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ffc203, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ffc203, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0176.871] GetProcessHeap () returned 0xfd0000 [0176.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ff73e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ffc203, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ffc203, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.871] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ff73e1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ffc203, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ffc203, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.871] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ffc203, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ffe8b0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5eac49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.871] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ffc203, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ffe8b0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5eac49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.872] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.872] GetProcessHeap () returned 0xfd0000 [0176.872] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.872] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea00374e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea008557, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea008557, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0176.872] GetProcessHeap () returned 0xfd0000 [0176.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\lv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea00374e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea008557, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea008557, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.872] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea00374e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea008557, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea008557, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.873] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea008557, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0084f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5eac49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.873] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea008557, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0084f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5eac49, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.873] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.873] GetProcessHeap () returned 0xfd0000 [0176.873] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.873] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea00fa86, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea012199, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea012199, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0176.873] GetProcessHeap () returned 0xfd0000 [0176.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ml\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea00fa86, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea012199, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea012199, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.873] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea00fa86, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea012199, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea012199, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.873] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea012199, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea014840, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5ed37e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.873] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea012199, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea014840, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5ed37e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.873] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.873] GetProcessHeap () returned 0xfd0000 [0176.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.874] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea01e4ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea023328, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea023328, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0176.874] GetProcessHeap () returned 0xfd0000 [0176.874] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\mr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea01e4ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea023328, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea023328, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.874] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea01e4ed, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea023328, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea023328, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.874] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea023328, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0232a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5efa90, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.875] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea023328, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0232a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5efa90, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.875] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.875] GetProcessHeap () returned 0xfd0000 [0176.875] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.875] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea02a83e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea02cf44, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea02cf44, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0176.875] GetProcessHeap () returned 0xfd0000 [0176.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ms\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea02a83e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea02cf44, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea02cf44, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.875] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea02a83e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea02cf44, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea02cf44, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.875] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea02cf44, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea02f5f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5efa90, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.875] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea02cf44, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea02f5f0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5efa90, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.875] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.875] GetProcessHeap () returned 0xfd0000 [0176.875] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.875] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea034485, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0392a1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0392a1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0176.875] GetProcessHeap () returned 0xfd0000 [0176.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nb\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea034485, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0392a1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0392a1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.878] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea034485, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0392a1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0392a1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.878] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0392a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea039230, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f219a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.878] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0392a1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea039230, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f219a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.878] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.878] GetProcessHeap () returned 0xfd0000 [0176.878] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.879] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0407d3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0455f9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0455f9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0176.879] GetProcessHeap () returned 0xfd0000 [0176.879] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\nl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0407d3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0455f9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0455f9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.879] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0407d3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0455f9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0455f9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.879] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0455f9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea045580, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f48b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.879] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0455f9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea045580, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f48b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.879] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.879] GetProcessHeap () returned 0xfd0000 [0176.879] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.879] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea04cb27, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05194d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea05194d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0176.879] GetProcessHeap () returned 0xfd0000 [0176.879] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea04cb27, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05194d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea05194d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.879] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea04cb27, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05194d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea05194d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.880] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea05194d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0518d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f48b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.880] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea05194d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0518d0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f48b3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.880] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.880] GetProcessHeap () returned 0xfd0000 [0176.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.880] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea058e7f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05dc9e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea05dc9e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0176.880] GetProcessHeap () returned 0xfd0000 [0176.880] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\pt\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea058e7f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05dc9e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea05dc9e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.880] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea058e7f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05dc9e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea05dc9e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.880] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea05dc9e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05dc20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f6fb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4006, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.880] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea05dc9e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea05dc20, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f6fb9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4006, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.880] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.880] GetProcessHeap () returned 0xfd0000 [0176.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.880] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0678e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea069fec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea069fec, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0176.880] GetProcessHeap () returned 0xfd0000 [0176.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ro\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0678e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea069fec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea069fec, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.881] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0678e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea069fec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea069fec, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.881] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea069fec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea06c680, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f96bc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.881] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea069fec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea06c680, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f96bc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.881] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.881] GetProcessHeap () returned 0xfd0000 [0176.881] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.881] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea071521, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea076343, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea076343, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0176.881] GetProcessHeap () returned 0xfd0000 [0176.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ru\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea071521, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea076343, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea076343, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0176.888] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea071521, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea076343, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea076343, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.888] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea076343, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0762c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f96bc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.888] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea076343, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0762c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5f96bc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.889] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0176.889] GetProcessHeap () returned 0xfd0000 [0176.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea07d872, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea07ff87, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea07ff87, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0176.889] GetProcessHeap () returned 0xfd0000 [0176.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea07d872, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea07ff87, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea07ff87, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.889] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea07d872, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea07ff87, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea07ff87, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.889] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea07ff87, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea082610, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5fe4e8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.889] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea07ff87, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea082610, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea5fe4e8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.889] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.889] GetProcessHeap () returned 0xfd0000 [0176.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.889] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea089bd5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea08e9e8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea08e9e8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0176.889] GetProcessHeap () returned 0xfd0000 [0176.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sl\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea089bd5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea08e9e8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea08e9e8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.892] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea089bd5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea08e9e8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea08e9e8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.892] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea08e9e8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea091070, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea600bee, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.892] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea08e9e8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea091070, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea600bee, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.892] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.893] GetProcessHeap () returned 0xfd0000 [0176.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.893] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea095f1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea09ad3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea09ad3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0176.893] GetProcessHeap () returned 0xfd0000 [0176.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea095f1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea09ad3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea09ad3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.893] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea095f1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea09ad3f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea09ad3f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.893] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea09ad3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea09acb0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea600bee, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.893] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea09ad3f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea09acb0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea600bee, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.893] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.893] GetProcessHeap () returned 0xfd0000 [0176.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.893] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0a226b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0a705b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0a705b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0176.893] GetProcessHeap () returned 0xfd0000 [0176.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sv\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0a226b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0a705b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0a705b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.894] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0a226b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0a705b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea0a705b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.894] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0a705b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0a7000, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea603310, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.894] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0a705b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea0a7000, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea603310, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.894] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.894] GetProcessHeap () returned 0xfd0000 [0176.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.894] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea11c3ae, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1211be, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1211be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0176.894] GetProcessHeap () returned 0xfd0000 [0176.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\sw\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea11c3ae, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1211be, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1211be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.894] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea11c3ae, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1211be, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1211be, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.894] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1211be, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea121120, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea605a23, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.895] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1211be, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea121120, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea605a23, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.895] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.895] GetProcessHeap () returned 0xfd0000 [0176.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.895] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea128702, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea12d524, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea12d524, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0176.895] GetProcessHeap () returned 0xfd0000 [0176.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ta\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea128702, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea12d524, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea12d524, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.895] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea128702, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea12d524, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea12d524, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.895] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12d524, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea12d470, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60812f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.895] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12d524, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea12d470, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60812f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.895] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.895] GetProcessHeap () returned 0xfd0000 [0176.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.895] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea134a53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea13987c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea13987c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0176.895] GetProcessHeap () returned 0xfd0000 [0176.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\te\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea134a53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea13987c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea13987c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0176.896] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea134a53, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea13987c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea13987c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.896] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13987c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1397c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60812f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.896] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13987c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1397c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60812f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.896] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0176.896] GetProcessHeap () returned 0xfd0000 [0176.896] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.896] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea140da7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1434b7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1434b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0176.896] GetProcessHeap () returned 0xfd0000 [0176.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\th\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea140da7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1434b7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1434b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0176.896] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea140da7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1434b7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea1434b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.896] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1434b7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea143400, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60cf4b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.897] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1434b7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea143400, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60cf4b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.897] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0176.897] GetProcessHeap () returned 0xfd0000 [0176.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.897] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea14d0e9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea154624, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea154624, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0176.897] GetProcessHeap () returned 0xfd0000 [0176.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0176.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\tr\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea14d0e9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea154624, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea154624, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0176.898] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea14d0e9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea154624, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea154624, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.898] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea154624, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea154570, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60cf4b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0176.898] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea154624, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea154570, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60cf4b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0176.898] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0176.898] GetProcessHeap () returned 0xfd0000 [0176.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0176.898] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea15bb5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea160981, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea160981, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0177.022] GetProcessHeap () returned 0xfd0000 [0177.022] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0177.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\uk\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea15bb5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea160981, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea160981, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0177.022] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea15bb5f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea160981, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea160981, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.022] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea160981, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1608c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60f664, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0177.023] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea160981, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1608c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea60f664, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0177.023] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0177.023] GetProcessHeap () returned 0xfd0000 [0177.023] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0177.023] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16a5c3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea16ccc9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea16ccc9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0177.023] GetProcessHeap () returned 0xfd0000 [0177.023] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0177.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\vi\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16a5c3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea16ccc9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea16ccc9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.024] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16a5c3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea16ccc9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea16ccc9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea16ccc9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea16f320, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea611d77, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea16ccc9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea16f320, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea611d77, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0177.024] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0177.024] GetProcessHeap () returned 0xfd0000 [0177.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea174204, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea17b730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea17b730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh", cAlternateFileName="")) returned 1 [0177.024] GetProcessHeap () returned 0xfd0000 [0177.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0177.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea174204, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea17b730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea17b730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0177.024] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea174204, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea17b730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea17b730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea17b730, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea17b670, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61449c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0177.024] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea17b730, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea17b670, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61449c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0177.024] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0177.026] GetProcessHeap () returned 0xfd0000 [0177.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea182c8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea187a8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea187a8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0177.026] GetProcessHeap () returned 0xfd0000 [0177.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0177.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\zh_TW\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea182c8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea187a8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea187a8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0177.027] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea182c8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea187a8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea187a8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea187a8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1879c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61449c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea187a8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea1879c0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61449c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0177.027] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0177.027] GetProcessHeap () returned 0xfd0000 [0177.027] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea182c8d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea187a8d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea187a8d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0177.027] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.028] GetProcessHeap () returned 0xfd0000 [0177.028] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0177.028] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea263665, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea265d8a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea265d8a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0177.028] GetProcessHeap () returned 0xfd0000 [0177.028] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0177.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_metadata\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea263665, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea265d8a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea687082, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.028] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea263665, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea265d8a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea687082, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.029] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea687082, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea687082, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea687082, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x76a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0177.029] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea265d8a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea268380, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0177.029] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea265d8a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea268380, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8b851c00, ftLastWriteTime.dwHighDateTime=0x1d2fec3, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0177.029] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.029] GetProcessHeap () returned 0xfd0000 [0177.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0177.029] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea263665, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea265d8a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea265d8a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0177.029] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0177.029] GetProcessHeap () returned 0xfd0000 [0177.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0177.030] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9e9a198, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc590e117, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea265d8a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6117.717.0.0_0", cAlternateFileName="611771~1.0_0")) returned 0 [0177.030] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.030] GetProcessHeap () returned 0xfd0000 [0177.030] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.031] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea61b99c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xea61e0bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xea61e0bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0177.031] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.032] GetProcessHeap () returned 0xfd0000 [0177.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242d194, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5242d194, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x527b211b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons", cAlternateFileName="")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5242f8b3, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5242f8b3, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x529538f7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5179d880, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5234a080, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa82ac98, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xfa82ac98, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa82ac98, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x6, dwReserved0=0x0, dwReserved1=0x0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x523d5309, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5296986b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5296986b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5753349f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Session", cAlternateFileName="LASTSE~1")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5776f89b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5776f89b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Tabs", cAlternateFileName="LASTTA~1")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xead47a83, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0177.032] GetProcessHeap () returned 0xfd0000 [0177.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xead47a83, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.033] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xead47a83, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeae4a779, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeae4a779, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0177.033] GetProcessHeap () returned 0xfd0000 [0177.033] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeae4a779, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeae4a779, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeae4a779, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeae4a779, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeae4a779, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeae4a779, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeae4a779, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead4a1af, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead4a1af, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeadba66c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xead47a83, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf7cf3ec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xead4a1af, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xead47a83, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xead4a1af, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0177.041] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.042] GetProcessHeap () returned 0xfd0000 [0177.043] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.043] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xead47a83, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeae4a779, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeae4a779, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 0 [0177.043] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.043] GetProcessHeap () returned 0xfd0000 [0177.043] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.043] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb024218, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb024218, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1 [0177.043] GetProcessHeap () returned 0xfd0000 [0177.043] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb024218, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb024218, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0177.056] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb024218, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb024218, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.056] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb1be4f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb1be4f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="leveldb", cAlternateFileName="")) returned 1 [0177.056] GetProcessHeap () returned 0xfd0000 [0177.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb1be4f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb1be4f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.056] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb1be4f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb1be4f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.056] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb1be4f3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb1be4f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf8a10d88, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x16cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0177.056] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb02903a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb02903a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb02903a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0177.056] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb026922, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb026922, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb026922, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb026922, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb026922, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf7cf3ec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb02903a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb02903a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb02903a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb02903a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb02903a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb02903a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0177.057] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.057] GetProcessHeap () returned 0xfd0000 [0177.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb024218, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb1be4f3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb1be4f3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="leveldb", cAlternateFileName="")) returned 0 [0177.057] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0177.057] GetProcessHeap () returned 0xfd0000 [0177.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52319328, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52319328, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xe75cff11, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5231ba4e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5231ba4e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xe761c3cc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5292eec7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5292eec7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53b5f051, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529315f0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x529315f0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x53d9f3c2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54135456, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x54135456, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xec432c10, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54135456, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x54135456, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xec45ead4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1 [0177.057] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c545a2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa792330, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa7b85d6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x206e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5157d0ff, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5157d0ff, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5397926d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1 [0177.058] SetEvent (hEvent=0x2e8) returned 1 [0177.058] ResetEvent (hEvent=0x2ec) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x517348e4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x517348e4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x539e223d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebab07e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xebab07e0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xebd41496, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebab2f0c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xebab2f0c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xebd83378, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5706285f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xeeb01e7d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeeb01e7d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x8617, dwReserved0=0x0, dwReserved1=0x0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52601e23, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52601e23, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xe774d6a2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52601e23, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52601e23, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xe7979194, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1 [0177.058] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Data", cAlternateFileName="SYNCDA~1")) returned 1 [0177.058] GetProcessHeap () returned 0xfd0000 [0177.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.059] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.059] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LevelDB", cAlternateFileName="")) returned 1 [0177.059] GetProcessHeap () returned 0xfd0000 [0177.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\LevelDB\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.066] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.066] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515e12a0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x515e12a0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0177.066] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0177.066] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0177.067] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe749ec47, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf143f155, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0177.067] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.old", cAlternateFileName="")) returned 1 [0177.067] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0177.067] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x513a1ab9, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x513a1ab9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0177.067] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.068] GetProcessHeap () returned 0xfd0000 [0177.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.068] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513a1ab9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LevelDB", cAlternateFileName="")) returned 0 [0177.068] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.068] GetProcessHeap () returned 0xfd0000 [0177.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.068] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb375cbe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb375cbe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1 [0177.068] GetProcessHeap () returned 0xfd0000 [0177.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb375cbe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb375cbe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0177.068] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb375cbe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb375cbe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.068] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb4a218c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb4a218c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0177.068] GetProcessHeap () returned 0xfd0000 [0177.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb4a218c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb4a218c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.071] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb4a218c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb4a218c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.071] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4a218c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb4a218c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb4a218c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0177.071] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb37f8e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb37f8e7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb3820b1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0177.071] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb37f8e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb37f8e7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb37f8e7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0177.072] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb375cbe, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf7cf3ec2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0177.072] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb37f8e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb37f8e7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb37f8e7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0177.072] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb37f8e7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb37f8e7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb37f8e7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0177.072] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.072] GetProcessHeap () returned 0xfd0000 [0177.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.073] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb375cbe, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xeb4a218c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xeb4a218c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0177.073] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0177.073] GetProcessHeap () returned 0xfd0000 [0177.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.073] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe75cff11, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe75cff11, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0177.073] GetProcessHeap () returned 0xfd0000 [0177.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Thumbnails\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe75cff11, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe75cff11, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe75cff11, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe75cff11, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522fbf33, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x522fbf33, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x522fbf33, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x51b5d18d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x514606bb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe75cff11, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf143f155, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.old", cAlternateFileName="")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x514606bb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0177.080] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514606bb, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x514606bb, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x514606bb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0177.080] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.081] GetProcessHeap () returned 0xfd0000 [0177.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5113f4c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5113f4c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x52c6a9d7, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1 [0177.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5118b971, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5118b971, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x52c99054, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1 [0177.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf148b749, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xf148b749, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf148b749, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1 [0177.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52aedbdc, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x52aedbdc, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5776f89b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1 [0177.082] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56cf52f5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cf52f5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1 [0177.082] GetProcessHeap () returned 0xfd0000 [0177.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56cf52f5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cf52f5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.082] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56cf52f5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56cf52f5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.082] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d93e5c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d93e5c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1 [0177.082] GetProcessHeap () returned 0xfd0000 [0177.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d93e5c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d93e5c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.082] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d93e5c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d93e5c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.082] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d10098, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d10098, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d175da, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0177.082] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d93e5c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d93e5c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d93e5c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1 [0177.083] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d93e5c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d93e5c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d93e5c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0 [0177.083] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.083] GetProcessHeap () returned 0xfd0000 [0177.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.083] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56cf52f5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x56d93e5c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x56d93e5c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 0 [0177.083] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.083] GetProcessHeap () returned 0xfd0000 [0177.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.083] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51119270, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x51119270, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x51b5f84c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1 [0177.083] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51119270, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x51119270, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5221db78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1 [0177.083] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51119270, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x51119270, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5221db78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0 [0177.083] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.083] GetProcessHeap () returned 0xfd0000 [0177.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.085] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0177.085] GetProcessHeap () returned 0xfd0000 [0177.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.086] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.086] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.086] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.086] GetProcessHeap () returned 0xfd0000 [0177.086] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.086] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5113f4c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5113f4c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5113f4c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0177.086] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b9a7a7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa7de7b5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa804a17, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12408, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0177.086] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0177.086] GetProcessHeap () returned 0xfd0000 [0177.086] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.087] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.087] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.087] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.087] GetProcessHeap () returned 0xfd0000 [0177.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.087] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0177.087] GetProcessHeap () returned 0xfd0000 [0177.087] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.092] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.092] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.092] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.092] GetProcessHeap () returned 0xfd0000 [0177.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.092] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0177.092] GetProcessHeap () returned 0xfd0000 [0177.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.092] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.092] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.092] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.093] GetProcessHeap () returned 0xfd0000 [0177.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.093] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x511fe097, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing", cAlternateFileName="SAFEBR~1")) returned 1 [0177.093] GetProcessHeap () returned 0xfd0000 [0177.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x511fe097, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.093] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x511fe097, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.093] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x511fe097, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.093] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.093] GetProcessHeap () returned 0xfd0000 [0177.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.093] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0177.094] GetProcessHeap () returned 0xfd0000 [0177.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0177.094] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.094] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.095] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0177.095] GetProcessHeap () returned 0xfd0000 [0177.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.095] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Subresource Filter", cAlternateFileName="SUBRES~1")) returned 1 [0177.095] GetProcessHeap () returned 0xfd0000 [0177.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.095] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.095] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unindexed Rules", cAlternateFileName="UNINDE~1")) returned 1 [0177.095] GetProcessHeap () returned 0xfd0000 [0177.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Unindexed Rules\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0177.253] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.253] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.253] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0177.253] GetProcessHeap () returned 0xfd0000 [0177.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.253] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unindexed Rules", cAlternateFileName="UNINDE~1")) returned 0 [0177.253] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.253] GetProcessHeap () returned 0xfd0000 [0177.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.253] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0177.253] GetProcessHeap () returned 0xfd0000 [0177.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.253] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.253] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.253] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.253] GetProcessHeap () returned 0xfd0000 [0177.257] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.257] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0177.257] GetProcessHeap () returned 0xfd0000 [0177.257] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.258] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.258] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.258] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.258] GetProcessHeap () returned 0xfd0000 [0177.258] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.258] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0177.258] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0177.258] GetProcessHeap () returned 0xfd0000 [0177.258] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.261] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0177.261] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.261] GetProcessHeap () returned 0xfd0000 [0177.261] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.261] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0177.261] GetProcessHeap () returned 0xfd0000 [0177.262] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0177.264] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.264] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.264] FindClose (in: hFindFile=0x10b7a40 | out: hFindFile=0x10b7a40) returned 1 [0177.264] GetProcessHeap () returned 0xfd0000 [0177.264] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.264] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0177.265] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0177.265] GetProcessHeap () returned 0xfd0000 [0177.265] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0177.265] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0177.265] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd2e85042, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x13441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0177.265] SetEvent (hEvent=0x2e8) returned 1 [0177.265] ResetEvent (hEvent=0x2ec) returned 1 [0177.265] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0177.265] GetProcessHeap () returned 0xfd0000 [0177.265] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0177.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0177.265] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.266] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0177.266] GetProcessHeap () returned 0xfd0000 [0177.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.266] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.266] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0177.266] GetProcessHeap () returned 0xfd0000 [0177.266] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0177.271] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff5a990, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.271] GetProcessHeap () returned 0xfd0000 [0177.271] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.272] GetProcessHeap () returned 0xfd0000 [0177.272] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.272] GetProcessHeap () returned 0xfd0000 [0177.272] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4005dd03, ftCreationTime.dwHighDateTime=0x1d3272c, ftLastAccessTime.dwLowDateTime=0x97043032, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x97043032, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.280] GetProcessHeap () returned 0xfd0000 [0177.280] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4005dd03, ftCreationTime.dwHighDateTime=0x1d3272c, ftLastAccessTime.dwLowDateTime=0x9719a3bf, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x9719a3bf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.283] GetProcessHeap () returned 0xfd0000 [0177.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.283] GetProcessHeap () returned 0xfd0000 [0177.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.283] GetProcessHeap () returned 0xfd0000 [0177.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dfe9793, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8dfe9793, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8e0ce49a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.283] GetProcessHeap () returned 0xfd0000 [0177.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e0ce49a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x8e0ce49a, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb86d2dbd, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.285] GetProcessHeap () returned 0xfd0000 [0177.285] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.285] GetProcessHeap () returned 0xfd0000 [0177.285] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.285] GetProcessHeap () returned 0xfd0000 [0177.285] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xffd2dee9, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0xffd2dee9, ftLastWriteTime.dwHighDateTime=0x1d5d805, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.286] GetProcessHeap () returned 0xfd0000 [0177.286] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.286] GetProcessHeap () returned 0xfd0000 [0177.286] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9153cde, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc9153cde, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc9153cde, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.287] GetProcessHeap () returned 0xfd0000 [0177.287] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.287] GetProcessHeap () returned 0xfd0000 [0177.287] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5e206cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.287] GetProcessHeap () returned 0xfd0000 [0177.288] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.288] GetProcessHeap () returned 0xfd0000 [0177.288] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4373c58d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5e21595, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4373c58d, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.288] GetProcessHeap () returned 0xfd0000 [0177.288] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.289] GetProcessHeap () returned 0xfd0000 [0177.289] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8280f106, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x8280f106, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x8280f106, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.290] GetProcessHeap () returned 0xfd0000 [0177.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.290] GetProcessHeap () returned 0xfd0000 [0177.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\GameDVR\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc71f3a6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc5e719bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdeb2fb6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.290] GetProcessHeap () returned 0xfd0000 [0177.290] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.290] GetProcessHeap () returned 0xfd0000 [0177.290] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InputPersonalization\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xabf27288, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabf27288, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0177.291] GetProcessHeap () returned 0xfd0000 [0177.291] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc5ea2c1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.292] GetProcessHeap () returned 0xfd0000 [0177.292] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.292] GetProcessHeap () returned 0xfd0000 [0177.292] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.292] GetProcessHeap () returned 0xfd0000 [0177.292] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee04858, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc5ea402c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdee04858, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.293] GetProcessHeap () returned 0xfd0000 [0177.293] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee04858, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa94f64d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xa94f64d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.352] GetProcessHeap () returned 0xfd0000 [0177.352] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.352] GetProcessHeap () returned 0xfd0000 [0177.352] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.352] GetProcessHeap () returned 0xfd0000 [0177.352] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cfd5892, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9b374a10, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x9b374a10, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.355] GetProcessHeap () returned 0xfd0000 [0177.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45e58e25, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x45e6c6af, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x45e6c6af, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.356] GetProcessHeap () returned 0xfd0000 [0177.356] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\JW094SOV\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45e6c6af, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x45e6c6af, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x8cd0fdbe, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.357] GetProcessHeap () returned 0xfd0000 [0177.357] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.357] GetProcessHeap () returned 0xfd0000 [0177.357] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KHCDOJTQ\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45e6c6af, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x45e6c6af, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x45e6c6af, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.359] GetProcessHeap () returned 0xfd0000 [0177.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.359] GetProcessHeap () returned 0xfd0000 [0177.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\ROM18SK9\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45e6c6af, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x45e6c6af, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x59b69c63, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.359] GetProcessHeap () returned 0xfd0000 [0177.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.359] GetProcessHeap () returned 0xfd0000 [0177.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\RZ8OSEEE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45e6c6af, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x45e6c6af, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x45e6c6af, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.360] GetProcessHeap () returned 0xfd0000 [0177.360] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.360] GetProcessHeap () returned 0xfd0000 [0177.360] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.360] GetProcessHeap () returned 0xfd0000 [0177.360] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4446aeac, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x4446aeac, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x4446aeac, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0177.361] GetProcessHeap () returned 0xfd0000 [0177.361] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.361] GetProcessHeap () returned 0xfd0000 [0177.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4446aeac, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x4446aeac, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x4446aeac, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.362] GetProcessHeap () returned 0xfd0000 [0177.362] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.362] GetProcessHeap () returned 0xfd0000 [0177.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0177.363] GetProcessHeap () returned 0xfd0000 [0177.363] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.363] GetProcessHeap () returned 0xfd0000 [0177.363] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb1af8a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x447fe759, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x447fe759, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0177.363] GetProcessHeap () returned 0xfd0000 [0177.363] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\idyl1t3\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb1af8a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xabb1af8a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabb1af8a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0177.363] GetProcessHeap () returned 0xfd0000 [0177.363] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.363] GetProcessHeap () returned 0xfd0000 [0177.363] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\p1nh3xb\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447fe759, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x45933233, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x45933233, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.364] GetProcessHeap () returned 0xfd0000 [0177.364] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.364] GetProcessHeap () returned 0xfd0000 [0177.364] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.364] GetProcessHeap () returned 0xfd0000 [0177.364] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1092cc59, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x6b9a2df3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6b9a2df3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.376] GetProcessHeap () returned 0xfd0000 [0177.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.376] GetProcessHeap () returned 0xfd0000 [0177.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4349f648, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x4349f648, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5c26bd14, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.382] GetProcessHeap () returned 0xfd0000 [0177.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4349f648, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0xabbf3518, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xb4cc42b6, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.386] GetProcessHeap () returned 0xfd0000 [0177.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.386] GetProcessHeap () returned 0xfd0000 [0177.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c26bd14, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0xa58a8538, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xb4a24886, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.405] GetProcessHeap () returned 0xfd0000 [0177.405] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.406] GetProcessHeap () returned 0xfd0000 [0177.406] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.406] GetProcessHeap () returned 0xfd0000 [0177.406] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\TabRoaming\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.406] GetProcessHeap () returned 0xfd0000 [0177.406] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.406] GetProcessHeap () returned 0xfd0000 [0177.406] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a5b1f55, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5a5b1f55, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5a72f6ee, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.407] GetProcessHeap () returned 0xfd0000 [0177.407] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a5b1f55, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5a5b1f55, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5a696d49, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.407] GetProcessHeap () returned 0xfd0000 [0177.407] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.407] GetProcessHeap () returned 0xfd0000 [0177.407] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin21042551290\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a72f6ee, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5a72f6ee, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5a72f6ee, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.429] GetProcessHeap () returned 0xfd0000 [0177.429] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.429] GetProcessHeap () returned 0xfd0000 [0177.429] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.429] GetProcessHeap () returned 0xfd0000 [0177.429] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Tracking Protection\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.430] GetProcessHeap () returned 0xfd0000 [0177.430] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.430] GetProcessHeap () returned 0xfd0000 [0177.430] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b374a10, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x9b374a10, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x9b374a10, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.430] GetProcessHeap () returned 0xfd0000 [0177.430] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.430] GetProcessHeap () returned 0xfd0000 [0177.430] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.431] GetProcessHeap () returned 0xfd0000 [0177.431] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb473f3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3c685c43, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x3c685c43, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.432] GetProcessHeap () returned 0xfd0000 [0177.433] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb473f3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xabb473f3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabb473f3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0177.433] GetProcessHeap () returned 0xfd0000 [0177.433] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabb473f3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xabb6d796, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabb6d796, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.434] GetProcessHeap () returned 0xfd0000 [0177.434] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\000165C9\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c9ad963, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc61bbb37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3c9d3bae, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.439] GetProcessHeap () returned 0xfd0000 [0177.439] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.439] GetProcessHeap () returned 0xfd0000 [0177.439] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.439] GetProcessHeap () returned 0xfd0000 [0177.439] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.441] GetProcessHeap () returned 0xfd0000 [0177.441] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c685c43, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x3c685c43, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x3c685c43, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.442] GetProcessHeap () returned 0xfd0000 [0177.442] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.442] GetProcessHeap () returned 0xfd0000 [0177.442] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.442] GetProcessHeap () returned 0xfd0000 [0177.442] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0db3a8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa3009cf0, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa3009cf0, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.443] GetProcessHeap () returned 0xfd0000 [0177.443] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0db3a8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc9a20d0e, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xc9a20d0e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.529] GetProcessHeap () returned 0xfd0000 [0177.529] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\BackstageInAppNavCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bde06c6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x2bde06c6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x2bde06c6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.531] GetProcessHeap () returned 0xfd0000 [0177.531] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\BackstageInAppNavCache\\MyComputer\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bde06c6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x2bde06c6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x2bde06c6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.533] GetProcessHeap () returned 0xfd0000 [0177.533] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.533] GetProcessHeap () returned 0xfd0000 [0177.533] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.533] GetProcessHeap () returned 0xfd0000 [0177.533] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\Floodgate\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe17ea40e, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xe17ea40e, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x77060bd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.540] GetProcessHeap () returned 0xfd0000 [0177.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.541] GetProcessHeap () returned 0xfd0000 [0177.541] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c194002, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x7c194002, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x7c194002, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.543] GetProcessHeap () returned 0xfd0000 [0177.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0177.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c194002, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xbb2b8178, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbb2b8178, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.546] GetProcessHeap () returned 0xfd0000 [0177.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c194002, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xbd9bb0d5, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xbda07330, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.549] GetProcessHeap () returned 0xfd0000 [0177.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.550] GetProcessHeap () returned 0xfd0000 [0177.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0177.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\omextemplates.content.office.net\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d18330f, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x7d5b0f86, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xbb21f846, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.558] GetProcessHeap () returned 0xfd0000 [0177.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0177.558] GetProcessHeap () returned 0xfd0000 [0177.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0177.558] GetProcessHeap () returned 0xfd0000 [0177.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.560] GetProcessHeap () returned 0xfd0000 [0177.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.560] GetProcessHeap () returned 0xfd0000 [0177.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Office\\OTele\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3009cf0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xb425304a, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb4279206, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.564] GetProcessHeap () returned 0xfd0000 [0177.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.564] GetProcessHeap () returned 0xfd0000 [0177.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0177.564] GetProcessHeap () returned 0xfd0000 [0177.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0177.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e02a2a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0177.564] GetProcessHeap () returned 0xfd0000 [0177.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4244211c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45981b75, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45fc3e4e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0177.565] GetProcessHeap () returned 0xfd0000 [0177.565] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313\\images\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45fc3e4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45fc3e4e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45fc3e4e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.566] GetProcessHeap () returned 0xfd0000 [0177.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.566] GetProcessHeap () returned 0xfd0000 [0177.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.566] GetProcessHeap () returned 0xfd0000 [0177.566] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62cd1c1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94192bdc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94192bdc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.572] GetProcessHeap () returned 0xfd0000 [0177.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\af\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a32b5c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79a32b5c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b80026d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.573] GetProcessHeap () returned 0xfd0000 [0177.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.573] GetProcessHeap () returned 0xfd0000 [0177.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\am-et\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c6e6df3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c6e6df3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d50edb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.573] GetProcessHeap () returned 0xfd0000 [0177.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.573] GetProcessHeap () returned 0xfd0000 [0177.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\amd64\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d535015, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92eeb4b7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x995052d5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.577] GetProcessHeap () returned 0xfd0000 [0177.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.577] GetProcessHeap () returned 0xfd0000 [0177.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\images\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62e75769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x65ebd293, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6648cf42, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.579] GetProcessHeap () returned 0xfd0000 [0177.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.579] GetProcessHeap () returned 0xfd0000 [0177.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\is\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x664b30ca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x664b30ca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x669ea1ca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.580] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x664b30ca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x664b30ca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x669ea1ca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.580] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669ea1ca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x669ea1ca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66a3667f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.580] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669ea1ca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x669ea1ca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66a3667f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.580] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.580] GetProcessHeap () returned 0xfd0000 [0177.581] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.581] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66a3667f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66a3667f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66efb348, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0177.581] GetProcessHeap () returned 0xfd0000 [0177.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\it\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66a3667f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66a3667f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66efb348, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.581] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66a3667f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66a3667f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66efb348, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.581] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66efb348, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66efb348, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66f215aa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.581] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66efb348, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66efb348, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66f215aa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.581] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.581] GetProcessHeap () returned 0xfd0000 [0177.581] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.581] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66fb9e02, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66fb9e02, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x676222fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0177.581] GetProcessHeap () returned 0xfd0000 [0177.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ja\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66fb9e02, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66fb9e02, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x676222fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.582] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66fb9e02, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66fb9e02, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x676222fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.582] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676222fd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x676222fd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6766e7b5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x14680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.582] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676222fd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x676222fd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6766e7b5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x14680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.582] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.582] GetProcessHeap () returned 0xfd0000 [0177.582] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.582] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6766e7b5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6766e7b5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x67c8a82f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0177.582] GetProcessHeap () returned 0xfd0000 [0177.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ka\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6766e7b5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6766e7b5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x67c8a82f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.583] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6766e7b5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6766e7b5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x67c8a82f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.583] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c8a82f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x67c8a82f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x67cd6ce4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20078, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.583] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c8a82f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x67c8a82f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x67cd6ce4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20078, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.583] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0177.583] GetProcessHeap () returned 0xfd0000 [0177.583] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.583] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67cd6ce4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x67cd6ce4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x683b195f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0177.584] GetProcessHeap () returned 0xfd0000 [0177.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\kk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67cd6ce4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x67cd6ce4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x683b195f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.584] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67cd6ce4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x67cd6ce4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x683b195f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.584] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683b195f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x683b195f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x683d7ba5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1fa80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.584] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683b195f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x683b195f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x683d7ba5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1fa80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.584] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.697] GetProcessHeap () returned 0xfd0000 [0177.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.697] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x683d7ba5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x683d7ba5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6895b2c6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km-kh", cAlternateFileName="")) returned 1 [0177.697] GetProcessHeap () returned 0xfd0000 [0177.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\km-kh\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x683d7ba5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x683d7ba5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6895b2c6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0177.698] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x683d7ba5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x683d7ba5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6895b2c6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.698] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6895b2c6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6895b2c6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x689a779d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1de78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.698] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6895b2c6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6895b2c6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x689a779d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1de78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.698] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0177.700] GetProcessHeap () returned 0xfd0000 [0177.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.701] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x689a779d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x689a779d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x68f9d5af, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0177.701] GetProcessHeap () returned 0xfd0000 [0177.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\kn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x689a779d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x689a779d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x68f9d5af, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.702] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x689a779d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x689a779d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x68f9d5af, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.702] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f9d5af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x68f9d5af, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6929867f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.702] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f9d5af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x68f9d5af, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6929867f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.702] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.702] GetProcessHeap () returned 0xfd0000 [0177.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.702] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6929867f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6929867f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x698680a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0177.702] GetProcessHeap () returned 0xfd0000 [0177.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ko\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6929867f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6929867f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x698680a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.703] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6929867f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6929867f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x698680a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.703] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698680a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x698680a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x698b455c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x13880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.703] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698680a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x698680a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x698b455c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x13880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.703] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.703] GetProcessHeap () returned 0xfd0000 [0177.704] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.704] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x698b455c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x698b455c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69d790b9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kok", cAlternateFileName="")) returned 1 [0177.704] GetProcessHeap () returned 0xfd0000 [0177.704] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\kok\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x698b455c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x698b455c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69d790b9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.706] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x698b455c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x698b455c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69d790b9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.706] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d790b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69d790b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69d9f315, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.706] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d790b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69d790b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69d9f315, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.706] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.706] GetProcessHeap () returned 0xfd0000 [0177.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.706] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69d9f315, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69d9f315, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6acf85b2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ku-arab", cAlternateFileName="")) returned 1 [0177.706] GetProcessHeap () returned 0xfd0000 [0177.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ku-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69d9f315, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69d9f315, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6acf85b2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.707] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69d9f315, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69d9f315, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6acf85b2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.707] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6acf85b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6acf85b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6b491e37, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.707] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6acf85b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6acf85b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6b491e37, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.707] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.707] GetProcessHeap () returned 0xfd0000 [0177.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.707] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ef2a5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6b9ef2a5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d7706a5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ky", cAlternateFileName="")) returned 1 [0177.708] GetProcessHeap () returned 0xfd0000 [0177.708] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ky\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ef2a5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6b9ef2a5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d7706a5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.708] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ef2a5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6b9ef2a5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d7706a5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.708] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7706a5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d7706a5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6e67d2d9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.709] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7706a5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d7706a5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6e67d2d9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.709] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.709] GetProcessHeap () returned 0xfd0000 [0177.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.709] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e762101, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6e762101, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f7a01b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-lu", cAlternateFileName="")) returned 1 [0177.709] GetProcessHeap () returned 0xfd0000 [0177.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\lb-lu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e762101, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6e762101, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f7a01b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.715] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e762101, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6e762101, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f7a01b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.716] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7a01b3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f7a01b3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f812a39, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x21680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.716] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7a01b3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f7a01b3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f812a39, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x21680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.716] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.716] GetProcessHeap () returned 0xfd0000 [0177.716] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.716] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f984dd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x63f984dd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x63fe4992, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x6880, dwReserved0=0x0, dwReserved1=0x0, cFileName="libEGL.dll", cAlternateFileName="")) returned 1 [0177.716] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x640a3555, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x640a3555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x640efa0d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e9a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0177.716] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x641ae5e2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x641ae5e2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x64947f51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x18078, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 1 [0177.716] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f812a39, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f812a39, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7082a726, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0177.716] GetProcessHeap () returned 0xfd0000 [0177.716] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\lt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f812a39, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f812a39, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7082a726, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.717] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f812a39, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f812a39, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7082a726, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.717] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7082a726, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7082a726, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71082c64, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f678, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.717] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7082a726, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7082a726, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71082c64, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f678, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.717] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.717] GetProcessHeap () returned 0xfd0000 [0177.717] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.717] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x712bee62, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x712bee62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72074711, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0177.717] GetProcessHeap () returned 0xfd0000 [0177.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\lv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x712bee62, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x712bee62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72074711, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.719] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x712bee62, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x712bee62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72074711, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.719] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72074711, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72074711, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7274f380, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1ee80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.719] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72074711, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72074711, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7274f380, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1ee80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.719] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.719] GetProcessHeap () returned 0xfd0000 [0177.719] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.719] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7298b859, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7298b859, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x738be721, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi-nz", cAlternateFileName="")) returned 1 [0177.719] GetProcessHeap () returned 0xfd0000 [0177.719] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\mi-nz\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7298b859, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7298b859, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x738be721, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.720] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7298b859, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7298b859, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x738be721, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.720] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x738be721, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x738be721, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x738e4aec, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.720] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x738be721, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x738be721, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x738e4aec, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.720] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.720] GetProcessHeap () returned 0xfd0000 [0177.720] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.720] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738e4aec, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x738e4aec, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7400ba78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mk", cAlternateFileName="")) returned 1 [0177.720] GetProcessHeap () returned 0xfd0000 [0177.720] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\mk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738e4aec, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x738e4aec, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7400ba78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.721] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738e4aec, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x738e4aec, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7400ba78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.721] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7400ba78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7400ba78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74568f5f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.721] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7400ba78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7400ba78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74568f5f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.721] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.721] GetProcessHeap () returned 0xfd0000 [0177.721] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.721] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d4ec0d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74d4ec0d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7574a9fb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml-in", cAlternateFileName="")) returned 1 [0177.721] GetProcessHeap () returned 0xfd0000 [0177.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ml-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d4ec0d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74d4ec0d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7574a9fb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.722] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d4ec0d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74d4ec0d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7574a9fb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.722] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7574a9fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7574a9fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x760fa2d7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x22480, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.722] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7574a9fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7574a9fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x760fa2d7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x22480, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.722] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.722] GetProcessHeap () returned 0xfd0000 [0177.722] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.722] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x766577c4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x766577c4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772b5b3d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0177.722] GetProcessHeap () returned 0xfd0000 [0177.722] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\mn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x766577c4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x766577c4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772b5b3d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0177.723] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x766577c4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x766577c4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772b5b3d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.723] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772b5b3d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772b5b3d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7791e076, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.723] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772b5b3d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772b5b3d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7791e076, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.723] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0177.723] GetProcessHeap () returned 0xfd0000 [0177.723] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.723] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b5a3c7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77b5a3c7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x78c0ab9c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0177.724] GetProcessHeap () returned 0xfd0000 [0177.724] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\mr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b5a3c7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77b5a3c7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x78c0ab9c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.724] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b5a3c7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77b5a3c7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x78c0ab9c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.724] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c0ab9c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x78c0ab9c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x78ca353b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.724] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c0ab9c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x78c0ab9c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x78ca353b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1e880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.725] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.725] GetProcessHeap () returned 0xfd0000 [0177.725] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.725] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ca353b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x78ca353b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7994dd40, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0177.725] GetProcessHeap () returned 0xfd0000 [0177.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ca353b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x78ca353b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7994dd40, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.725] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ca353b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x78ca353b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7994dd40, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.725] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7994dd40, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7994dd40, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7999a1e6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f280, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7994dd40, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7994dd40, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7999a1e6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f280, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.726] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.726] GetProcessHeap () returned 0xfd0000 [0177.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64a52e75, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x64a52e75, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x64a9f327, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x6f080, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64c68f6a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x64c68f6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x64cb5428, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xece78, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x799c044b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x799c044b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ba1636c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mt-mt", cAlternateFileName="")) returned 1 [0177.726] GetProcessHeap () returned 0xfd0000 [0177.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\mt-mt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x799c044b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x799c044b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ba1636c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.726] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x799c044b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x799c044b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ba1636c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ba1636c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ba1636c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c7f1e77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ba1636c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ba1636c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c7f1e77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f680, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.726] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.726] GetProcessHeap () returned 0xfd0000 [0177.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.726] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c88a7da, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c88a7da, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d82ff2c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0177.727] GetProcessHeap () returned 0xfd0000 [0177.727] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\nb-no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c88a7da, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c88a7da, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d82ff2c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.727] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c88a7da, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c88a7da, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d82ff2c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.727] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82ff2c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d82ff2c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7de4bfc8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1d880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.727] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82ff2c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d82ff2c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7de4bfc8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1d880, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.727] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.727] GetProcessHeap () returned 0xfd0000 [0177.727] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.727] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dee4913, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dee4913, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ea37c2a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne-np", cAlternateFileName="")) returned 1 [0177.727] GetProcessHeap () returned 0xfd0000 [0177.727] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\ne-np\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dee4913, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dee4913, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ea37c2a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.728] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dee4913, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dee4913, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ea37c2a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.728] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ea37c2a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ea37c2a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f1d144c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20078, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.728] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ea37c2a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ea37c2a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f1d144c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20078, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.728] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.728] GetProcessHeap () returned 0xfd0000 [0177.728] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.728] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2dc4c4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f2dc4c4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7fae83f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0177.728] GetProcessHeap () returned 0xfd0000 [0177.728] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\nl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2dc4c4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f2dc4c4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7fae83f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.731] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2dc4c4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f2dc4c4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7fae83f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.731] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fae83f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7fae83f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1fc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.731] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fae83f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7fae83f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1fc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.731] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.731] GetProcessHeap () returned 0xfd0000 [0177.731] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.731] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80687bb0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80687bb0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x821f8fe4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-no", cAlternateFileName="")) returned 1 [0177.731] GetProcessHeap () returned 0xfd0000 [0177.731] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\nn-no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80687bb0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80687bb0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x821f8fe4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0177.732] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80687bb0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80687bb0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x821f8fe4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.732] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f8fe4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x821f8fe4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83499640, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1d480, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.732] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f8fe4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x821f8fe4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83499640, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1d480, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.732] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0177.732] GetProcessHeap () returned 0xfd0000 [0177.732] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.732] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x841f8082, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x841f8082, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x87940ac2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nso-za", cAlternateFileName="")) returned 1 [0177.732] GetProcessHeap () returned 0xfd0000 [0177.732] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\nso-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x841f8082, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x841f8082, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x87940ac2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.733] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x841f8082, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x841f8082, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x87940ac2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.733] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87940ac2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x87940ac2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8878ec7a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20480, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.733] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87940ac2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x87940ac2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8878ec7a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20480, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.733] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.733] GetProcessHeap () returned 0xfd0000 [0177.733] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.733] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e0c952, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x64e0c952, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x64e32bb1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x16f678, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1 [0177.733] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x651a039f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x651a039f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6521297f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveLogo.png", cAlternateFileName="ONEDRI~1.PNG")) returned 1 [0177.734] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6544ec4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6544ec4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6544ec4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrivePersonal.cmd", cAlternateFileName="ONEDRI~1.CMD")) returned 1 [0177.734] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655f2628, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x655f2628, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6563eae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1a4478, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveStandaloneUpdater.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0177.734] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8884d827, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8884d827, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x89a7b782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="or-in", cAlternateFileName="")) returned 1 [0177.734] GetProcessHeap () returned 0xfd0000 [0177.734] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\or-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8884d827, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8884d827, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x89a7b782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.734] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8884d827, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8884d827, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x89a7b782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.735] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a7b782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x89a7b782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8bbdc723, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x21a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.735] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a7b782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x89a7b782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8bbdc723, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x21a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.735] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.735] GetProcessHeap () returned 0xfd0000 [0177.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.735] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c2dd635, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8c2dd635, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8dfe14e2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa", cAlternateFileName="")) returned 1 [0177.735] GetProcessHeap () returned 0xfd0000 [0177.735] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\pa\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c2dd635, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8c2dd635, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8dfe14e2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.736] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c2dd635, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8c2dd635, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8dfe14e2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.736] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dfe14e2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8dfe14e2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8ef09cab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f280, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.736] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dfe14e2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8dfe14e2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8ef09cab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1f280, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.736] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.736] GetProcessHeap () returned 0xfd0000 [0177.736] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f41accd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f41accd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x90838ac4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa-arab", cAlternateFileName="")) returned 1 [0177.736] GetProcessHeap () returned 0xfd0000 [0177.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\pa-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f41accd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f41accd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x90838ac4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0177.737] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f41accd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f41accd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x90838ac4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.737] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90838ac4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x90838ac4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x915a1ebb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1ec80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.737] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90838ac4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x90838ac4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x915a1ebb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1ec80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.737] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0177.737] GetProcessHeap () returned 0xfd0000 [0177.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.737] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9176bafe, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9176bafe, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x91fc3ef2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa-arab-pk", cAlternateFileName="PA-ARA~1")) returned 1 [0177.737] GetProcessHeap () returned 0xfd0000 [0177.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\pa-arab-pk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9176bafe, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9176bafe, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x91fc3ef2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.738] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9176bafe, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9176bafe, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x91fc3ef2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.738] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc3ef2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91fc3ef2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92d10e9e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1ec80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.738] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc3ef2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91fc3ef2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92d10e9e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1ec80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.738] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.738] GetProcessHeap () returned 0xfd0000 [0177.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.738] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92fa272d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92fa272d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x93cb15c0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0177.738] GetProcessHeap () returned 0xfd0000 [0177.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\pl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92fa272d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92fa272d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x93cb15c0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.739] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92fa272d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92fa272d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x93cb15c0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.739] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cb15c0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x93cb15c0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9412f7df, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.739] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93cb15c0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x93cb15c0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9412f7df, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x20c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.739] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.740] GetProcessHeap () returned 0xfd0000 [0177.740] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.740] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94192bdc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94192bdc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x95e55260, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="platforms", cAlternateFileName="PLATFO~1")) returned 1 [0177.740] GetProcessHeap () returned 0xfd0000 [0177.740] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6816.0313_1\\platforms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94192bdc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94192bdc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x95e55260, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.740] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94192bdc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94192bdc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x95e55260, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.740] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e55260, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x95e55260, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c8ba415, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x48000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 1 [0177.740] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e55260, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x95e55260, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c8ba415, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x48000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 0 [0177.741] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.741] GetProcessHeap () returned 0xfd0000 [0177.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.741] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65808733, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x65808733, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x65939a33, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x478c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Core.dll", cAlternateFileName="")) returned 1 [0177.741] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b9bfab, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x65b9bfab, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66060b50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x50c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5DBus.dll", cAlternateFileName="")) returned 1 [0177.741] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663a7ede, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x663a7ede, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66597d74, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4a8480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Gui.dll", cAlternateFileName="")) returned 1 [0177.741] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668b8ef0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x668b8ef0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x668df14f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xd3280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Network.dll", cAlternateFileName="QT5NET~1.DLL")) returned 1 [0177.741] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66eaeea0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x66eaeea0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x66f215aa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x44e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5PrintSupport.dll", cAlternateFileName="QT5PRI~1.DLL")) returned 1 [0177.742] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672daf1e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x672daf1e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x673273d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x269280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Qml.dll", cAlternateFileName="")) returned 1 [0177.742] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676222fd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x676222fd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6770711e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x27c280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Quick.dll", cAlternateFileName="")) returned 1 [0177.742] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679696bc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x679696bc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x679b5b74, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x11a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5QuickControls2.dll", cAlternateFileName="QT5QUI~1.DLL")) returned 1 [0177.802] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c8a82f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x67c8a82f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x67d49401, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x7a480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5QuickTemplates2.dll", cAlternateFileName="QT5QUI~2.DLL")) returned 1 [0177.809] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6838b6e1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6838b6e1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x683d7ba5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x41280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Svg.dll", cAlternateFileName="")) returned 1 [0177.809] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6885024e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6885024e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6890edf2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x44b280, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Widgets.dll", cAlternateFileName="QT5WID~1.DLL")) returned 1 [0177.809] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68d6125d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x68d6125d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x68d874b9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x3be80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5WinExtras.dll", cAlternateFileName="QT5WIN~1.DLL")) returned 1 [0177.816] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x692722dd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x692722dd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6929867f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2266, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaCritical.png", cAlternateFileName="QUOTAC~1.PNG")) returned 1 [0177.822] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x696ea90f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x696ea90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69710b74, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaError.png", cAlternateFileName="QUOTAE~1.PNG")) returned 1 [0177.830] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69aca657, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x69aca657, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x69b16b0c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x1d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaNearing.png", cAlternateFileName="QUOTAN~1.PNG")) returned 1 [0177.830] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1f175f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6a1f175f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6b03f98a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x95878, dwReserved0=0x0, dwReserved1=0x0, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf18113, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6cf18113, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6e762101, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x3b721, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScreenshotOptIn.gif", cAlternateFileName="SCREEN~1.GIF")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ec668, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f7ec668, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f812a39, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x32078, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705ee3d2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x705ee3d2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x709357eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xa080, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqmWrapper.dll", cAlternateFileName="SQMWRA~1.DLL")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef6f73, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ef6f73, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x739a353d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x45fe78, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7496eece, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7496eece, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7587bcf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4da80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769c4dd9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x769c4dd9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772b5b3d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78091616, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x78091616, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7863afb8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="Warning.png", cAlternateFileName="")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79462f6b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79462f6b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7999a1e6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f478, dwReserved0=0x0, dwReserved1=0x0, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79462f6b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79462f6b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7999a1e6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f478, dwReserved0=0x0, dwReserved1=0x0, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 0 [0177.832] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.832] GetProcessHeap () returned 0xfd0000 [0177.832] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.832] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99698e57, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xfc44d7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfc44d7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.6998.0830", cAlternateFileName="173699~1.083")) returned 1 [0177.835] GetProcessHeap () returned 0xfd0000 [0177.835] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99698e57, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xfc44d7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfc44d7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.835] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99698e57, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xfc44d7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfc44d7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.835] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99698e57, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0xfc44d7b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xfc44d7b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.835] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0177.836] GetProcessHeap () returned 0xfd0000 [0177.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.836] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fe5d7d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4d63219e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4d63219e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.7076.1026", cAlternateFileName="173707~1.102")) returned 1 [0177.836] GetProcessHeap () returned 0xfd0000 [0177.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fe5d7d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4d63219e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4d8482cc, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.838] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fe5d7d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4d63219e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4d8482cc, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432220cc, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x432220cc, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x432220cc, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xd5ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="adal.dll", cAlternateFileName="")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432483c3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x432483c3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x432483c3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="alertIcon.png", cAlternateFileName="ALERTI~1.PNG")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4326e587, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4326e587, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x432baa3b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432baa3b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x432baa3b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x432baa3b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432e0d21, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x432e0d21, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x432e0d21, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43306ef9, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43306ef9, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43306ef9, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4332d1b3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4332d1b3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4332d1b3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x54c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="AP87F4~1.DLL")) returned 1 [0177.841] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433533b1, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x433533b1, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x433533b1, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433533b1, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x433533b1, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x433533b1, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="APC7B0~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4337960b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4337960b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4337960b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="AP4F63~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4339f8f1, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4339f8f1, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4339f8f1, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="AP26B7~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433c5ab8, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x433c5ab8, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x433c5ab8, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="AP40C7~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433ebd08, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x433ebd08, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x433ebd08, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="APD0F3~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433ebd08, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x433ebd08, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x433ebd08, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x50c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="AP6221~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43411f70, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43411f70, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43411f70, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="AP25B1~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434381b9, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x434381b9, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4345e41a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="AP8526~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4345e41a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4345e41a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4345e41a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="AP507A~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43484682, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43484682, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43484682, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="APEF2A~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434d0b3d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x434d0b3d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x434d0b3d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1 [0177.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434f6d90, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x434f6d90, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x434f6d90, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x44c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="AP5574~1.DLL")) returned 1 [0177.843] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434f6d90, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x434f6d90, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x434f6d90, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x44c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="APDC30~1.DLL")) returned 1 [0177.843] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4351cff1, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4351cff1, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4351cff1, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="AP743F~1.DLL")) returned 1 [0177.843] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435432b8, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x435432b8, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x435432b8, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="AP7678~1.DLL")) returned 1 [0177.843] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435694a2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x435694a2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4358f6e7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0177.843] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435b5953, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x435b5953, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x435b5953, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="APFAD9~1.DLL")) returned 1 [0177.844] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435dbbba, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x435dbbba, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x435dbbba, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0177.844] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43601e14, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43601e14, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4362805d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="APF2DB~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4364e2c2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4364e2c2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4364e2c2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4367452a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4367452a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4367452a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x56c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4369a779, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4369a779, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4369a779, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436c09da, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x436c09da, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4373317b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x439bb982, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x439bb982, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43a7a4f2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac695b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43ac695b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43ac695b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43b12e49, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43b12e49, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43b39099, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x70c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43b5f2f0, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43b5f2f0, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43b5f2f0, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x66c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43b85540, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43b85540, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43b85540, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x11cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bab77b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43bab77b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43bab77b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bab77b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43bab77b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43bab77b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x58c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bd19ea, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43bd19ea, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43bd19ea, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x5ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0177.845] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bf7c41, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43bf7c41, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43bf7c41, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x5ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c1de9b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43c1de9b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43c1de9b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x50c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c1de9b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43c1de9b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43c1de9b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c440fc, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43c440fc, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43c440fc, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x157b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppBlue.png", cAlternateFileName="")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c6a348, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43c6a348, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43c6a348, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1d96, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppErrorBlue.png", cAlternateFileName="APPERR~1.PNG")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c905a2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43c905a2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43c905a2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppErrorWhite.png", cAlternateFileName="APPERR~2.PNG")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c905a2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43c905a2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43c905a2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xbeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppWhite.png", cAlternateFileName="")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43cb6811, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43cb6811, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43cb6811, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43cdca64, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43cdca64, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43cdca64, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~1.PNG")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d02cc5, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43d02cc5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43d02cc5, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1914, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSyncLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d28f1f, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43d28f1f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43d28f1f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1cd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElevatedAppBlue.png", cAlternateFileName="ELEVAT~1.PNG")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d4f17d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43d4f17d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43d4f17d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x13cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElevatedAppWhite.png", cAlternateFileName="ELEVAT~2.PNG")) returned 1 [0177.846] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d753cc, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43d753cc, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43d753cc, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1e64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Error.png", cAlternateFileName="")) returned 1 [0177.847] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d9b627, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43d9b627, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43d9b627, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ErrorPage.html", cAlternateFileName="ERRORP~1.HTM")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43dc1881, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43dc1881, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43dc1881, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43de7adb, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43de7adb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43e0dd2e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x3fcc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuth.exe", cAlternateFileName="FILECO~1.EXE")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43e5a208, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43e5a208, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43e5a208, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x268c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuthLib.dll", cAlternateFileName="FILECO~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441eda6d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x441eda6d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x441eda6d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x206c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44450056, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x44450056, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x444762b0, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xab4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446feaa9, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x446feaa9, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4474af37, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xb9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448c86c0, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x448c86c0, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x448c86c0, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2fb2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449d3741, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x449d3741, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x449d3741, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x40ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44ade7be, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x44ade7be, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x44ade7be, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x120c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncFAL.dll", cAlternateFileName="FI0695~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44d66fd9, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x44d66fd9, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x44d66fd9, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x340c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncFALWB.dll", cAlternateFileName="FI7839~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44fef89b, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x44fef89b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45088144, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x176ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45251d87, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45251d87, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45277fd0, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x27f6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x454b43f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x454b43f3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x454b43f3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0xd50c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncViews.dll", cAlternateFileName="FI224F~1.DLL")) returned 1 [0177.848] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43817f3c, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43817f3c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x43817f3c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0177.849] GetProcessHeap () returned 0xfd0000 [0177.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\gl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43817f3c, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43817f3c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45015a88, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.849] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43817f3c, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x43817f3c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45015a88, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.849] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45015a88, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45015a88, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45088144, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x248c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.849] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45015a88, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45015a88, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45088144, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x248c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.849] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.850] GetProcessHeap () returned 0xfd0000 [0177.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.850] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x450fa84f, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x450fa84f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x450fa84f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0177.850] GetProcessHeap () returned 0xfd0000 [0177.850] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\gu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x450fa84f, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x450fa84f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45f6ecb7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.850] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x450fa84f, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x450fa84f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45f6ecb7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.850] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f6ecb7, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45f6ecb7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45f6ecb7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x238c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.850] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f6ecb7, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45f6ecb7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45f6ecb7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x238c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.850] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.850] GetProcessHeap () returned 0xfd0000 [0177.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.850] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f6ecb7, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45f6ecb7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x45f6ecb7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ha-latn-ng", cAlternateFileName="HA-LAT~1")) returned 1 [0177.851] GetProcessHeap () returned 0xfd0000 [0177.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\ha-latn-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f6ecb7, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45f6ecb7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e09392, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.852] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f6ecb7, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x45f6ecb7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e09392, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.852] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46e09392, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x46e09392, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e09392, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.852] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46e09392, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x46e09392, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e09392, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.852] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.852] GetProcessHeap () returned 0xfd0000 [0177.852] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.852] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46e09392, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x46e09392, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e09392, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0177.852] GetProcessHeap () returned 0xfd0000 [0177.852] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\he\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46e09392, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x46e09392, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x478515fa, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0177.853] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46e09392, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x46e09392, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x478515fa, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.853] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478515fa, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x478515fa, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x479a8b8f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1d2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.853] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478515fa, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x478515fa, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x479a8b8f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1d2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.853] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0177.853] GetProcessHeap () returned 0xfd0000 [0177.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.853] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479a8b8f, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x479a8b8f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x479a8b8f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0177.854] GetProcessHeap () returned 0xfd0000 [0177.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\hi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479a8b8f, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x479a8b8f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x48decbf3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.861] GetProcessHeap () returned 0xfd0000 [0177.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.861] GetProcessHeap () returned 0xfd0000 [0177.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\hr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48decbf3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x48decbf3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4bac7060, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.861] GetProcessHeap () returned 0xfd0000 [0177.861] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.862] GetProcessHeap () returned 0xfd0000 [0177.862] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\hu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bac7060, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4bac7060, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4cc5c63a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.862] GetProcessHeap () returned 0xfd0000 [0177.862] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.862] GetProcessHeap () returned 0xfd0000 [0177.862] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\hy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cc5c63a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4cc5c63a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4d67e648, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0177.862] GetProcessHeap () returned 0xfd0000 [0177.862] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.863] GetProcessHeap () returned 0xfd0000 [0177.863] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7076.1026\\id\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d8482cc, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x4d8482cc, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4d8482cc, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.863] GetProcessHeap () returned 0xfd0000 [0177.863] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.863] GetProcessHeap () returned 0xfd0000 [0177.863] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0177.864] GetProcessHeap () returned 0xfd0000 [0177.864] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0177.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec96f546, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0177.871] GetProcessHeap () returned 0xfd0000 [0177.871] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\adm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4c891e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfeabe74d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff14df10, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.872] GetProcessHeap () returned 0xfd0000 [0177.872] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.873] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff14df10, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff14df10, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff14df10, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0177.873] GetProcessHeap () returned 0xfd0000 [0177.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\af\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff14df10, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff14df10, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff7db67a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.873] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff14df10, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff14df10, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff7db67a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.873] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7db67a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff7db67a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff7db67a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x242c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.873] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7db67a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff7db67a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff7db67a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x242c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.873] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0177.873] GetProcessHeap () returned 0xfd0000 [0177.873] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.873] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd25c76, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecd25c76, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecd25c76, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="alertIcon.png", cAlternateFileName="ALERTI~1.PNG")) returned 1 [0177.873] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff7db67a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff7db67a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff7db67a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am-et", cAlternateFileName="")) returned 1 [0177.873] GetProcessHeap () returned 0xfd0000 [0177.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\am-et\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff7db67a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff7db67a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x249b52, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.874] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff7db67a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff7db67a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x249b52, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.874] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249b52, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x249b52, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x249b52, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1aac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.874] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249b52, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x249b52, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x249b52, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1aac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.874] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.874] GetProcessHeap () returned 0xfd0000 [0177.875] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.875] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249b52, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1071af7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1071af7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0177.875] GetProcessHeap () returned 0xfd0000 [0177.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\amd64\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249b52, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1071af7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a3c82, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.877] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249b52, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1071af7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a3c82, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.877] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd111, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9bd111, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9bd111, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuthLib64.dll", cAlternateFileName="FILECO~1.DLL")) returned 1 [0177.877] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1071af7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1071af7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10bdfa4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xff4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi64.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0177.877] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17264e1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17264e1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a3c82, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x2ccac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0177.877] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17264e1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17264e1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a3c82, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x2ccac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 0 [0177.877] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.880] GetProcessHeap () returned 0xfd0000 [0177.880] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.880] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd4bed3, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecd4bed3, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecd4bed3, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0177.880] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd81e4c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecd81e4c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecd81e4c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0177.880] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd9b880, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecd9b880, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecd9cc21, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0177.880] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda54d9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecda54d9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecda54d9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0177.880] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdcb7f9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecdcb7f9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecdcb7f9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x54c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="AP87F4~1.DLL")) returned 1 [0177.880] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdcb7f9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecdcb7f9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecdcb7f9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf1a53, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecdf1a53, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecdf1a53, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="APC7B0~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece17cad, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xece17cad, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xece17cad, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="AP4F63~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece3df22, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xece3df22, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xece3df22, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="AP26B7~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece3df22, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xece3df22, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xece3df22, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="AP40C7~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece6415d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xece6415d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xece6415d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="APD0F3~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece8a3b0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xece8a3b0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xece8a3b0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x50c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="AP6221~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece8a3b0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xece8a3b0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xece8a3b0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="AP25B1~1.DLL")) returned 1 [0177.881] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceb0625, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeceb0625, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeceb0625, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="AP8526~1.DLL")) returned 1 [0177.882] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeced6864, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeced6864, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeced6864, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="AP507A~1.DLL")) returned 1 [0177.882] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeced6864, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeced6864, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeced6864, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="APEF2A~1.DLL")) returned 1 [0177.882] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecefcad5, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecefcad5, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecefcad5, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1 [0177.882] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf95421, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecf95421, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecf95421, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x44c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="AP5574~1.DLL")) returned 1 [0177.882] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfbb67f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecfbb67f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecfbb67f, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x44c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="APDC30~1.DLL")) returned 1 [0177.882] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfe18e6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecfe18e6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xecfe18e6, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="AP743F~1.DLL")) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfe18e6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xecfe18e6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed007b3d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="AP7678~1.DLL")) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed007b3d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed007b3d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed007b3d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed02dda4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed02dda4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed02dda4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="APFAD9~1.DLL")) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed053fed, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed053fed, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed053fed, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed053fed, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed053fed, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed053fed, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="APF2DB~1.DLL")) returned 1 [0177.883] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed07a24e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed07a24e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed07a24e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0177.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0a049d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed0a049d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed0a049d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x56c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0177.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0c6705, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed0c6705, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed0c6705, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0177.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0c6705, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed0c6705, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed0ec958, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0177.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed112bb8, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed112bb8, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed112bb8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0177.955] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed138e16, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed138e16, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed138e16, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed15f069, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed15f069, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed15f069, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x70c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed15f069, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed15f069, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed15f069, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x66c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1852c9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed1852c9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed1852c9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x11cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1ab520, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed1ab520, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed1ab520, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1ab520, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed1ab520, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed1ab520, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x58c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1d1787, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed1d1787, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed1d1787, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x5ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1f79da, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed1f79da, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed1f79da, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x5ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed21dc2a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed21dc2a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed21dc2a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x50c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed21dc2a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed21dc2a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed21dc2a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0177.961] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed243e95, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed243e95, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed243e95, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x157b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppBlue.png", cAlternateFileName="")) returned 1 [0177.962] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26a0eb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed26a0eb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed26a0eb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1d96, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppErrorBlue.png", cAlternateFileName="APPERR~1.PNG")) returned 1 [0177.962] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed290342, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed290342, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed290342, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppErrorWhite.png", cAlternateFileName="APPERR~2.PNG")) returned 1 [0177.962] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed290342, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed290342, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed290342, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xbeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppWhite.png", cAlternateFileName="")) returned 1 [0177.962] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18c9ece, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18c9ece, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18c9ece, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0177.962] GetProcessHeap () returned 0xfd0000 [0177.962] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ar\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18c9ece, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18c9ece, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f58668, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.963] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18c9ece, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18c9ece, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f58668, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.963] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f58668, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f58668, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f58668, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1fec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.963] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f58668, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f58668, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f58668, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1fec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.963] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.963] GetProcessHeap () returned 0xfd0000 [0177.963] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.963] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f58668, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x28e1d11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x28e1d11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arm64", cAlternateFileName="")) returned 1 [0177.964] GetProcessHeap () returned 0xfd0000 [0177.964] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\arm64\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f58668, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x28e1d11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x30a181e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.965] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f58668, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x28e1d11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x30a181e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.965] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e1d11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x28e1d11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x2907f4c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1040c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi64.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0177.965] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a181e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x30a181e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x30c79de, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x2cc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0177.965] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a181e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x30a181e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x30c79de, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x2cc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 0 [0177.965] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.965] GetProcessHeap () returned 0xfd0000 [0177.965] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.965] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b3a15, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x33b3a15, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x33b3a15, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="as-in", cAlternateFileName="")) returned 1 [0177.966] GetProcessHeap () returned 0xfd0000 [0177.966] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\as-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b3a15, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x33b3a15, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x3febb32, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.966] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b3a15, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x33b3a15, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x3febb32, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.966] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3febb32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x3febb32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x3febb32, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.966] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3febb32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x3febb32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x3febb32, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.966] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0177.966] GetProcessHeap () returned 0xfd0000 [0177.967] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.967] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b659b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed2b659b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed2b659b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 1 [0177.967] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2dc7ff, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed2dc7ff, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed2dc7ff, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~1.PNG")) returned 1 [0177.967] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3febb32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x3febb32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x3febb32, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="az-latn-az", cAlternateFileName="AZ-LAT~1")) returned 1 [0177.967] GetProcessHeap () returned 0xfd0000 [0177.967] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\az-latn-az\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3febb32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x3febb32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x486a177, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0177.967] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3febb32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x3febb32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x486a177, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.967] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486a177, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x486a177, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x486a177, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x248c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.967] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486a177, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x486a177, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x486a177, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x248c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.967] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0177.967] GetProcessHeap () returned 0xfd0000 [0177.967] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.968] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x486a177, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x486a177, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x486a177, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="be", cAlternateFileName="")) returned 1 [0177.968] GetProcessHeap () returned 0xfd0000 [0177.968] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\be\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x486a177, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x486a177, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x4f6b01b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.968] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x486a177, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x486a177, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x4f6b01b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.968] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6b01b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x4f6b01b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x4f6b01b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.968] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6b01b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x4f6b01b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x4f6b01b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.968] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.968] GetProcessHeap () returned 0xfd0000 [0177.968] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.968] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c253d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x50c253d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x50c253d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0177.968] GetProcessHeap () returned 0xfd0000 [0177.968] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\bg\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c253d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x50c253d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x58a8206, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.969] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c253d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x50c253d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x58a8206, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.969] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a8206, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x58a8206, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x58a8206, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.969] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a8206, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x58a8206, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x58a8206, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.969] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.969] GetProcessHeap () returned 0xfd0000 [0177.969] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.969] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8206, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x58a8206, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x58a8206, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn-bd", cAlternateFileName="")) returned 1 [0177.969] GetProcessHeap () returned 0xfd0000 [0177.969] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\bn-bd\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8206, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x58a8206, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6362b99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.970] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8206, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x58a8206, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6362b99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.970] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6362b99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6362b99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6362b99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.970] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6362b99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6362b99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6362b99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x250c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.970] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.970] GetProcessHeap () returned 0xfd0000 [0177.970] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.970] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6362b99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6362b99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6362b99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn-in", cAlternateFileName="")) returned 1 [0177.973] GetProcessHeap () returned 0xfd0000 [0177.973] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\bn-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6362b99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6362b99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6c53922, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0177.973] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6362b99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6362b99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6c53922, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.974] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c53922, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6c53922, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6c53922, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.974] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c53922, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6c53922, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6c53922, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.974] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0177.974] GetProcessHeap () returned 0xfd0000 [0177.974] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.974] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c53922, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6c53922, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6c53922, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-latn-ba", cAlternateFileName="BS-LAT~1")) returned 1 [0177.974] GetProcessHeap () returned 0xfd0000 [0177.974] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\bs-latn-ba\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c53922, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6c53922, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x74d1f08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.975] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c53922, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6c53922, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x74d1f08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.975] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d1f08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x74d1f08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x74d1f08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.975] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d1f08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x74d1f08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x74d1f08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.975] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.975] GetProcessHeap () returned 0xfd0000 [0177.975] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.975] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d1f08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x74d1f08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x74d1f08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0177.975] GetProcessHeap () returned 0xfd0000 [0177.975] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ca\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d1f08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x74d1f08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x7f1a16e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0177.976] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d1f08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x74d1f08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x7f1a16e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.976] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f1a16e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x7f1a16e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x7f1a16e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.976] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f1a16e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x7f1a16e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x7f1a16e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.976] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0177.976] GetProcessHeap () returned 0xfd0000 [0177.976] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.976] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f1a16e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x7f1a16e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x7f1a16e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0177.976] GetProcessHeap () returned 0xfd0000 [0177.976] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ca-es-valencia\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f1a16e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x7f1a16e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x86b397a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.977] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f1a16e, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x7f1a16e, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x86b397a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.977] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b397a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x86b397a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x86d9bd7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.977] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b397a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x86b397a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x86d9bd7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.977] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.977] GetProcessHeap () returned 0xfd0000 [0177.977] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.977] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d9bd7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x86d9bd7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x86d9bd7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0177.977] GetProcessHeap () returned 0xfd0000 [0177.977] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\cs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d9bd7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x86d9bd7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x8e00cdc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0177.978] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d9bd7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x86d9bd7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x8e00cdc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.978] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e00cdc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x8e00cdc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x8e00cdc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.978] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e00cdc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x8e00cdc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x8e00cdc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.978] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0177.978] GetProcessHeap () returned 0xfd0000 [0177.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.978] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e26f32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x8e26f32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x8e26f32, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cy-gb", cAlternateFileName="")) returned 1 [0177.978] GetProcessHeap () returned 0xfd0000 [0177.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\cy-gb\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e26f32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x8e26f32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9501b6b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0177.979] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e26f32, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x8e26f32, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9501b6b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.979] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9501b6b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9501b6b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9501b6b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.979] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9501b6b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9501b6b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9501b6b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.979] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0177.979] GetProcessHeap () returned 0xfd0000 [0177.979] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.979] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9501b6b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9501b6b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9501b6b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0177.979] GetProcessHeap () returned 0xfd0000 [0177.979] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\da\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9501b6b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9501b6b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9f7002f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.981] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9501b6b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9501b6b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9f7002f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.981] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7002f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9f7002f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9f7002f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.981] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7002f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9f7002f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9f7002f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.981] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.981] GetProcessHeap () returned 0xfd0000 [0177.981] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.981] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f7002f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9f7002f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x9f7002f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0177.981] GetProcessHeap () returned 0xfd0000 [0177.981] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\de\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f7002f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9f7002f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa7a018a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.982] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f7002f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x9f7002f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa7a018a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.982] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a018a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa7a018a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa7a018a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.982] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a018a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa7a018a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa7a018a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.982] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.982] GetProcessHeap () returned 0xfd0000 [0177.982] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.982] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7a018a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa7a018a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa7a018a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0177.982] GetProcessHeap () returned 0xfd0000 [0177.983] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\el\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7a018a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa7a018a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaff858a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.984] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7a018a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa7a018a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaff858a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.984] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff858a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaff858a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaff858a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.984] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff858a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaff858a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaff858a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.984] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.984] GetProcessHeap () returned 0xfd0000 [0177.984] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.984] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed302ae9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed302ae9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed328c8a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1cd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElevatedAppBlue.png", cAlternateFileName="ELEVAT~1.PNG")) returned 1 [0177.984] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed328c8a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed328c8a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed34ef03, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x13cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElevatedAppWhite.png", cAlternateFileName="ELEVAT~2.PNG")) returned 1 [0177.984] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaff858a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaff858a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaff858a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0177.984] GetProcessHeap () returned 0xfd0000 [0177.984] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\en\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaff858a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaff858a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb7458a1, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.985] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaff858a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xaff858a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb7458a1, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.985] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7458a1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb7458a1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb7458a1, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.985] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7458a1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb7458a1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb7458a1, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.985] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0177.985] GetProcessHeap () returned 0xfd0000 [0177.985] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.985] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7458a1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb7458a1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb7458a1, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0177.985] GetProcessHeap () returned 0xfd0000 [0177.985] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\en-gb\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7458a1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb7458a1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbe92bf2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.986] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7458a1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb7458a1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbe92bf2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.986] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe92bf2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbe92bf2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbe92bf2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x212c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.986] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe92bf2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbe92bf2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbe92bf2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x212c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.986] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.986] GetProcessHeap () returned 0xfd0000 [0177.986] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.986] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed34ef03, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed34ef03, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed34ef03, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1e64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Error.png", cAlternateFileName="")) returned 1 [0177.986] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3e786a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed3e786a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed40dacb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1829, dwReserved0=0x0, dwReserved1=0x0, cFileName="ErrorPage.html", cAlternateFileName="ERRORP~1.HTM")) returned 1 [0177.987] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe92bf2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbe92bf2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbe92bf2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0177.987] GetProcessHeap () returned 0xfd0000 [0177.987] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\es\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe92bf2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbe92bf2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc6061aa, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.987] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe92bf2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbe92bf2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc6061aa, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.987] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6061aa, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc6061aa, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc6061aa, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.987] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6061aa, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc6061aa, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc6061aa, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.987] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.987] GetProcessHeap () returned 0xfd0000 [0177.987] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.987] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6061aa, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc6061aa, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc6061aa, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0177.987] GetProcessHeap () returned 0xfd0000 [0177.987] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\et\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6061aa, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc6061aa, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd15bc8d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0177.988] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6061aa, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc6061aa, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd15bc8d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.988] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15bc8d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd15bc8d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd15bc8d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.988] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15bc8d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd15bc8d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd15bc8d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.988] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0177.988] GetProcessHeap () returned 0xfd0000 [0177.988] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.988] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed433d36, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed433d36, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed433d36, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x7ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 1 [0177.988] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd15bc8d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd15bc8d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd15bc8d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0177.989] GetProcessHeap () returned 0xfd0000 [0177.989] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\eu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd15bc8d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd15bc8d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd882dd6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0177.989] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd15bc8d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd15bc8d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd882dd6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.989] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd882dd6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd882dd6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd882dd6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.989] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd882dd6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd882dd6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd882dd6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.989] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0177.989] GetProcessHeap () returned 0xfd0000 [0177.989] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.989] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd882dd6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd882dd6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd882dd6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0177.989] GetProcessHeap () returned 0xfd0000 [0177.989] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\fa\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd882dd6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd882dd6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdfa9e96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0177.989] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd882dd6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd882dd6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdfa9e96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.989] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa9e96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdfa9e96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdfa9e96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.990] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa9e96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdfa9e96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdfa9e96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.990] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0177.990] GetProcessHeap () returned 0xfd0000 [0177.990] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.990] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfa9e96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdfa9e96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdfa9e96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0177.990] GetProcessHeap () returned 0xfd0000 [0177.990] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\fi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfa9e96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdfa9e96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe65e87f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0177.991] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfa9e96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdfa9e96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe65e87f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.991] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe65e87f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe65e87f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe684add, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.991] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe65e87f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe65e87f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe684add, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.991] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0177.991] GetProcessHeap () returned 0xfd0000 [0177.991] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.991] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe684add, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe684add, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe684add, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil-ph", cAlternateFileName="")) returned 1 [0177.991] GetProcessHeap () returned 0xfd0000 [0177.991] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\fil-ph\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe684add, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe684add, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xedd1e31, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0177.992] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe684add, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe684add, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xedd1e31, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1e31, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xedd1e31, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xedd1e31, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x27ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1e31, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xedd1e31, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xedd1e31, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x27ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.992] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0177.992] GetProcessHeap () returned 0xfd0000 [0177.992] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed459f8c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed459f8c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed459f8c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3e8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuth.exe", cAlternateFileName="FILECO~1.EXE")) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed58b4c1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed58b4c1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed5b1563, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x268c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuthLib.dll", cAlternateFileName="FILECO~1.DLL")) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee227269, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee227269, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee227269, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x210c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee273727, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee273727, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee273727, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xab4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0177.992] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4170f9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee4170f9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee4170f9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xba2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 1 [0177.993] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81d076, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee81d076, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee81d076, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x306ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb3e1ec, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeeb3e1ec, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeeb3e1ec, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x39cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecbb98a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeecbb98a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeece1bd3, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x124c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncFAL.dll", cAlternateFileName="FI0695~1.DLL")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeedc69ff, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeedc69ff, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeedecc74, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x348c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncFALWB.dll", cAlternateFileName="FI7839~1.DLL")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0c191f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xef0c191f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef15a286, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1744c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef34a10f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xef34a10f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef34a10f, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x28a6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef513d49, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xef513d49, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef513d49, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xe42c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncViews.dll", cAlternateFileName="FI224F~1.DLL")) returned 1 [0177.994] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd1e31, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xedd1e31, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xedd1e31, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0177.994] GetProcessHeap () returned 0xfd0000 [0177.994] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\fr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd1e31, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xedd1e31, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf4d2cc4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0177.995] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd1e31, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xedd1e31, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf4d2cc4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.995] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d2cc4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf4d2cc4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf4d2cc4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x28ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0177.995] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d2cc4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf4d2cc4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf4d2cc4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x28ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0177.995] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0177.995] GetProcessHeap () returned 0xfd0000 [0177.995] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0177.995] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4d2cc4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf4d2cc4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf4d2cc4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ga-ie", cAlternateFileName="")) returned 1 [0177.995] GetProcessHeap () returned 0xfd0000 [0177.995] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0177.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ga-ie\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4d2cc4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf4d2cc4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfc27656, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0178.004] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4d2cc4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf4d2cc4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfc27656, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.005] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc27656, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfc27656, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfc27656, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.005] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc27656, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfc27656, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfc27656, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.005] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0178.005] GetProcessHeap () returned 0xfd0000 [0178.005] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.005] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc27656, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfc27656, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfc27656, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gd-latn", cAlternateFileName="")) returned 1 [0178.005] GetProcessHeap () returned 0xfd0000 [0178.005] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\gd-latn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc27656, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfc27656, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x102dc03c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.134] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc27656, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfc27656, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x102dc03c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.134] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102dc03c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x102dc03c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x102dc03c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.135] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102dc03c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x102dc03c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x102dc03c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x29ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.135] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.135] GetProcessHeap () returned 0xfd0000 [0178.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.135] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x102dc03c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x102dc03c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x102dc03c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0178.135] GetProcessHeap () returned 0xfd0000 [0178.135] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\gl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x102dc03c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x102dc03c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x109dcee7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.136] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x102dc03c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x102dc03c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x109dcee7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.136] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109dcee7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x109dcee7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x109dcee7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.136] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109dcee7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x109dcee7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x109dcee7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.137] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.137] GetProcessHeap () returned 0xfd0000 [0178.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.137] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5b1563, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed5b1563, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed5b1563, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0178.137] GetProcessHeap () returned 0xfd0000 [0178.137] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\gu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5b1563, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed5b1563, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xedbbed14, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.138] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5b1563, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xed5b1563, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xedbbed14, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.138] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbbed14, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xedbbed14, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee227269, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.138] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbbed14, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xedbbed14, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee227269, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.138] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.138] GetProcessHeap () returned 0xfd0000 [0178.138] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.138] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee273727, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee273727, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xee273727, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ha-latn-ng", cAlternateFileName="HA-LAT~1")) returned 1 [0178.139] GetProcessHeap () returned 0xfd0000 [0178.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ha-latn-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee273727, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee273727, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeefb6899, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.139] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee273727, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xee273727, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeefb6899, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.139] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefb6899, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeefb6899, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeefdcaec, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.139] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefb6899, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeefb6899, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeefdcaec, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.139] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.139] GetProcessHeap () returned 0xfd0000 [0178.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.139] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefdcaec, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeefdcaec, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeefdcaec, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0178.140] GetProcessHeap () returned 0xfd0000 [0178.140] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\he\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefdcaec, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeefdcaec, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefa7121e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.140] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefdcaec, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xeefdcaec, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefa7121e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.140] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa7121e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefa7121e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefa7121e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1dac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa7121e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefa7121e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefa7121e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1dac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.141] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.141] GetProcessHeap () returned 0xfd0000 [0178.141] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.141] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefa7121e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefa7121e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefa7121e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0178.141] GetProcessHeap () returned 0xfd0000 [0178.141] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\hi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefa7121e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefa7121e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf059e2bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefa7121e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefa7121e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf059e2bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.142] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf059e2bc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf059e2bc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf059e2bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.142] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf059e2bc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf059e2bc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf059e2bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.142] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.142] GetProcessHeap () returned 0xfd0000 [0178.142] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.142] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf059e2bc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf059e2bc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf059e2bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0178.142] GetProcessHeap () returned 0xfd0000 [0178.142] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\hr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf059e2bc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf059e2bc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0ee159c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.143] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf059e2bc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf059e2bc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0ee159c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.143] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ee159c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0ee159c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0ee159c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.143] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ee159c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0ee159c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0ee159c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x24cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.143] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0178.143] GetProcessHeap () returned 0xfd0000 [0178.143] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.143] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ee159c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0ee159c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0ee159c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0178.143] GetProcessHeap () returned 0xfd0000 [0178.143] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\hu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ee159c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0ee159c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf13da468, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.145] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ee159c, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0ee159c, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf13da468, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.146] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf13da468, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf13da468, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf17ba2b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x25cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.146] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf13da468, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf13da468, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf17ba2b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x25cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.146] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.146] GetProcessHeap () returned 0xfd0000 [0178.146] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.146] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18c5252, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf18c5252, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf18c5252, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0178.146] GetProcessHeap () returned 0xfd0000 [0178.146] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\hy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18c5252, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf18c5252, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2274b29, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0178.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18c5252, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf18c5252, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2274b29, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2274b29, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2274b29, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2274b29, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.147] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2274b29, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2274b29, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2274b29, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.147] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0178.147] GetProcessHeap () returned 0xfd0000 [0178.147] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.147] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2274b29, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2274b29, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2274b29, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0178.147] GetProcessHeap () returned 0xfd0000 [0178.147] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\id\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2274b29, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2274b29, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf3135446, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.148] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2274b29, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2274b29, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf3135446, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.148] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3135446, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf3135446, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf315b699, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x236c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.148] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3135446, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf3135446, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf315b699, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x236c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.148] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.148] GetProcessHeap () returned 0xfd0000 [0178.148] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.148] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf35878fc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf35878fc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf35878fc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ig-ng", cAlternateFileName="")) returned 1 [0178.148] GetProcessHeap () returned 0xfd0000 [0178.148] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ig-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf35878fc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf35878fc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf40b4925, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.150] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf35878fc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf35878fc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf40b4925, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.150] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40b4925, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf40b4925, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf40b4925, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.150] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40b4925, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf40b4925, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf40b4925, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.150] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.150] GetProcessHeap () returned 0xfd0000 [0178.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.150] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40b4925, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf4be19de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf4be19de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imageformats", cAlternateFileName="IMAGEF~1")) returned 1 [0178.150] GetProcessHeap () returned 0xfd0000 [0178.150] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\imageformats\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40b4925, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf4be19de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5d9d1de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.151] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40b4925, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf4be19de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5d9d1de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.151] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4be19de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf4be19de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf4be19de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjpeg.dll", cAlternateFileName="")) returned 1 [0178.151] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5d9d1de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf5d9d1de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5d9d1de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x8ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qsvg.dll", cAlternateFileName="")) returned 1 [0178.151] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5d9d1de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf5d9d1de, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5d9d1de, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x8ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qsvg.dll", cAlternateFileName="")) returned 0 [0178.151] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.151] GetProcessHeap () returned 0xfd0000 [0178.151] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.151] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5d9d1de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x585bd56, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x585bd56, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0178.152] GetProcessHeap () returned 0xfd0000 [0178.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\images\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5d9d1de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x585bd56, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x63fb507, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.155] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5d9d1de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x585bd56, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x63fb507, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.156] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf651079a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf651079a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf651079a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x8f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="acmDismissIcon.svg", cAlternateFileName="ACMDIS~1.SVG")) returned 1 [0178.156] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6c11645, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf6c11645, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf6c11645, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="blurrect.png", cAlternateFileName="")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7385be9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7385be9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7385be9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_finished.svg", cAlternateFileName="CHECKM~1.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a14375, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7a14375, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7bb7d84, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_hovered.svg", cAlternateFileName="CHECKM~2.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83050ba, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf83050ba, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf83050ba, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_in_progress.svg", cAlternateFileName="CHECKM~3.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf899384a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf899384a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf899384a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_selected.svg", cAlternateFileName="CHECKM~4.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8fd5b44, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf8fd5b44, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf8fd5b44, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="chevron.svg", cAlternateFileName="")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97490fd, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf97490fd, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf97490fd, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="chevronUp.svg", cAlternateFileName="CHEVRO~1.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f55038, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf9f55038, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf9f55038, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x6c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud.svg", cAlternateFileName="")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa68f152, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfa68f152, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfa68f152, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="done_graphic.svg", cAlternateFileName="DONE_G~1.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdf42f6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfbdf42f6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfbdf42f6, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="errorIcon.svg", cAlternateFileName="ERRORI~1.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc7a3c0a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc7a3c0a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc7a3c0a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.svg", cAlternateFileName="")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd022231, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfd022231, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfd022231, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x79b, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_desktop.svg", cAlternateFileName="FOLDER~1.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd74ed43, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfd74ed43, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfd7500d6, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x5031, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_documents.svg", cAlternateFileName="FOLDER~2.SVG")) returned 1 [0178.157] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf4520a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfdf4520a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfdf4520a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_pictures.svg", cAlternateFileName="FOLDER~3.SVG")) returned 1 [0178.160] GetProcessHeap () returned 0xfd0000 [0178.160] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.160] GetProcessHeap () returned 0xfd0000 [0178.160] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\is\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63fb507, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x63fb507, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6cc600a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.167] GetProcessHeap () returned 0xfd0000 [0178.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.167] GetProcessHeap () returned 0xfd0000 [0178.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\it\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cc600a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6cc600a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x769bb2d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.167] GetProcessHeap () returned 0xfd0000 [0178.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.167] GetProcessHeap () returned 0xfd0000 [0178.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ja\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x769bb2d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x769bb2d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x813029d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.167] GetProcessHeap () returned 0xfd0000 [0178.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.168] GetProcessHeap () returned 0xfd0000 [0178.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ka\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x813029d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x813029d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x88a3817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.168] GetProcessHeap () returned 0xfd0000 [0178.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.168] GetProcessHeap () returned 0xfd0000 [0178.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a3817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x88a3817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x90894cc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0178.168] GetProcessHeap () returned 0xfd0000 [0178.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.168] GetProcessHeap () returned 0xfd0000 [0178.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\km-kh\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90894cc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x90894cc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.169] GetProcessHeap () returned 0xfd0000 [0178.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.169] GetProcessHeap () returned 0xfd0000 [0178.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0178.171] GetProcessHeap () returned 0xfd0000 [0178.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.171] GetProcessHeap () returned 0xfd0000 [0178.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ko\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xaba610e, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.171] GetProcessHeap () returned 0xfd0000 [0178.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.172] GetProcessHeap () returned 0xfd0000 [0178.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\kok\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabcc372, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xabcc372, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.172] GetProcessHeap () returned 0xfd0000 [0178.172] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.172] GetProcessHeap () returned 0xfd0000 [0178.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ku-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.172] GetProcessHeap () returned 0xfd0000 [0178.172] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.172] GetProcessHeap () returned 0xfd0000 [0178.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ky\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.173] GetProcessHeap () returned 0xfd0000 [0178.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.173] GetProcessHeap () returned 0xfd0000 [0178.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lb-lu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xcda21d4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.174] GetProcessHeap () returned 0xfd0000 [0178.174] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.175] GetProcessHeap () returned 0xfd0000 [0178.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce60d95, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xce60d95, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.175] GetProcessHeap () returned 0xfd0000 [0178.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.175] GetProcessHeap () returned 0xfd0000 [0178.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\lv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.176] GetProcessHeap () returned 0xfd0000 [0178.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.176] GetProcessHeap () returned 0xfd0000 [0178.176] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mi-nz\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.177] GetProcessHeap () returned 0xfd0000 [0178.177] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.177] GetProcessHeap () returned 0xfd0000 [0178.177] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.177] GetProcessHeap () returned 0xfd0000 [0178.177] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.177] GetProcessHeap () returned 0xfd0000 [0178.177] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ml-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.178] GetProcessHeap () returned 0xfd0000 [0178.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.178] GetProcessHeap () returned 0xfd0000 [0178.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.178] GetProcessHeap () returned 0xfd0000 [0178.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.178] GetProcessHeap () returned 0xfd0000 [0178.178] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.179] GetProcessHeap () returned 0xfd0000 [0178.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.179] GetProcessHeap () returned 0xfd0000 [0178.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0178.179] GetProcessHeap () returned 0xfd0000 [0178.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.179] GetProcessHeap () returned 0xfd0000 [0178.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\mt-mt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.300] GetProcessHeap () returned 0xfd0000 [0178.300] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.300] GetProcessHeap () returned 0xfd0000 [0178.300] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nb-no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.301] GetProcessHeap () returned 0xfd0000 [0178.301] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.301] GetProcessHeap () returned 0xfd0000 [0178.301] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ne-np\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.301] GetProcessHeap () returned 0xfd0000 [0178.301] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.301] GetProcessHeap () returned 0xfd0000 [0178.301] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.302] GetProcessHeap () returned 0xfd0000 [0178.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.302] GetProcessHeap () returned 0xfd0000 [0178.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nn-no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.302] GetProcessHeap () returned 0xfd0000 [0178.302] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.302] GetProcessHeap () returned 0xfd0000 [0178.302] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\nso-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.303] GetProcessHeap () returned 0xfd0000 [0178.303] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.303] GetProcessHeap () returned 0xfd0000 [0178.303] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\or-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.304] GetProcessHeap () returned 0xfd0000 [0178.304] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.304] GetProcessHeap () returned 0xfd0000 [0178.304] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.304] GetProcessHeap () returned 0xfd0000 [0178.305] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.305] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa-arab", cAlternateFileName="")) returned 1 [0178.305] GetProcessHeap () returned 0xfd0000 [0178.305] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pa-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.305] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.305] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.306] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.306] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.306] GetProcessHeap () returned 0xfd0000 [0178.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.306] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0178.306] GetProcessHeap () returned 0xfd0000 [0178.306] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.306] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.306] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b06d1c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13b06d1c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.306] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b06d1c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13b06d1c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13b06d1c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.306] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.306] GetProcessHeap () returned 0xfd0000 [0178.306] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.306] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13e694e3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="platforms", cAlternateFileName="PLATFO~1")) returned 1 [0178.307] GetProcessHeap () returned 0xfd0000 [0178.307] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\platforms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.307] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.307] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142956c8, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142956c8, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x10c4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 1 [0178.307] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142956c8, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142956c8, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142956c8, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x10c4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 0 [0178.308] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0178.308] GetProcessHeap () returned 0xfd0000 [0178.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.308] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142bb925, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prs-af", cAlternateFileName="")) returned 1 [0178.308] GetProcessHeap () returned 0xfd0000 [0178.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\prs-af\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.308] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.309] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.309] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x23ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.309] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.309] GetProcessHeap () returned 0xfd0000 [0178.309] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.309] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0178.309] GetProcessHeap () returned 0xfd0000 [0178.309] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-br\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.310] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.310] GetProcessHeap () returned 0xfd0000 [0178.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.310] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0178.310] GetProcessHeap () returned 0xfd0000 [0178.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\pt-pt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ea7587, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ea7587, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ea7587, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14ea7587, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ecd7c9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ea7587, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14ea7587, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14ecd7c9, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.310] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.311] GetProcessHeap () returned 0xfd0000 [0178.311] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.311] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ec87e47, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qml", cAlternateFileName="")) returned 1 [0178.311] GetProcessHeap () returned 0xfd0000 [0178.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.311] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.311] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15261046, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15261046, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15261046, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1a05c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fabricmdl2.ttf", cAlternateFileName="FABRIC~1.TTF")) returned 1 [0178.312] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick", cAlternateFileName="")) returned 1 [0178.312] GetProcessHeap () returned 0xfd0000 [0178.312] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0178.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\QtQuick\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.314] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.314] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x21680807, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x21680807, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Controls.2", cAlternateFileName="")) returned 1 [0178.314] GetProcessHeap () returned 0xfd0000 [0178.314] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\QtQuick\\Controls.2\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x21680807, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x21680807, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.318] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x21680807, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x21680807, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.318] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fcc5eff, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1fcc5eff, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1fcc5eff, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Button.qml", cAlternateFileName="")) returned 1 [0178.318] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20157a35, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x20157a35, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x20157a35, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="Menu.qml", cAlternateFileName="")) returned 1 [0178.318] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2055d923, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x2055d923, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x2055d923, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xe3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MenuItem.qml", cAlternateFileName="")) returned 1 [0178.318] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2093d654, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x2093d654, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x2093d654, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x11437, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins.qmltypes", cAlternateFileName="PLUGIN~1.QML")) returned 1 [0178.319] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d1d385, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x20d1d385, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x20d1d385, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa31, dwReserved0=0x0, dwReserved1=0x0, cFileName="Popup.qml", cAlternateFileName="")) returned 1 [0178.319] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213abb0a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x213abb0a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x216a6a68, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xae7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgressBar.qml", cAlternateFileName="PROGRE~1.QML")) returned 1 [0178.319] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213abb0a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x213abb0a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x216a6a68, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xae7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgressBar.qml", cAlternateFileName="PROGRE~1.QML")) returned 0 [0178.319] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.320] GetProcessHeap () returned 0xfd0000 [0178.320] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.320] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x21680807, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x21680807, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Controls.2", cAlternateFileName="")) returned 0 [0178.320] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0178.320] GetProcessHeap () returned 0xfd0000 [0178.320] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0178.320] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f4478d5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick.2", cAlternateFileName="")) returned 1 [0178.320] GetProcessHeap () returned 0xfd0000 [0178.320] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0178.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qml\\QtQuick.2\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.320] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.320] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f067ba5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f067ba5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f067ba5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x2d552, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins.qmltypes", cAlternateFileName="PLUGIN~1.QML")) returned 1 [0178.320] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4478d5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f4478d5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmldir", cAlternateFileName="")) returned 1 [0178.320] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x7ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qtquick2plugin.dll", cAlternateFileName="QTQUIC~1.DLL")) returned 1 [0178.320] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f827600, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f827600, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f827600, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x7ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qtquick2plugin.dll", cAlternateFileName="QTQUIC~1.DLL")) returned 0 [0178.321] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.321] GetProcessHeap () returned 0xfd0000 [0178.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1f4478d5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1f4478d5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QtQuick.2", cAlternateFileName="")) returned 0 [0178.321] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.321] GetProcessHeap () returned 0xfd0000 [0178.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ca4f64, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf1ca4f64, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf1d89d75, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48eac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Core.dll", cAlternateFileName="")) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21b5f68, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf21b5f68, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf21b5f68, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x53ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5DBus.dll", cAlternateFileName="")) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b3f63d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2b3f63d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2d09276, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4becc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Gui.dll", cAlternateFileName="")) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf34eef09, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf34eef09, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf34eef09, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xe4ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Network.dll", cAlternateFileName="QT5NET~1.DLL")) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b7d6aa, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf3b7d6aa, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf3ba390e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x450c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5PrintSupport.dll", cAlternateFileName="QT5PRI~1.DLL")) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf41e5bf4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf41e5bf4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf41e5bf4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x280cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Qml.dll", cAlternateFileName="")) returned 1 [0178.321] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ad6ba0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf4ad6ba0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf4b95568, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2b9ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Quick.dll", cAlternateFileName="")) returned 1 [0178.322] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf518b334, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf518b334, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf518b334, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x192c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5QuickControls2.dll", cAlternateFileName="QT5QUI~1.DLL")) returned 1 [0178.322] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5ef470e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf5ef470e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5ef470e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x9b2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5QuickTemplates2.dll", cAlternateFileName="QT5QUI~2.DLL")) returned 1 [0178.322] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6346bd1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf6346bd1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf6346bd1, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x44ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Svg.dll", cAlternateFileName="")) returned 1 [0178.322] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf691671e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf691671e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf691671e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x442cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5Widgets.dll", cAlternateFileName="QT5WID~1.DLL")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e73bdf, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf6e73bdf, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf6e73bdf, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3d0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qt5WinExtras.dll", cAlternateFileName="QT5WIN~1.DLL")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72ed277, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf72ed277, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf72ed277, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2266, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaCritical.png", cAlternateFileName="QUOTAC~1.PNG")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7909300, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7909300, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7c2a4eb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaError.png", cAlternateFileName="QUOTAE~1.PNG")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81adb87, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf81adb87, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf81adb87, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaNearing.png", cAlternateFileName="QUOTAN~1.PNG")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x152d3757, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qut-latn", cAlternateFileName="")) returned 1 [0178.323] GetProcessHeap () returned 0xfd0000 [0178.323] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\qut-latn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.323] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15666fc7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15666fc7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.323] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15666fc7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15666fc7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15666fc7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.324] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.324] GetProcessHeap () returned 0xfd0000 [0178.324] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.324] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1568d220, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="quz-pe", cAlternateFileName="")) returned 1 [0178.324] GetProcessHeap () returned 0xfd0000 [0178.324] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\quz-pe\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.324] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.324] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x264c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.325] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.325] GetProcessHeap () returned 0xfd0000 [0178.325] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86e4df2, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf86e4df2, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf86e4df2, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x9f2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0178.325] GetProcessHeap () returned 0xfd0000 [0178.325] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ro\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.325] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x258c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x258c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.325] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.325] GetProcessHeap () returned 0xfd0000 [0178.325] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0178.326] GetProcessHeap () returned 0xfd0000 [0178.326] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ru\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.326] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.326] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.326] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.327] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.327] GetProcessHeap () returned 0xfd0000 [0178.327] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.327] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rw", cAlternateFileName="")) returned 1 [0178.327] GetProcessHeap () returned 0xfd0000 [0178.327] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\rw\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.327] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.327] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.327] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.327] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.334] GetProcessHeap () returned 0xfd0000 [0178.334] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.334] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bf5e88, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf8bf5e88, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf8bf5e88, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b721, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScreenshotOptIn.gif", cAlternateFileName="SCREEN~1.GIF")) returned 1 [0178.335] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sd-arab", cAlternateFileName="")) returned 1 [0178.335] GetProcessHeap () returned 0xfd0000 [0178.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sd-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.335] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.335] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.336] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x24ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.336] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.336] GetProcessHeap () returned 0xfd0000 [0178.336] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.336] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si-lk", cAlternateFileName="")) returned 1 [0178.336] GetProcessHeap () returned 0xfd0000 [0178.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\si-lk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.336] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.336] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.336] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.336] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.336] GetProcessHeap () returned 0xfd0000 [0178.336] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.336] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0178.336] GetProcessHeap () returned 0xfd0000 [0178.336] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.337] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.337] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.337] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.337] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.337] GetProcessHeap () returned 0xfd0000 [0178.337] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.337] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0178.338] GetProcessHeap () returned 0xfd0000 [0178.338] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.338] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.338] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.338] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x252c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.338] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.338] GetProcessHeap () returned 0xfd0000 [0178.338] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.338] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sq", cAlternateFileName="")) returned 1 [0178.338] GetProcessHeap () returned 0xfd0000 [0178.338] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sq\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.339] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.339] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.339] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x262c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.340] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0178.340] GetProcessHeap () returned 0xfd0000 [0178.340] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.340] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90946f8, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf90946f8, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf90946f8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x320c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0178.340] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl-ba", cAlternateFileName="SR-CYR~1")) returned 1 [0178.340] GetProcessHeap () returned 0xfd0000 [0178.340] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-ba\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.341] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.341] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.341] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.341] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.341] GetProcessHeap () returned 0xfd0000 [0178.341] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.341] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl-rs", cAlternateFileName="SR-CYR~2")) returned 1 [0178.341] GetProcessHeap () returned 0xfd0000 [0178.341] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-cyrl-rs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1863c348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.342] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1863c348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.342] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1863c348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1863c348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1863c348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.342] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1863c348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1863c348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1863c348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.342] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.342] GetProcessHeap () returned 0xfd0000 [0178.342] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.342] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1863c348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1863c348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1863c348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn-rs", cAlternateFileName="SR-LAT~1")) returned 1 [0178.343] GetProcessHeap () returned 0xfd0000 [0178.343] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sr-latn-rs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1863c348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1863c348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a422dd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.343] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1863c348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1863c348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a422dd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.343] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a422dd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18a422dd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a422dd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.343] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a422dd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18a422dd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a422dd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.343] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.343] GetProcessHeap () returned 0xfd0000 [0178.343] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.343] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf95a570f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf95a570f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf95a570f, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x478c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssleay32.dll", cAlternateFileName="")) returned 1 [0178.343] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a422dd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18a422dd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a422dd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0178.343] GetProcessHeap () returned 0xfd0000 [0178.343] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a422dd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18a422dd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18e22011, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.344] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a422dd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18a422dd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18e22011, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.344] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e22011, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18e22011, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18e22011, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x234c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.344] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e22011, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18e22011, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18e22011, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x234c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.344] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.344] GetProcessHeap () returned 0xfd0000 [0178.344] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.344] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e22011, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18e22011, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18e22011, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0178.344] GetProcessHeap () returned 0xfd0000 [0178.344] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\sw\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e22011, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18e22011, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x191dbad7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.345] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e22011, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18e22011, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x191dbad7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.345] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191dbad7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x191dbad7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x191dbad7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.345] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191dbad7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x191dbad7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x191dbad7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.345] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0178.345] GetProcessHeap () returned 0xfd0000 [0178.345] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.345] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b752e5, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf9b752e5, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf9b752e5, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x53d8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 1 [0178.345] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x191dbad7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x191dbad7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x191dbad7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0178.346] GetProcessHeap () returned 0xfd0000 [0178.346] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ta\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x191dbad7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x191dbad7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1965420c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0178.346] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x191dbad7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x191dbad7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1965420c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.346] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1965420c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1965420c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1967a3da, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x282c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.347] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1965420c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1965420c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1967a3da, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x282c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.347] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0178.347] GetProcessHeap () returned 0xfd0000 [0178.347] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.347] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1967a3da, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1967a3da, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1967a3da, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0178.347] GetProcessHeap () returned 0xfd0000 [0178.347] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\te\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1967a3da, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1967a3da, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19a208eb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.347] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1967a3da, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1967a3da, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19a208eb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.347] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a208eb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19a208eb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19a208eb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.347] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a208eb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19a208eb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19a208eb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x256c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.347] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.347] GetProcessHeap () returned 0xfd0000 [0178.347] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.347] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa321b21, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfa321b21, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfa321b21, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x52ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 1 [0178.348] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaa229e0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfaa229e0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfaa229e0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestSharePage.html", cAlternateFileName="TESTSH~1.HTM")) returned 1 [0178.348] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19a208eb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19a208eb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19a208eb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tg-cyrl", cAlternateFileName="")) returned 1 [0178.348] GetProcessHeap () returned 0xfd0000 [0178.348] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\tg-cyrl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19a208eb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19a208eb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19e72d5c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.348] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19a208eb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19a208eb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19e72d5c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.348] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e72d5c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19e72d5c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19e72d5c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x274c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.348] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e72d5c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19e72d5c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19e72d5c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x274c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.348] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.348] GetProcessHeap () returned 0xfd0000 [0178.349] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.349] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e72d5c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19e72d5c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19e72d5c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0178.349] GetProcessHeap () returned 0xfd0000 [0178.349] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\th\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e72d5c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19e72d5c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a4db277, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.349] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e72d5c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19e72d5c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a4db277, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.418] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4db277, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a4db277, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a4db277, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x212c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.418] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4db277, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a4db277, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a4db277, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x212c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.424] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0178.425] GetProcessHeap () returned 0xfd0000 [0178.432] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.432] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc05689e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc05689e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc05689e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xbfe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0178.432] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a4db277, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a4db277, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a4db277, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ti", cAlternateFileName="")) returned 1 [0178.435] GetProcessHeap () returned 0xfd0000 [0178.435] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ti\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a4db277, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a4db277, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a979b36, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a4db277, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a4db277, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a979b36, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a979b36, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a979b36, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a979b36, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.435] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a979b36, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a979b36, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a979b36, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.435] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.436] GetProcessHeap () returned 0xfd0000 [0178.436] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.436] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a979b36, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a979b36, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a979b36, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tk-tm", cAlternateFileName="")) returned 1 [0178.436] GetProcessHeap () returned 0xfd0000 [0178.436] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\tk-tm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a979b36, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a979b36, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ae68634, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.436] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a979b36, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a979b36, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ae68634, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.436] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae68634, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ae68634, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ae68634, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x228c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.437] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae68634, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ae68634, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ae68634, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x228c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.437] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.437] GetProcessHeap () returned 0xfd0000 [0178.437] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.437] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae68634, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ae68634, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ae68634, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tn-za", cAlternateFileName="")) returned 1 [0178.437] GetProcessHeap () returned 0xfd0000 [0178.437] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\tn-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae68634, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ae68634, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b1f8171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.437] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae68634, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ae68634, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b1f8171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.437] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1f8171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b1f8171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b1f8171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x294c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.437] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1f8171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b1f8171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b1f8171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x294c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.437] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.437] GetProcessHeap () returned 0xfd0000 [0178.437] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.437] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b1f8171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b1f8171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b1f8171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0178.437] GetProcessHeap () returned 0xfd0000 [0178.437] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\tr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b1f8171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b1f8171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b624355, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b1f8171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b1f8171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b624355, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b624355, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b624355, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b624355, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.438] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b624355, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b624355, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b624355, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.438] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.439] GetProcessHeap () returned 0xfd0000 [0178.439] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.439] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b624355, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b624355, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b624355, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tt", cAlternateFileName="")) returned 1 [0178.439] GetProcessHeap () returned 0xfd0000 [0178.439] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\tt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b624355, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b624355, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ba50552, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.443] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b624355, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b624355, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ba50552, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.443] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba50552, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ba50552, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ba50552, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.443] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba50552, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ba50552, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ba50552, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x244c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.443] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0178.443] GetProcessHeap () returned 0xfd0000 [0178.443] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.443] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc7314f6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc7314f6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc75774c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x116cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0178.443] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba50552, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ba50552, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ba50552, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ug-arab", cAlternateFileName="")) returned 1 [0178.443] GetProcessHeap () returned 0xfd0000 [0178.443] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ug-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba50552, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ba50552, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1be7c72c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.444] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba50552, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ba50552, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1be7c72c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.444] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be7c72c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1be7c72c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1bea2990, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.444] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be7c72c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1be7c72c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1bea2990, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x22cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.444] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.444] GetProcessHeap () returned 0xfd0000 [0178.444] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.444] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bea2990, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1bea2990, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1bea2990, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0178.444] GetProcessHeap () returned 0xfd0000 [0178.444] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\uk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bea2990, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1bea2990, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c2826be, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.444] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bea2990, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1bea2990, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c2826be, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.444] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c2826be, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c2826be, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c2826be, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.444] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c2826be, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c2826be, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c2826be, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x25ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.444] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.445] GetProcessHeap () returned 0xfd0000 [0178.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.445] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce324a4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfce324a4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfce324a4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x18ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateRingSettings.dll", cAlternateFileName="UPDATE~1.DLL")) returned 1 [0178.445] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c2826be, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c2826be, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c2826be, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1 [0178.445] GetProcessHeap () returned 0xfd0000 [0178.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\ur\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c2826be, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c2826be, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c63c195, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.445] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c2826be, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c2826be, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c63c195, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.445] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c63c195, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c63c195, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c63c195, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.446] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c63c195, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c63c195, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c63c195, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x254c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.446] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.446] GetProcessHeap () returned 0xfd0000 [0178.446] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.446] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c63c195, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c63c195, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c63c195, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uz-latn-uz", cAlternateFileName="UZ-LAT~1")) returned 1 [0178.446] GetProcessHeap () returned 0xfd0000 [0178.446] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\uz-latn-uz\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c63c195, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c63c195, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cb733f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.446] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c63c195, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c63c195, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cb733f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.446] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb733f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cb733f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cb733f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x260c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.446] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb733f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cb733f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cb733f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x260c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.446] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.446] GetProcessHeap () returned 0xfd0000 [0178.446] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.446] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4c0b1f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfd4c0b1f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfd4c0b1f, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x144c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0178.446] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cb733f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cb733f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cb733f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0178.447] GetProcessHeap () returned 0xfd0000 [0178.447] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\vi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cb733f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cb733f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cf79383, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.447] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cb733f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cb733f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cf79383, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.447] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf79383, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cf79383, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cf79383, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.447] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf79383, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cf79383, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cf79383, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x240c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.447] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.447] GetProcessHeap () returned 0xfd0000 [0178.447] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.447] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdb654d9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfdb654d9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfdb654d9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="Warning.png", cAlternateFileName="")) returned 1 [0178.447] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe45622b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfe45622b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfe4c891e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x626c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 1 [0178.447] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cf79383, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cf79383, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cf79383, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wo", cAlternateFileName="")) returned 1 [0178.447] GetProcessHeap () returned 0xfd0000 [0178.447] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\wo\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cf79383, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cf79383, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d332e5a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.448] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cf79383, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cf79383, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d332e5a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.448] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d332e5a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d332e5a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d332e5a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.448] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d332e5a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d332e5a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d332e5a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x20ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.448] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.448] GetProcessHeap () returned 0xfd0000 [0178.448] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.448] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d332e5a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d332e5a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d332e5a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xh-za", cAlternateFileName="")) returned 1 [0178.448] GetProcessHeap () returned 0xfd0000 [0178.448] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\xh-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d332e5a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d332e5a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d760772, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.449] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d332e5a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d332e5a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d760772, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.449] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d760772, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d760772, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d760772, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x248c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.449] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d760772, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d760772, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d760772, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x248c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.450] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.450] GetProcessHeap () returned 0xfd0000 [0178.450] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.450] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d760772, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d760772, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d760772, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yo-ng", cAlternateFileName="")) returned 1 [0178.450] GetProcessHeap () returned 0xfd0000 [0178.450] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\yo-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d760772, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d760772, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1df1ea96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.450] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d760772, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d760772, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1df1ea96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.450] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df1ea96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1df1ea96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1df1ea96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.451] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df1ea96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1df1ea96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1df1ea96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.451] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.451] GetProcessHeap () returned 0xfd0000 [0178.451] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.451] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1df1ea96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1df1ea96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1df1ea96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0178.451] GetProcessHeap () returned 0xfd0000 [0178.451] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\zh-cn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1df1ea96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1df1ea96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e2fe7ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.452] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1df1ea96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1df1ea96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e2fe7ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.452] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2fe7ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e2fe7ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.452] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2fe7ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e2fe7ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.452] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.452] GetProcessHeap () returned 0xfd0000 [0178.452] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.452] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e2fe7ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e2fe7ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0178.452] GetProcessHeap () returned 0xfd0000 [0178.452] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\zh-tw\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e2fe7ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.452] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e2fe7ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.452] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x126c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.453] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x126c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.453] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.453] GetProcessHeap () returned 0xfd0000 [0178.453] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.453] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu-za", cAlternateFileName="")) returned 1 [0178.453] GetProcessHeap () returned 0xfd0000 [0178.453] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7131.1115\\zu-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ec87e47, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.453] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ec87e47, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.454] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ec87e47, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x268c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.454] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec87e47, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ec87e47, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x268c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.454] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0178.454] GetProcessHeap () returned 0xfd0000 [0178.454] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.454] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu-za", cAlternateFileName="")) returned 0 [0178.454] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.454] GetProcessHeap () returned 0xfd0000 [0178.454] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0178.456] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59fa41b9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x91e28c9b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e28c9b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.7294.0108", cAlternateFileName="173729~1.010")) returned 1 [0178.456] GetProcessHeap () returned 0xfd0000 [0178.456] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0178.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59fa41b9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x91e28c9b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e28c9b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0178.457] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59fa41b9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x91e28c9b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e28c9b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.460] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2f9348, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a2f9348, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a2f9348, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd5ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="adal.dll", cAlternateFileName="")) returned 1 [0178.460] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x665613bf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66a9861a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66a9861a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="adm", cAlternateFileName="")) returned 1 [0178.460] GetProcessHeap () returned 0xfd0000 [0178.460] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\adm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x665613bf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66a9861a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66ff5aca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.461] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x665613bf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66a9861a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66ff5aca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.461] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9861a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66a9861a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66abe868, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.adml", cAlternateFileName="ONEDRI~1.ADM")) returned 1 [0178.461] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ff5aca, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66ff5aca, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66ff5aca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.admx", cAlternateFileName="ONEDRI~2.ADM")) returned 1 [0178.461] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ff5aca, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66ff5aca, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66ff5aca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.admx", cAlternateFileName="ONEDRI~2.ADM")) returned 0 [0178.461] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.461] GetProcessHeap () returned 0xfd0000 [0178.461] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.461] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x670b4694, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x670b4694, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x670b4694, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0178.462] GetProcessHeap () returned 0xfd0000 [0178.462] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\af\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x670b4694, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x670b4694, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6759f429, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.462] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x670b4694, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x670b4694, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6759f429, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.462] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6759f429, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6759f429, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6759f429, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x258a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.463] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6759f429, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6759f429, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6759f429, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x258a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.463] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0178.463] GetProcessHeap () returned 0xfd0000 [0178.463] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.463] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3117b2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a3117b2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a3117b2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="alertIcon.png", cAlternateFileName="ALERTI~1.PNG")) returned 1 [0178.463] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ab06d3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x67ab06d3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x67ab06d3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am-et", cAlternateFileName="")) returned 1 [0178.463] GetProcessHeap () returned 0xfd0000 [0178.463] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\am-et\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ab06d3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x67ab06d3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x680cc483, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.464] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ab06d3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x67ab06d3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x680cc483, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x680cc483, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x680cc483, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x680cc483, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x680cc483, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x680cc483, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x680cc483, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.464] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.464] GetProcessHeap () returned 0xfd0000 [0178.464] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x680cc483, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x68b3a963, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x68b3a963, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0178.464] GetProcessHeap () returned 0xfd0000 [0178.464] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\amd64\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x680cc483, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6917cc35, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6917cc35, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.464] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x680cc483, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6917cc35, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6917cc35, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68603707, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x68603707, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x68603707, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x29c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuthLib64.dll", cAlternateFileName="FILECO~1.DLL")) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b3a963, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x68b3a963, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x68b3a963, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xff8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi64.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6917cc35, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6917cc35, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6917cc35, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2cce98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0178.464] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6917cc35, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6917cc35, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6917cc35, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2cce98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 0 [0178.465] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.465] GetProcessHeap () returned 0xfd0000 [0178.465] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a337a1b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a337a1b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a337a1b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a35dcc3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a35dcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a35dcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a35dcc3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a35dcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a35dcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a383ec3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a383ec3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a383ec3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3aa122, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a3aa122, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a3aa122, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x54a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="AP87F4~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3aa122, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a3aa122, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a3aa122, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3d037e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a3d037e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a3d037e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="APC7B0~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3f65d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a3f65d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a3f65d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="AP4F63~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3f65d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a3f65d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a3f65d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="AP26B7~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a41c83d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a41c83d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a41c83d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="AP40C7~1.DLL")) returned 1 [0178.465] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a442a88, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a442a88, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a442a88, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x48a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="APD0F3~1.DLL")) returned 1 [0178.467] GetProcessHeap () returned 0xfd0000 [0178.467] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ar\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x691a2e8a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x691a2e8a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x697beefd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.467] GetProcessHeap () returned 0xfd0000 [0178.467] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.468] GetProcessHeap () returned 0xfd0000 [0178.468] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\arm64\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x697beefd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x69d6885c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6a4dbe1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.469] GetProcessHeap () returned 0xfd0000 [0178.469] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.469] GetProcessHeap () returned 0xfd0000 [0178.469] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\as-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a502076, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6a502076, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6adccb37, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.471] GetProcessHeap () returned 0xfd0000 [0178.471] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.471] GetProcessHeap () returned 0xfd0000 [0178.471] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\az-latn-az\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6adccb37, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6adccb37, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6b40ee40, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.471] GetProcessHeap () returned 0xfd0000 [0178.471] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.471] GetProcessHeap () returned 0xfd0000 [0178.472] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\be\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b435092, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6b435092, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6beefaef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.473] GetProcessHeap () returned 0xfd0000 [0178.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.473] GetProcessHeap () returned 0xfd0000 [0178.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\bg\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bf15dcd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6bf15dcd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6c616abb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.474] GetProcessHeap () returned 0xfd0000 [0178.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.474] GetProcessHeap () returned 0xfd0000 [0178.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\bn-bd\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c616abb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6c616abb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6cc32b2e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0178.474] GetProcessHeap () returned 0xfd0000 [0178.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.474] GetProcessHeap () returned 0xfd0000 [0178.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\bn-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cc32b2e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6cc32b2e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d228941, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.475] GetProcessHeap () returned 0xfd0000 [0178.475] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.475] GetProcessHeap () returned 0xfd0000 [0178.475] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\bs-latn-ba\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d274dfa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d274dfa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d81e75c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.476] GetProcessHeap () returned 0xfd0000 [0178.477] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.477] GetProcessHeap () returned 0xfd0000 [0178.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ca\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d81e75c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d81e75c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6deacef1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.477] GetProcessHeap () returned 0xfd0000 [0178.477] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.477] GetProcessHeap () returned 0xfd0000 [0178.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ca-es-valencia\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6deacef1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6deacef1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6e4a2cfa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.478] GetProcessHeap () returned 0xfd0000 [0178.478] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.478] GetProcessHeap () returned 0xfd0000 [0178.478] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\cs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e94183a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6e94183a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f08ebbe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.479] GetProcessHeap () returned 0xfd0000 [0178.479] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.479] GetProcessHeap () returned 0xfd0000 [0178.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\cy-gb\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f1010c8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f1010c8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f7b5a23, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.480] GetProcessHeap () returned 0xfd0000 [0178.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.480] GetProcessHeap () returned 0xfd0000 [0178.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\da\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f7b5a23, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f7b5a23, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6fd855e4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.481] GetProcessHeap () returned 0xfd0000 [0178.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.551] GetProcessHeap () returned 0xfd0000 [0178.551] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\de\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fdd1a99, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6fdd1a99, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7043a22e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.567] GetProcessHeap () returned 0xfd0000 [0178.567] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.567] GetProcessHeap () returned 0xfd0000 [0178.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\el\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7043a22e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7043a22e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x70a7c290, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.568] GetProcessHeap () returned 0xfd0000 [0178.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.568] GetProcessHeap () returned 0xfd0000 [0178.568] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\en\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a7c290, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x70a7c290, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x710720aa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.569] GetProcessHeap () returned 0xfd0000 [0178.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.569] GetProcessHeap () returned 0xfd0000 [0178.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\en-gb\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x710720aa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x710720aa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x71ae05fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.569] GetProcessHeap () returned 0xfd0000 [0178.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.569] GetProcessHeap () returned 0xfd0000 [0178.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\es\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ae05fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x71ae05fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7229ffc6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.570] GetProcessHeap () returned 0xfd0000 [0178.570] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.570] GetProcessHeap () returned 0xfd0000 [0178.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\et\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7229ffc6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7229ffc6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x728bc02e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.571] GetProcessHeap () returned 0xfd0000 [0178.572] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.572] GetProcessHeap () returned 0xfd0000 [0178.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\eu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72954ae0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x72954ae0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x72f96c5d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.572] GetProcessHeap () returned 0xfd0000 [0178.572] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.572] GetProcessHeap () returned 0xfd0000 [0178.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\fa\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72f96c5d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x72f96c5d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x738617b8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.572] GetProcessHeap () returned 0xfd0000 [0178.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.573] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738617b8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x738617b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x738617b8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0178.573] GetProcessHeap () returned 0xfd0000 [0178.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\fi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738617b8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x738617b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73e57549, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.574] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738617b8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x738617b8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73e57549, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.574] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73e57549, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73e57549, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73e57549, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.574] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73e57549, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73e57549, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73e57549, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.574] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0178.574] GetProcessHeap () returned 0xfd0000 [0178.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.574] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73e57549, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73e57549, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73e57549, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil-ph", cAlternateFileName="")) returned 1 [0178.574] GetProcessHeap () returned 0xfd0000 [0178.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\fil-ph\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73e57549, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73e57549, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x745cab18, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.575] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73e57549, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73e57549, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x745cab18, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.575] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745cab18, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x745cab18, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x745cab18, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x294a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.575] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745cab18, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x745cab18, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x745cab18, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x294a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.575] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.576] GetProcessHeap () returned 0xfd0000 [0178.576] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.576] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a9c6187, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a9c6187, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5aa3889c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuth.exe", cAlternateFileName="FILECO~1.EXE")) returned 1 [0178.576] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aa5eaf8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5aa5eaf8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5aa5eaf8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x268a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileCoAuthLib.dll", cAlternateFileName="FILECO~1.DLL")) returned 1 [0178.576] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aa84d4d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5aa84d4d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5aa84d4d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x222a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0178.576] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aaaafa9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5aaaafa9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5aaaafa9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xab4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0178.576] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ab69b65, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5ab69b65, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5ab69b65, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbb298, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac74bf1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5ac74bf1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5ac74bf1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x30d8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad7fc57, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5ad7fc57, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5ad7fc57, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae64a72, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5ae64a72, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5ae64a72, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncFAL.dll", cAlternateFileName="FI0695~1.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af49891, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5af49891, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5afe2205, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x35aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncFALWB.dll", cAlternateFileName="FI7839~1.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2448f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b2448f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b26aa56, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x182ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b43463e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b43463e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b43463e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28aca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5d801f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b5d801f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b5d801f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xe80a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncViews.dll", cAlternateFileName="FI224F~1.DLL")) returned 1 [0178.577] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745cab18, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x745cab18, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x745cab18, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0178.577] GetProcessHeap () returned 0xfd0000 [0178.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\fr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745cab18, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x745cab18, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74a43158, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745cab18, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x745cab18, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74a43158, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74a43158, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74a43158, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74a43158, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74a43158, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74a43158, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74a43158, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.578] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.578] GetProcessHeap () returned 0xfd0000 [0178.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.578] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a43158, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74a43158, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74a43158, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ga-ie", cAlternateFileName="")) returned 1 [0178.579] GetProcessHeap () returned 0xfd0000 [0178.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ga-ie\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a43158, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74a43158, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7538045a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.579] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a43158, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74a43158, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7538045a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.579] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7538045a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7538045a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7538045a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.579] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7538045a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7538045a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7538045a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.580] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.580] GetProcessHeap () returned 0xfd0000 [0178.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.580] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7538045a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7538045a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7538045a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gd-latn", cAlternateFileName="")) returned 1 [0178.580] GetProcessHeap () returned 0xfd0000 [0178.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\gd-latn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7538045a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7538045a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x759c2637, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.582] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7538045a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7538045a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x759c2637, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.582] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x759c2637, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x759c2637, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x759c2637, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.582] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x759c2637, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x759c2637, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x759c2637, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.582] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.582] GetProcessHeap () returned 0xfd0000 [0178.582] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.582] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x759c2637, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x759c2637, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x759c2637, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0178.582] GetProcessHeap () returned 0xfd0000 [0178.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\gl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x759c2637, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x759c2637, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75f6bf95, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.583] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x759c2637, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x759c2637, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75f6bf95, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.583] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f6bf95, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75f6bf95, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75f6bf95, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.583] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f6bf95, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75f6bf95, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75f6bf95, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.583] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0178.583] GetProcessHeap () returned 0xfd0000 [0178.583] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.583] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75f6bf95, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75f6bf95, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75f6bf95, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0178.583] GetProcessHeap () returned 0xfd0000 [0178.583] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\gu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75f6bf95, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75f6bf95, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76456d46, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.584] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75f6bf95, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75f6bf95, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76456d46, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.584] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76456d46, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76456d46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76456d46, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x254a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.584] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76456d46, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76456d46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76456d46, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x254a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.584] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.584] GetProcessHeap () returned 0xfd0000 [0178.584] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.584] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76456d46, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76456d46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76456d46, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ha-latn-ng", cAlternateFileName="HA-LAT~1")) returned 1 [0178.584] GetProcessHeap () returned 0xfd0000 [0178.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ha-latn-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76456d46, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76456d46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a72db5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.585] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76456d46, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76456d46, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a72db5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.585] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a72db5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a72db5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a72db5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x258a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.585] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a72db5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a72db5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a72db5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x258a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.585] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.585] GetProcessHeap () returned 0xfd0000 [0178.585] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.585] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d5459, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a0d5459, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5a0d5459, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0178.585] GetProcessHeap () returned 0xfd0000 [0178.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\he\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d5459, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a0d5459, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5abdc284, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0178.586] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d5459, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5a0d5459, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5abdc284, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.586] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abdc284, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5abdc284, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5abdc284, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1eaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.586] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abdc284, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5abdc284, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5abdc284, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1eaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.586] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0178.586] GetProcessHeap () returned 0xfd0000 [0178.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.587] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abdc284, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5abdc284, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5abdc284, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0178.587] GetProcessHeap () returned 0xfd0000 [0178.587] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\hi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abdc284, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5abdc284, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b2b6efa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.587] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abdc284, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5abdc284, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b2b6efa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.587] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2b6efa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b2b6efa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b2b6efa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x262a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.587] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2b6efa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b2b6efa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b2b6efa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x262a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.588] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.588] GetProcessHeap () returned 0xfd0000 [0178.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.588] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2b6efa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b2b6efa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b2b6efa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0178.588] GetProcessHeap () returned 0xfd0000 [0178.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\hr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2b6efa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b2b6efa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b9b7d40, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.588] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2b6efa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b2b6efa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b9b7d40, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.588] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9b7d40, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b9b7d40, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b9b7d40, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x260a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.588] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9b7d40, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b9b7d40, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b9b7d40, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x260a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.588] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.588] GetProcessHeap () returned 0xfd0000 [0178.588] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.588] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b9b7d40, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b9b7d40, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b9b7d40, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0178.588] GetProcessHeap () returned 0xfd0000 [0178.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\hu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b9b7d40, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b9b7d40, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c0b8be0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.589] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b9b7d40, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b9b7d40, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c0b8be0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.589] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c0b8be0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c0b8be0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c0b8be0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x272a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.589] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c0b8be0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c0b8be0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c0b8be0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x272a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.589] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.589] GetProcessHeap () returned 0xfd0000 [0178.589] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.589] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c0b8be0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c0b8be0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c0b8be0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0178.589] GetProcessHeap () returned 0xfd0000 [0178.589] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\hy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c0b8be0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c0b8be0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c747367, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.589] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c0b8be0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c0b8be0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c747367, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.589] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c747367, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c747367, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c747367, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25098, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.589] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c747367, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c747367, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c747367, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25098, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.590] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.590] GetProcessHeap () returned 0xfd0000 [0178.590] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.590] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c747367, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c747367, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c747367, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0178.590] GetProcessHeap () returned 0xfd0000 [0178.590] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\id\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c747367, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c747367, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5cd3d185, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c747367, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c747367, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5cd3d185, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd3d185, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5cd3d185, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5cd3d185, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.591] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd3d185, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5cd3d185, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5cd3d185, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.591] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.591] GetProcessHeap () returned 0xfd0000 [0178.591] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.591] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cd633eb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5cd633eb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5cd633eb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ig-ng", cAlternateFileName="")) returned 1 [0178.591] GetProcessHeap () returned 0xfd0000 [0178.591] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ig-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cd633eb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5cd633eb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5d37f461, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.592] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5cd633eb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5cd633eb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5d37f461, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.592] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d37f461, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5d37f461, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5d37f461, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x216a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.592] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d37f461, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5d37f461, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5d37f461, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x216a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.592] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.592] GetProcessHeap () returned 0xfd0000 [0178.592] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.592] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f461, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5da33e45, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5da33e45, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imageformats", cAlternateFileName="IMAGEF~1")) returned 1 [0178.592] GetProcessHeap () returned 0xfd0000 [0178.592] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\imageformats\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f461, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5da33e45, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5dfb7544, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.593] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f461, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5da33e45, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5dfb7544, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.593] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5da33e45, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5da33e45, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5da33e45, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjpeg.dll", cAlternateFileName="")) returned 1 [0178.593] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dfb7544, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5dfb7544, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5dfb7544, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qsvg.dll", cAlternateFileName="")) returned 1 [0178.593] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dfb7544, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5dfb7544, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5dfb7544, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qsvg.dll", cAlternateFileName="")) returned 0 [0178.593] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.593] GetProcessHeap () returned 0xfd0000 [0178.593] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.593] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dfb7544, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6b566373, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6b566373, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0178.593] GetProcessHeap () returned 0xfd0000 [0178.593] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\images\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dfb7544, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6b566373, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6bf62145, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.595] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dfb7544, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6b566373, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6bf62145, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e776fa2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5e776fa2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5e776fa2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="acmDismissIcon.svg", cAlternateFileName="ACMDIS~1.SVG")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee9e08c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5ee9e08c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5ee9e08c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="blurrect.png", cAlternateFileName="")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f578ccc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5f578ccc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5f578ccc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_finished.svg", cAlternateFileName="CHECKM~1.SVG")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc2d6dc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5fc2d6dc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5fc2d6dc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_hovered.svg", cAlternateFileName="CHECKM~2.SVG")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60249726, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x60249726, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x60249726, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_in_progress.svg", cAlternateFileName="CHECKM~3.SVG")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6088b9f5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6088b9f5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6088b9f5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_selected.svg", cAlternateFileName="CHECKM~4.SVG")) returned 1 [0178.597] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ea7a68, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x60ea7a68, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x60ea7a68, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="chevron.svg", cAlternateFileName="")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614513cd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x614513cd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x614513cd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="chevronUp.svg", cAlternateFileName="CHEVRO~1.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619d4add, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x619d4add, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x619d4add, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud.svg", cAlternateFileName="")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620fbbd5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x620fbbd5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x620fbbd5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="done_graphic.svg", cAlternateFileName="DONE_G~1.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x627b05bc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x627b05bc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x627b05bc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="errorIcon.svg", cAlternateFileName="ERRORI~1.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e3ed32, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x62e3ed32, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x62e3ed32, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.svg", cAlternateFileName="")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64151add, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x64151add, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x64151add, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x79b, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_desktop.svg", cAlternateFileName="FOLDER~1.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6489edac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6489edac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6489edac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5031, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_documents.svg", cAlternateFileName="FOLDER~2.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650f716d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x650f716d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x650f716d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_pictures.svg", cAlternateFileName="FOLDER~3.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65785995, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x65785995, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x65785995, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x172e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iceBucket.svg", cAlternateFileName="ICEBUC~1.SVG")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f6b5a1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x65f6b5a1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x65f6b5a1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading.svg", cAlternateFileName="")) returned 1 [0178.598] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6666c433, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6666c433, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6666c433, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading_spinner.svg", cAlternateFileName="LOADIN~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66cd4968, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x66cd4968, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x66cd4968, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="onDemandFiles.svg", cAlternateFileName="ONDEMA~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6733ce97, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6733ce97, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x673630f6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="onDemandFilesDehydrate.svg", cAlternateFileName="ONDEMA~2.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6771cbbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6771cbbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x67ab06d3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="onDemandSelectiveSync.svg", cAlternateFileName="ONDEMA~3.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682239dc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x682239dc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x682239dc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="onedrivePremium.svg", cAlternateFileName="ONEDRI~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x688197f9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x688197f9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x688197f9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3db, dwReserved0=0x0, dwReserved1=0x0, cFileName="overflowIcon.svg", cAlternateFileName="OVERFL~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f1a69f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x68f1a69f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x68f1a69f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="overflowIconWhite.svg", cAlternateFileName="OVERFL~2.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695cf06e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x695cf06e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x695cf06e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x0, dwReserved1=0x0, cFileName="partiallyFreezing.svg", cAlternateFileName="PARTIA~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69ca9ca0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x69ca9ca0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x69ca9ca0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x136, dwReserved0=0x0, dwReserved1=0x0, cFileName="paused.svg", cAlternateFileName="")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3848e0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6a3848e0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6a3848e0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56d, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.svg", cAlternateFileName="")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a92e250, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6a92e250, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6a92e250, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x56f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settingsdisabled.svg", cAlternateFileName="SETTIN~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ad0df78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6ad0df78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6ad0df78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="signIn.svg", cAlternateFileName="")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b566373, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6b566373, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6b566373, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="stackedIceCubes.svg", cAlternateFileName="STACKE~1.SVG")) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bc8d41c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6bc8d41c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6bf62145, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="waterGlass.svg", cAlternateFileName="WATERG~1.SVG")) returned 1 [0178.600] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bc8d41c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6bc8d41c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6bf62145, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="waterGlass.svg", cAlternateFileName="WATERG~1.SVG")) returned 0 [0178.600] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.601] GetProcessHeap () returned 0xfd0000 [0178.601] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.601] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bf62145, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6bf62145, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6bf62145, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1 [0178.601] GetProcessHeap () returned 0xfd0000 [0178.601] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\is\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bf62145, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6bf62145, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6c662f66, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0178.601] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bf62145, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6bf62145, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6c662f66, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.601] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c662f66, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6c662f66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6c662f66, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.601] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c662f66, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6c662f66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6c662f66, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.602] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0178.602] GetProcessHeap () returned 0xfd0000 [0178.602] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.602] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c662f66, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6c662f66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6c662f66, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0178.602] GetProcessHeap () returned 0xfd0000 [0178.602] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\it\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c662f66, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6c662f66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6cca5235, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.602] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c662f66, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6c662f66, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6cca5235, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.602] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cca5235, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6cca5235, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6cca5235, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x270a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.602] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cca5235, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6cca5235, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6cca5235, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x270a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.602] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.602] GetProcessHeap () returned 0xfd0000 [0178.603] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.603] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cca5235, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6cca5235, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6cca5235, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0178.603] GetProcessHeap () returned 0xfd0000 [0178.603] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ja\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cca5235, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6cca5235, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d359c11, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.603] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cca5235, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6cca5235, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d359c11, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.603] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d359c11, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d359c11, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d359c11, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x18298, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.603] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d359c11, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d359c11, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d359c11, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x18298, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.604] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.604] GetProcessHeap () returned 0xfd0000 [0178.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.604] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d359c11, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d359c11, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d359c11, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0178.604] GetProcessHeap () returned 0xfd0000 [0178.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ka\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d359c11, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d359c11, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d8b70c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.604] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d359c11, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d359c11, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d8b70c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.604] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8b70c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d8b70c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d8dd32c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.604] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d8b70c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d8b70c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d8dd32c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.604] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.604] GetProcessHeap () returned 0xfd0000 [0178.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.604] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d9297d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d9297d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6d9297d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0178.604] GetProcessHeap () returned 0xfd0000 [0178.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\kk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d9297d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d9297d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6dfde1ba, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.605] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d9297d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6d9297d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6dfde1ba, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.605] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfde1ba, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6dfde1ba, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6dfde1ba, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x272a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.605] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfde1ba, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6dfde1ba, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6dfde1ba, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x272a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.605] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.605] GetProcessHeap () returned 0xfd0000 [0178.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.605] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dfde1ba, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6dfde1ba, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6dfde1ba, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km-kh", cAlternateFileName="")) returned 1 [0178.605] GetProcessHeap () returned 0xfd0000 [0178.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\km-kh\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dfde1ba, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6dfde1ba, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6e515464, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.605] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dfde1ba, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6dfde1ba, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6e515464, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.605] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e515464, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6e515464, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6e94183a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.605] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e515464, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6e515464, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6e94183a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.606] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.606] GetProcessHeap () returned 0xfd0000 [0178.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.606] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e9b3d6d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6e9b3d6d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6e9b3d6d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0178.606] GetProcessHeap () returned 0xfd0000 [0178.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\kn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e9b3d6d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6e9b3d6d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6efa9b17, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.606] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e9b3d6d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6e9b3d6d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6efa9b17, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.606] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efa9b17, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6efa9b17, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6efa9b17, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x284a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.606] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efa9b17, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6efa9b17, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6efa9b17, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x284a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.606] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.606] GetProcessHeap () returned 0xfd0000 [0178.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.606] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f08ebbe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f08ebbe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f08ebbe, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0178.607] GetProcessHeap () returned 0xfd0000 [0178.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ko\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f08ebbe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f08ebbe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f743315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.607] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f08ebbe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f08ebbe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f743315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.607] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f743315, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f743315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f743315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x172a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.607] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f743315, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f743315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f743315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x172a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.607] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.607] GetProcessHeap () returned 0xfd0000 [0178.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.607] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f743315, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f743315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6f743315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kok", cAlternateFileName="")) returned 1 [0178.607] GetProcessHeap () returned 0xfd0000 [0178.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\kok\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f743315, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f743315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6fd855e4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.607] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f743315, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6f743315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6fd855e4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.608] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd855e4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6fd855e4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6fd855e4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.608] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd855e4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6fd855e4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6fd855e4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.608] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.608] GetProcessHeap () returned 0xfd0000 [0178.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.608] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd855e4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6fd855e4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6fd855e4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ku-arab", cAlternateFileName="")) returned 1 [0178.608] GetProcessHeap () returned 0xfd0000 [0178.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ku-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd855e4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6fd855e4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x704ac724, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.608] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd855e4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6fd855e4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x704ac724, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.608] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ac724, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x704ac724, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x704ac724, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x264a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.608] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ac724, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x704ac724, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x704ac724, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x264a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.609] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.609] GetProcessHeap () returned 0xfd0000 [0178.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.609] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704ac724, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x704ac724, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x704ac724, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ky", cAlternateFileName="")) returned 1 [0178.609] GetProcessHeap () returned 0xfd0000 [0178.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ky\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704ac724, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x704ac724, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x70aee99e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.609] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704ac724, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x704ac724, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x70aee99e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.609] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70aee99e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x70aee99e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x70aee99e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x254a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.609] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70aee99e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x70aee99e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x70aee99e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x254a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.609] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0178.609] GetProcessHeap () returned 0xfd0000 [0178.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.609] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70aee99e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x70aee99e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x70aee99e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-lu", cAlternateFileName="")) returned 1 [0178.609] GetProcessHeap () returned 0xfd0000 [0178.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\lb-lu\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70aee99e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x70aee99e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x71a6e131, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0178.768] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70aee99e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x70aee99e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x71a6e131, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.768] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a6e131, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x71a6e131, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x71a9417f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x294a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.768] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a6e131, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x71a6e131, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x71a9417f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x294a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.769] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0178.769] GetProcessHeap () returned 0xfd0000 [0178.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.769] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b70940e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b70940e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b70940e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x13a098, dwReserved0=0x0, dwReserved1=0x0, cFileName="libeay32.dll", cAlternateFileName="")) returned 1 [0178.769] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b860841, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5b860841, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5b860841, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x74a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libEGL.dll", cAlternateFileName="")) returned 1 [0178.769] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ba2a455, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5ba2a455, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5ba2a455, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1e06a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0178.769] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bbf4095, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5bbf4095, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5bbf4095, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1900, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadingPage.html", cAlternateFileName="LOADIN~1.HTM")) returned 1 [0178.769] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bdbdcd6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5bdbdcd6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5bdbdcd6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1516a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 1 [0178.770] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a9417f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x71a9417f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x71a9417f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0178.770] GetProcessHeap () returned 0xfd0000 [0178.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\lt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a9417f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x71a9417f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x723126c2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a9417f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x71a9417f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x723126c2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723126c2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x723126c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x723126c2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723126c2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x723126c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x723126c2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.770] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.770] GetProcessHeap () returned 0xfd0000 [0178.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.770] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x723126c2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x723126c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x723126c2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0178.770] GetProcessHeap () returned 0xfd0000 [0178.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\lv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x723126c2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x723126c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x728e228e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.771] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x723126c2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x723126c2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x728e228e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.771] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728e228e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x728e228e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x72954ae0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.771] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728e228e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x728e228e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x72954ae0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.771] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.771] GetProcessHeap () returned 0xfd0000 [0178.771] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.771] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x729c70f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x729c70f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x729c70f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi-nz", cAlternateFileName="")) returned 1 [0178.771] GetProcessHeap () returned 0xfd0000 [0178.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\mi-nz\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x729c70f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x729c70f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x730ee190, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0178.773] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x729c70f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x729c70f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x730ee190, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.773] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730ee190, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x730ee190, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x730ee190, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x250a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.773] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730ee190, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x730ee190, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x730ee190, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x250a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.773] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0178.773] GetProcessHeap () returned 0xfd0000 [0178.773] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.773] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x737a2e22, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x737a2e22, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x737a2e22, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mk", cAlternateFileName="")) returned 1 [0178.773] GetProcessHeap () returned 0xfd0000 [0178.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\mk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x737a2e22, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x737a2e22, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73eefec1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.775] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x737a2e22, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x737a2e22, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73eefec1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.775] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eefec1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73eefec1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73eefec1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.775] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eefec1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73eefec1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73eefec1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.775] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.775] GetProcessHeap () returned 0xfd0000 [0178.775] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.775] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73eefec1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73eefec1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x73eefec1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml-in", cAlternateFileName="")) returned 1 [0178.775] GetProcessHeap () returned 0xfd0000 [0178.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ml-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73eefec1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73eefec1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7472202c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.775] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73eefec1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x73eefec1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7472202c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.776] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7472202c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7472202c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7472202c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x29a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.776] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7472202c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7472202c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7472202c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x29a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.776] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.776] GetProcessHeap () returned 0xfd0000 [0178.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.776] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74938114, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74938114, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74938114, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0178.776] GetProcessHeap () returned 0xfd0000 [0178.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\mn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74938114, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74938114, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74f07ccb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.776] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74938114, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74938114, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74f07ccb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.776] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f07ccb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74f07ccb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74f07ccb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x258a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.776] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f07ccb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x74f07ccb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x74f07ccb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x258a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.776] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.776] GetProcessHeap () returned 0xfd0000 [0178.776] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.776] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7530def7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7530def7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7530def7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0178.776] GetProcessHeap () returned 0xfd0000 [0178.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\mr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7530def7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7530def7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75a5af9d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.777] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7530def7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7530def7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75a5af9d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.777] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a5af9d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75a5af9d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75a5af9d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25498, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.777] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a5af9d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75a5af9d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75a5af9d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25498, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.777] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0178.777] GetProcessHeap () returned 0xfd0000 [0178.777] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.777] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75a5af9d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75a5af9d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x75a5af9d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0178.777] GetProcessHeap () returned 0xfd0000 [0178.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75a5af9d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75a5af9d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x761a82f8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.777] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75a5af9d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x75a5af9d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x761a82f8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.777] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761a82f8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x761a82f8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x761a82f8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x264a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.777] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761a82f8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x761a82f8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x761a82f8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x264a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.778] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.778] GetProcessHeap () returned 0xfd0000 [0178.778] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.778] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c020276, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c020276, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c020276, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6aca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0178.778] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x763e463c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x763e463c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x763e463c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mt-mt", cAlternateFileName="")) returned 1 [0178.778] GetProcessHeap () returned 0xfd0000 [0178.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\mt-mt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x763e463c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x763e463c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a006a8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.779] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x763e463c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x763e463c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a006a8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.779] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a006a8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a006a8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a006a8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.779] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a006a8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a006a8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a006a8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.779] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.779] GetProcessHeap () returned 0xfd0000 [0178.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.779] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a006a8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a006a8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76a006a8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0178.779] GetProcessHeap () returned 0xfd0000 [0178.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\nb-no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a006a8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a006a8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76d47a6a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.780] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76a006a8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76a006a8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76d47a6a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.780] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d47a6a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76d47a6a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76d47a6a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24498, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.780] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d47a6a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76d47a6a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76d47a6a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24498, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.780] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.780] GetProcessHeap () returned 0xfd0000 [0178.780] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.780] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76d47a6a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76d47a6a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x76d47a6a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne-np", cAlternateFileName="")) returned 1 [0178.780] GetProcessHeap () returned 0xfd0000 [0178.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ne-np\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76d47a6a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76d47a6a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77612579, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.782] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76d47a6a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x76d47a6a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77612579, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.782] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77612579, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77612579, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77612579, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.782] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77612579, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77612579, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77612579, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.782] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.782] GetProcessHeap () returned 0xfd0000 [0178.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.782] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77684e57, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77684e57, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77684e57, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0178.782] GetProcessHeap () returned 0xfd0000 [0178.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\nl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77684e57, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77684e57, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77b4d6f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.783] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77684e57, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77684e57, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77b4d6f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.783] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b4d6f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77b4d6f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77b4d6f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.783] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b4d6f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77b4d6f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77b4d6f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.783] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.783] GetProcessHeap () returned 0xfd0000 [0178.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.783] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b4d6f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77b4d6f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77b4d6f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-no", cAlternateFileName="")) returned 1 [0178.783] GetProcessHeap () returned 0xfd0000 [0178.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\nn-no\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b4d6f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77b4d6f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77e90b59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0178.784] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b4d6f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77b4d6f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77e90b59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.784] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e90b59, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77e90b59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77e90b59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.784] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e90b59, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77e90b59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77e90b59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.784] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0178.784] GetProcessHeap () returned 0xfd0000 [0178.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.785] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77e90b59, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77e90b59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x77e90b59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nso-za", cAlternateFileName="")) returned 1 [0178.785] GetProcessHeap () returned 0xfd0000 [0178.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\nso-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77e90b59, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77e90b59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x782243c6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.786] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77e90b59, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x77e90b59, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x782243c6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.786] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782243c6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x782243c6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x782243c6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x278a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.786] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782243c6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x782243c6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x782243c6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x278a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.786] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.786] GetProcessHeap () returned 0xfd0000 [0178.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.786] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c44c464, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x5c44c464, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c44c464, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveLogo.png", cAlternateFileName="ONEDRI~1.PNG")) returned 1 [0178.786] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d1dbfe, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x91d1dbfe, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x51c3686e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x17ec0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~2.EXE")) returned 1 [0178.786] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x782243c6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x782243c6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x782243c6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="or-in", cAlternateFileName="")) returned 1 [0178.786] GetProcessHeap () returned 0xfd0000 [0178.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\or-in\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x782243c6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x782243c6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78545521, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.787] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x782243c6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x782243c6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78545521, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.787] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78545521, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78545521, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78545521, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x296a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.787] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78545521, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78545521, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78545521, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x296a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.787] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.787] GetProcessHeap () returned 0xfd0000 [0178.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.787] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78545521, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78545521, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78545521, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa", cAlternateFileName="")) returned 1 [0178.787] GetProcessHeap () returned 0xfd0000 [0178.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\pa\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78545521, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78545521, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78866691, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.788] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78545521, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78545521, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78866691, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.788] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78866691, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78866691, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78866691, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26498, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.788] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78866691, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78866691, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78866691, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26498, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.788] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.788] GetProcessHeap () returned 0xfd0000 [0178.788] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.788] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788ff291, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x788ff291, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x788ff291, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa-arab", cAlternateFileName="")) returned 1 [0178.788] GetProcessHeap () returned 0xfd0000 [0178.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\pa-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788ff291, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x788ff291, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78d04f8a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0178.789] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788ff291, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x788ff291, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78d04f8a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.789] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d04f8a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78d04f8a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78d04f8a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.789] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d04f8a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78d04f8a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78d04f8a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.789] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0178.789] GetProcessHeap () returned 0xfd0000 [0178.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.789] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d2b1e2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78d2b1e2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x78d2b1e2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0178.789] GetProcessHeap () returned 0xfd0000 [0178.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\pl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d2b1e2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78d2b1e2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x791573db, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.790] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d2b1e2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x78d2b1e2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x791573db, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.790] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x791573db, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x791573db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x791573db, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x284a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.790] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x791573db, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x791573db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x791573db, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x284a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.790] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.790] GetProcessHeap () returned 0xfd0000 [0178.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.791] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791573db, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x791573db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x791573db, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="platforms", cAlternateFileName="PLATFO~1")) returned 1 [0178.791] GetProcessHeap () returned 0xfd0000 [0178.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\platforms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791573db, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x791573db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79510e8c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.791] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791573db, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x791573db, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79510e8c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.791] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79510e8c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79510e8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79510e8c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10c4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 1 [0178.792] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79510e8c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79510e8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79510e8c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10c4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwindows.dll", cAlternateFileName="")) returned 0 [0178.792] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.792] GetProcessHeap () returned 0xfd0000 [0178.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.792] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7966859d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7966859d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7966859d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prs-af", cAlternateFileName="")) returned 1 [0178.792] GetProcessHeap () returned 0xfd0000 [0178.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\prs-af\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7966859d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7966859d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79aba7fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0178.793] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7966859d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7966859d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79aba7fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.793] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79aba7fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79aba7fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79aba7fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.793] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79aba7fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79aba7fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79aba7fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.793] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0178.793] GetProcessHeap () returned 0xfd0000 [0178.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.793] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79aba7fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79aba7fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79aba7fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0178.793] GetProcessHeap () returned 0xfd0000 [0178.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\pt-br\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79aba7fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79aba7fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79e27e0c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0178.794] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79aba7fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79aba7fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x79e27e0c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.794] GetProcessHeap () returned 0xfd0000 [0178.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.794] GetProcessHeap () returned 0xfd0000 [0178.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\pt-pt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e27e0c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x79e27e0c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7a7fdb88, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.796] GetProcessHeap () returned 0xfd0000 [0178.796] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.796] GetProcessHeap () returned 0xfd0000 [0178.796] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a8702eb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87cc7b5b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x888d9759, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.799] GetProcessHeap () returned 0xfd0000 [0178.800] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0178.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x888d9759, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8f38ae10, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x90b3c2c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.803] GetProcessHeap () returned 0xfd0000 [0178.803] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Controls\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90b3c2c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x90b3c2c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x90b3c2c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.804] GetProcessHeap () returned 0xfd0000 [0178.804] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0178.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Controls\\Styles\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90b3c2c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x91479622, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9149f6b1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.804] GetProcessHeap () returned 0xfd0000 [0178.804] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0178.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Controls\\Styles\\Flat\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9149f6b1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x918cb7c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91cab62a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.806] GetProcessHeap () returned 0xfd0000 [0178.806] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0178.806] GetProcessHeap () returned 0xfd0000 [0178.806] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0178.806] GetProcessHeap () returned 0xfd0000 [0178.806] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.807] GetProcessHeap () returned 0xfd0000 [0178.807] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Controls.2\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e36d5c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8c9856cc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8cdfdaea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.828] GetProcessHeap () returned 0xfd0000 [0178.828] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.828] GetProcessHeap () returned 0xfd0000 [0178.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Extras\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce23d2b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8d524bcd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8d8b84d7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.829] GetProcessHeap () returned 0xfd0000 [0178.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.829] GetProcessHeap () returned 0xfd0000 [0178.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Layouts\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d904999, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8e21bb1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8e647a56, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.830] GetProcessHeap () returned 0xfd0000 [0178.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.830] GetProcessHeap () returned 0xfd0000 [0178.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Templates.2\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e647a56, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8ee79bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8f38ae10, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.833] GetProcessHeap () returned 0xfd0000 [0178.833] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.833] GetProcessHeap () returned 0xfd0000 [0178.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0178.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick\\Window.2\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f38ae10, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x900cdfd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x90604f73, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.834] GetProcessHeap () returned 0xfd0000 [0178.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0178.834] GetProcessHeap () returned 0xfd0000 [0178.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0178.834] GetProcessHeap () returned 0xfd0000 [0178.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0178.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qml\\QtQuick.2\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87cc7b5b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x884f9caf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x888b34fd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.835] GetProcessHeap () returned 0xfd0000 [0178.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0178.835] GetProcessHeap () returned 0xfd0000 [0178.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.839] GetProcessHeap () returned 0xfd0000 [0178.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\qut-latn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aed86d6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7aed86d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7bbcf4cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.840] GetProcessHeap () returned 0xfd0000 [0178.840] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.840] GetProcessHeap () returned 0xfd0000 [0178.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\quz-pe\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c12c7ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7c12c7ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7c5f30e3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.841] GetProcessHeap () returned 0xfd0000 [0178.841] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.841] GetProcessHeap () returned 0xfd0000 [0178.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ro\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c5f30e3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7c5f30e3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7ca69b59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.842] GetProcessHeap () returned 0xfd0000 [0178.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.842] GetProcessHeap () returned 0xfd0000 [0178.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ru\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ca8fc0b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7ca8fc0b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7da353c7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.843] GetProcessHeap () returned 0xfd0000 [0178.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.843] GetProcessHeap () returned 0xfd0000 [0178.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\rw\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ddc8d0e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7ddc8d0e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7e6937fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.844] GetProcessHeap () returned 0xfd0000 [0178.844] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.844] GetProcessHeap () returned 0xfd0000 [0178.844] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sd-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e79e87a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7e79e87a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7eeebbb2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0178.845] GetProcessHeap () returned 0xfd0000 [0178.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.845] GetProcessHeap () returned 0xfd0000 [0178.845] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\si-lk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eeebbb2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7eeebbb2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7f38a36d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.847] GetProcessHeap () returned 0xfd0000 [0178.847] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.847] GetProcessHeap () returned 0xfd0000 [0178.847] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f38a36d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7f38a36d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7f743cf5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.848] GetProcessHeap () returned 0xfd0000 [0178.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.848] GetProcessHeap () returned 0xfd0000 [0178.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9802b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7f9802b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x7fdf86cb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.848] GetProcessHeap () returned 0xfd0000 [0178.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.849] GetProcessHeap () returned 0xfd0000 [0178.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sq\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fdf86cb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x7fdf86cb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x80270ecd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.849] GetProcessHeap () returned 0xfd0000 [0178.849] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.849] GetProcessHeap () returned 0xfd0000 [0178.849] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sr-cyrl-ba\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80270ecd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x80270ecd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8070f8da, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.850] GetProcessHeap () returned 0xfd0000 [0178.850] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.850] GetProcessHeap () returned 0xfd0000 [0178.850] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sr-cyrl-rs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x807f4700, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x807f4700, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x80cdf4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.851] GetProcessHeap () returned 0xfd0000 [0178.851] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.851] GetProcessHeap () returned 0xfd0000 [0178.851] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sr-latn-rs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cdf4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x80cdf4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x814c50a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.853] GetProcessHeap () returned 0xfd0000 [0178.853] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.853] GetProcessHeap () returned 0xfd0000 [0178.853] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8170141c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8170141c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x81c12233, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.854] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8170141c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8170141c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x81c12233, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.854] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c12233, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x81c12233, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x81c12233, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.854] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c12233, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x81c12233, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x81c12233, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x24aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.854] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.854] GetProcessHeap () returned 0xfd0000 [0178.854] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.854] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81caadff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x81caadff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x81caadff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0178.854] GetProcessHeap () returned 0xfd0000 [0178.854] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\sw\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81caadff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x81caadff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x820fcfa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.855] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81caadff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x81caadff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x820fcfa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.855] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x820fcfa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x820fcfa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x820fcfa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.855] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x820fcfa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x820fcfa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x820fcfa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.855] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.855] GetProcessHeap () returned 0xfd0000 [0178.855] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.855] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62717c63, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x62717c63, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x62717c63, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5498a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 1 [0178.855] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820fcfa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x820fcfa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x820fcfa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0178.856] GetProcessHeap () returned 0xfd0000 [0178.856] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ta\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820fcfa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x820fcfa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8246a5b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0178.864] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820fcfa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x820fcfa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8246a5b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.864] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8246a5b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8246a5b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8246a5b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x296a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.864] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8246a5b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8246a5b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8246a5b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x296a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.864] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0178.864] GetProcessHeap () returned 0xfd0000 [0178.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.864] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x824908b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x824908b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x824908b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0178.864] GetProcessHeap () returned 0xfd0000 [0178.864] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\te\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x824908b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x824908b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82c03db8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.865] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x824908b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x824908b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82c03db8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.865] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c03db8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82c03db8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82c03db8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.865] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c03db8, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82c03db8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82c03db8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.865] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.865] GetProcessHeap () returned 0xfd0000 [0178.865] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.865] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62da6455, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x62da6455, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x62da6455, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x524a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 1 [0178.865] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x640df5fc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x640df5fc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x640df5fc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestSharePage.html", cAlternateFileName="TESTSH~1.HTM")) returned 1 [0178.865] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x82dcdbf9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tg-cyrl", cAlternateFileName="")) returned 1 [0178.867] GetProcessHeap () returned 0xfd0000 [0178.867] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tg-cyrl\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.867] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82dcdbf9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x82dcdbf9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.867] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8321fe2b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8321fe2b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.867] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8321fe2b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8321fe2b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8321fe2b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x28ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.867] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.867] GetProcessHeap () returned 0xfd0000 [0178.867] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.868] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x832461b4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0178.868] GetProcessHeap () returned 0xfd0000 [0178.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\th\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.868] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x832461b4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x832461b4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.868] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x835ffb5a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x835ffb5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x224a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.869] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x835ffb5a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x835ffb5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x835ffb5a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x224a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.869] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.869] GetProcessHeap () returned 0xfd0000 [0178.869] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.869] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6476dad2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6476dad2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6476dad2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xbfe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThirdPartyNotices.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0178.869] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83625f0f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ti", cAlternateFileName="")) returned 1 [0178.869] GetProcessHeap () returned 0xfd0000 [0178.869] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ti\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.869] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83625f0f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83625f0f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.870] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.870] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1bc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.870] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.870] GetProcessHeap () returned 0xfd0000 [0178.870] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.870] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83ba94c3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tk-tm", cAlternateFileName="")) returned 1 [0178.870] GetProcessHeap () returned 0xfd0000 [0178.870] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tk-tm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.870] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83ba94c3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83ba94c3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.870] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.870] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x23aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.870] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0178.870] GetProcessHeap () returned 0xfd0000 [0178.870] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.870] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x83faf448, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tn-za", cAlternateFileName="")) returned 1 [0178.870] GetProcessHeap () returned 0xfd0000 [0178.877] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tn-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.899] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83faf448, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x83faf448, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.899] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.908] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.908] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.913] GetProcessHeap () returned 0xfd0000 [0178.913] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.913] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8431ca5f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0178.921] GetProcessHeap () returned 0xfd0000 [0178.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tr\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0178.923] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8431ca5f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8431ca5f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.923] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.923] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.923] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0178.923] GetProcessHeap () returned 0xfd0000 [0178.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.923] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x848ec705, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tt", cAlternateFileName="")) returned 1 [0178.923] GetProcessHeap () returned 0xfd0000 [0178.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\tt\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d187f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.924] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x848ec705, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x848ec705, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d187f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.924] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d187f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d187f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d3eae9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.924] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d187f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d187f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d3eae9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.924] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.924] GetProcessHeap () returned 0xfd0000 [0178.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e94bc6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x64e94bc6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x64e94bc6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x116ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0178.924] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x84d3eae9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ug-arab", cAlternateFileName="")) returned 1 [0178.924] GetProcessHeap () returned 0xfd0000 [0178.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ug-arab\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85229a93, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0178.925] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d3eae9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x84d3eae9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85229a93, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.925] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85229a93, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85229a93, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8524fb26, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x240a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.925] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85229a93, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85229a93, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8524fb26, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x240a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.925] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0178.925] GetProcessHeap () returned 0xfd0000 [0178.925] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.925] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8524fb26, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0178.925] GetProcessHeap () returned 0xfd0000 [0178.926] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uk\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x856ee5cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.929] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8524fb26, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x8524fb26, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x856ee5cc, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.929] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856ee5cc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x856ee5cc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x857145dd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.930] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856ee5cc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x856ee5cc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x857145dd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x26ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.930] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.930] GetProcessHeap () returned 0xfd0000 [0178.930] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.930] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6543e52f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6543e52f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x65464784, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x19ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateRingSettings.dll", cAlternateFileName="UPDATE~1.DLL")) returned 1 [0178.930] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x857145dd, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1 [0178.930] GetProcessHeap () returned 0xfd0000 [0178.930] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\ur\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.931] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857145dd, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x857145dd, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.931] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cbe150, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85cbe150, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x268a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.931] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cbe150, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85cbe150, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85cbe150, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x268a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.931] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0178.931] GetProcessHeap () returned 0xfd0000 [0178.931] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.931] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x85ce41fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uz-latn-uz", cAlternateFileName="UZ-LAT~1")) returned 1 [0178.931] GetProcessHeap () returned 0xfd0000 [0178.931] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\uz-latn-uz\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.932] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ce41fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x85ce41fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.932] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.932] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x274a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.932] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.932] GetProcessHeap () returned 0xfd0000 [0178.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.932] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659c1c42, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x659c1c42, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x659c1c42, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x144a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0178.932] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86110334, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0178.932] GetProcessHeap () returned 0xfd0000 [0178.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\vi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.933] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86110334, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86110334, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.933] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.933] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x252a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.933] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.933] GetProcessHeap () returned 0xfd0000 [0178.933] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.933] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6602a167, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x6602a167, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x6602a167, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="Warning.png", cAlternateFileName="")) returned 1 [0178.933] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665613bf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x665613bf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x665613bf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x60aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 1 [0178.933] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x864f0063, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wo", cAlternateFileName="")) returned 1 [0178.933] GetProcessHeap () returned 0xfd0000 [0178.933] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\wo\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.934] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x864f0063, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x864f0063, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.934] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x220a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.934] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x220a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.934] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.934] GetProcessHeap () returned 0xfd0000 [0178.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.934] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x868a9b36, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xh-za", cAlternateFileName="")) returned 1 [0178.934] GetProcessHeap () returned 0xfd0000 [0178.934] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\xh-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.935] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868a9b36, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x868a9b36, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.935] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.935] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x25ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.935] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.935] GetProcessHeap () returned 0xfd0000 [0178.935] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.935] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x86c1714d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yo-ng", cAlternateFileName="")) returned 1 [0178.935] GetProcessHeap () returned 0xfd0000 [0178.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\yo-ng\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.936] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86c1714d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x86c1714d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.936] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.936] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x246a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.936] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0178.936] GetProcessHeap () returned 0xfd0000 [0178.936] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.936] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x870696c1, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0178.936] GetProcessHeap () returned 0xfd0000 [0178.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-cn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.937] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x870696c1, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x870696c1, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.937] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.937] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x126a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.937] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.937] GetProcessHeap () returned 0xfd0000 [0178.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.938] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87495786, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0178.938] GetProcessHeap () returned 0xfd0000 [0178.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zh-tw\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.939] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87495786, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87495786, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.939] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.939] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.939] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.939] GetProcessHeap () returned 0xfd0000 [0178.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.939] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu-za", cAlternateFileName="")) returned 1 [0178.939] GetProcessHeap () returned 0xfd0000 [0178.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\17.3.7294.0108\\zu-za\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b703a3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87b703a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0178.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b703a3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87b703a3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87b703a3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x27ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0178.940] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.940] GetProcessHeap () returned 0xfd0000 [0178.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.940] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87802d78, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x87802d78, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87802d78, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu-za", cAlternateFileName="")) returned 0 [0178.940] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0178.940] GetProcessHeap () returned 0xfd0000 [0178.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0178.941] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd897090, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xcd897090, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0178.941] GetProcessHeap () returned 0xfd0000 [0178.941] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0178.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd897090, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xcd897090, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0178.943] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd897090, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xcd897090, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.943] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common", cAlternateFileName="")) returned 1 [0178.943] GetProcessHeap () returned 0xfd0000 [0178.943] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.945] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xcd897090, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x55f90df8, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x33bad36c, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x33bad36c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x400109da, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-11-15.1116.1216.1.odl", cAlternateFileName="STANDA~3.ODL")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x875afc47, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x875afc47, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x9370aa75, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x3dab, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-9-26.1455.6924.1.odl", cAlternateFileName="STANDA~2.ODL")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd8bd310, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd8bd310, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd57401b7, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2017-9-7.839.2648.1.odl", cAlternateFileName="STANDA~1.ODL")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xdcafea7a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xdcafea7a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xeb5f32aa, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2018-1-13.755.2112.1.odl", cAlternateFileName="STANDA~4.ODL")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x36831603, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x36831603, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55f90df8, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater-2018-2-6.1514.3984.1.odl", cAlternateFileName="ST97AD~1.ODL")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x8766e737, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x8766e737, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x892e2653, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="standaloneUpdaterTelemetryCache.otc.session", cAlternateFileName="STANDA~1.SES")) returned 1 [0178.946] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x8766e737, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x8766e737, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x892e2653, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="standaloneUpdaterTelemetryCache.otc.session", cAlternateFileName="STANDA~1.SES")) returned 0 [0178.946] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.947] GetProcessHeap () returned 0xfd0000 [0178.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.947] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personal", cAlternateFileName="")) returned 1 [0178.948] GetProcessHeap () returned 0xfd0000 [0178.948] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb265ad7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xb265ad7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fa7527, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2814e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-26.1459.6740.1.aodl", cAlternateFileName="SYNCEN~1.AOD")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xe7108ba8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe7108ba8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x55097bbd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0xd19e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-6.1925.840.1.odl", cAlternateFileName="SYNCEN~1.ODL")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4516422, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x4516422, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x95a923b0, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x19dc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine-2017-9-7.840.3616.1.odl", cAlternateFileName="SYNCEN~2.ODL")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4516422, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x4516422, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xbd1f712, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetryCache.otc.session", cAlternateFileName="TELEME~1.SES")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x438e2ed3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x439090e4, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.5892.0626-1.etl", cAlternateFileName="TRACEA~2.ETL")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xe7e981ee, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe7e981ee, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x551a2c7c, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.6816.0313-2.etl", cAlternateFileName="TRACEA~3.ETL")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0x5a3f29b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x5a3f29b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x95a923b0, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceArchive.6943.0625-3.etl", cAlternateFileName="TRACEA~4.ETL")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc27c59d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fcd764, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceCurrent.6998.0830.etl", cAlternateFileName="TRACEC~1.ETL")) returned 1 [0178.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc27c59d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x18fcd764, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TraceCurrent.6998.0830.etl", cAlternateFileName="TRACEC~1.ETL")) returned 0 [0178.952] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0178.953] GetProcessHeap () returned 0xfd0000 [0178.953] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.953] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc27c59d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc27c59d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personal", cAlternateFileName="")) returned 0 [0178.953] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0178.953] GetProcessHeap () returned 0xfd0000 [0178.953] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0178.953] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ef4d171, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c25c5c7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x17b6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1 [0178.953] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d07569, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe3d07569, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xb1234fa3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrivePersonal.cmd", cAlternateFileName="ONEDRI~1.CMD")) returned 1 [0178.954] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d07569, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c6d4c59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x22f6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveStandaloneUpdater.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0178.954] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x7a48c8b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x7a48c8b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="")) returned 1 [0178.954] GetProcessHeap () returned 0xfd0000 [0178.954] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0178.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x7a48c8b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x7a48c8b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0178.954] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x7a48c8b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x7a48c8b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.954] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personal", cAlternateFileName="")) returned 1 [0178.955] GetProcessHeap () returned 0xfd0000 [0178.955] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\settings\\Personal\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0178.957] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b68cdf, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x18ec2a2b, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18ec2a2b, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.957] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b705ce, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x5b705ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x1d7a9502, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1098, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationSettings.xml", cAlternateFileName="APPLIC~1.XML")) returned 1 [0178.957] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c457c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x18dddb2e, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18e2a037, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xabc, dwReserved0=0x0, dwReserved1=0x0, cFileName="global.ini", cAlternateFileName="")) returned 1 [0178.958] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c457c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x18dddb2e, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x18e2a037, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xabc, dwReserved0=0x0, dwReserved1=0x0, cFileName="global.ini", cAlternateFileName="")) returned 0 [0178.958] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0178.958] GetProcessHeap () returned 0xfd0000 [0178.958] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0178.958] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a48c8b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7a48c8b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x159a2a89, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreSignInSettingsConfig.json", cAlternateFileName="PRESIG~1.JSO")) returned 1 [0178.959] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a48c8b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7a48c8b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x159a2a89, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreSignInSettingsConfig.json", cAlternateFileName="PRESIG~1.JSO")) returned 0 [0178.959] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0178.959] GetProcessHeap () returned 0xfd0000 [0178.959] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0178.959] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd358a482, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd358a482, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0178.959] GetProcessHeap () returned 0xfd0000 [0178.959] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0178.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd358a482, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd358a482, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0178.959] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd358a482, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd358a482, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.959] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0178.960] GetProcessHeap () returned 0xfd0000 [0178.960] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0178.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0178.963] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442db8d6, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x442db8d6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x45234c56, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_170112_f7c-948.log", cAlternateFileName="2018-1~1.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447c66f9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x447c66f9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x44ea11e3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2134, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_170113_f4c-be0.log", cAlternateFileName="2018-1~2.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x878bfcc2, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x878bfcc2, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x887f2f47, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_171724_d80-678.log", cAlternateFileName="2018-1~3.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87cc5d55, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x883ece3d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1ea4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2018-11-14_171725_f28-d4c.log", cAlternateFileName="2018-1~4.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cbb1b0, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x40cbb1b0, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x4e3c1809, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x5c0f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2017-11-15_121658_11bc-11c0.log", cAlternateFileName="INSTAL~4.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea96ea5b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xea96ea5b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x218241ad, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x888e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2018-01-13_085545_f54-e1c.log", cAlternateFileName="IN2D73~1.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ff509c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x56ff509c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x97259f33, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9a502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install-PerUser_2018-02-06_161536_320-1b4.log", cAlternateFileName="IN1304~1.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90785512, ftCreationTime.dwHighDateTime=0x1d336d7, ftLastAccessTime.dwLowDateTime=0x90785512, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x13d8f038, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1d3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2017-09-26_165559_91c-123c.log", cAlternateFileName="INSTAL~1.LOG")) returned 1 [0178.964] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d3f61, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x3d0d3f61, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x46e2f5ec, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1d1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2017-11-15_121652_111c-1114.log", cAlternateFileName="INSTAL~3.LOG")) returned 1 [0178.965] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8758a32, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe8758a32, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef703bf8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1e0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2018-01-13_085541_f60-f7c.log", cAlternateFileName="IN0470~1.LOG")) returned 1 [0178.965] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53290922, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x53290922, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x97364e22, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install_2018-02-06_161529_da8-b1c.log", cAlternateFileName="INA0B8~1.LOG")) returned 1 [0179.003] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5383f076, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x55ded6e0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="parentTelemetryCache.otc.session", cAlternateFileName="PARENT~1.SES")) returned 1 [0179.011] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3514559e, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x3514559e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x430a4940, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2017-11-15_121639_4c0-7b4.log", cAlternateFileName="STANDA~3.LOG")) returned 1 [0179.011] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd88e0aa, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xdd88e0aa, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xed3e786a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2018-01-13_085523_840-928.log", cAlternateFileName="STANDA~4.LOG")) returned 1 [0179.016] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b328bd6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x4b328bd6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5870dfe3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdate_2018-02-06_161516_f90-3a4.log", cAlternateFileName="STFD35~1.LOG")) returned 1 [0179.016] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a9a8f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xe2a9a8f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x15c2addb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x3fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update_2017-09-26_165930_1a54-1854.log", cAlternateFileName="UPDATE~3.LOG")) returned 1 [0179.016] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7913822, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5733c46c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58e350ca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="userTelemetryCache.otc.session", cAlternateFileName="USERTE~1.SES")) returned 1 [0179.017] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7913822, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5733c46c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58e350ca, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="userTelemetryCache.otc.session", cAlternateFileName="USERTE~1.SES")) returned 0 [0179.017] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.018] GetProcessHeap () returned 0xfd0000 [0179.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.018] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x87cc5d55, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x87cc5d55, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0179.018] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.018] GetProcessHeap () returned 0xfd0000 [0179.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.018] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd955c7b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd4289a6f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd4289a6f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater", cAlternateFileName="STANDA~1")) returned 1 [0179.019] GetProcessHeap () returned 0xfd0000 [0179.019] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd955c7b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd4289a6f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd4289a6f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.019] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd955c7b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd4289a6f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd4289a6f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.019] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ccf660, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xd4289a6f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x51c3686e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x17ec0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0179.019] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf49ad00, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcf49ad00, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x4bbf3629, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update.xml", cAlternateFileName="")) returned 1 [0179.019] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf49ad00, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcf49ad00, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x4bbf3629, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update.xml", cAlternateFileName="")) returned 0 [0179.020] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.020] GetProcessHeap () returned 0xfd0000 [0179.020] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.020] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x77018ce, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update", cAlternateFileName="")) returned 1 [0179.020] GetProcessHeap () returned 0xfd0000 [0179.020] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\OneDrive\\Update\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x77018ce, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.020] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x77018ce, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.020] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77018ce, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x14b558f9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.xml", cAlternateFileName="")) returned 1 [0179.020] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77018ce, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x14b558f9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.xml", cAlternateFileName="")) returned 0 [0179.020] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.020] GetProcessHeap () returned 0xfd0000 [0179.020] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.020] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x77018ce, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update", cAlternateFileName="")) returned 0 [0179.020] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0179.021] GetProcessHeap () returned 0xfd0000 [0179.021] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.022] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6aa62a, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0179.022] GetProcessHeap () returned 0xfd0000 [0179.022] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6aa62a, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0179.023] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6aa62a, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.023] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x827c2c6b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x827c2c6b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gliding", cAlternateFileName="")) returned 1 [0179.023] GetProcessHeap () returned 0xfd0000 [0179.023] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Outlook\\gliding\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x827c2c6b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x827c2c6b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.023] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x827c2c6b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x827c2c6b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.024] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x827c2c6b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x827c2c6b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.024] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.024] GetProcessHeap () returned 0xfd0000 [0179.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.024] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc6aa62a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6f6b41, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0179.024] GetProcessHeap () returned 0xfd0000 [0179.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc6aa62a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xb129cfc0, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc6aa62a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xb129cfc0, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1250b07, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0xb1250b07, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb1250b07, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_AvailabilityOptions_2_552986138D849B4EAB2449C96BE58DE9.dat", cAlternateFileName="STREAM~4.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1250b07, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0xb1250b07, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb1250b07, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_Calendar_2_5A35E38A428E384AAA89F0FABC43BC63.dat", cAlternateFileName="STREAM~3.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1276c93, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0xb1276c93, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb1276c93, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_5FEACDDF00CBC74AAD4AAFFF6B598F75.dat", cAlternateFileName="ST233C~1.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1276c93, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0xb1276c93, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb1276c93, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ConversationPrefs_2_A2BF86C562EDA944ABA29857A9A5D252.dat", cAlternateFileName="STBF29~1.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1250b07, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0xb1250b07, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb1250b07, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_RssRule_2_7F9FABB0413E7F41B3D94FE78B1EDDD2.dat", cAlternateFileName="STD26D~1.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb129cfc0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0xb129cfc0, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb129cfc0, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_TableViewPreviewPrefs_2_EFE05DD2231B2843B5B39482C9157B21.dat", cAlternateFileName="STE86A~1.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc6d089a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6d089a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xb08fdd90, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_TCPrefs_2_367203432B40E2489F9FA2AEB4149DD7.dat", cAlternateFileName="STREAM~2.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc6aa62a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xb1250b07, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_WorkHours_1_20219F6A28C4FF4CAE937B6DEA4780FF.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc6aa62a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xb1250b07, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_WorkHours_1_20219F6A28C4FF4CAE937B6DEA4780FF.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0179.027] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.029] GetProcessHeap () returned 0xfd0000 [0179.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.029] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc6aa62a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6f6b41, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0179.029] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0179.029] GetProcessHeap () returned 0xfd0000 [0179.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.029] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xdd63cb27, ftLastWriteTime.dwHighDateTime=0x1d327b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PenWorkspace", cAlternateFileName="PENWOR~1")) returned 1 [0179.029] GetProcessHeap () returned 0xfd0000 [0179.029] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PenWorkspace\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xdd63cb27, ftLastWriteTime.dwHighDateTime=0x1d327b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.029] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xdd63cb27, ftLastWriteTime.dwHighDateTime=0x1d327b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.029] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xcde6d2c0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscoverCacheData.dat", cAlternateFileName="DISCOV~1.DAT")) returned 1 [0179.029] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xcde6d2c0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscoverCacheData.dat", cAlternateFileName="DISCOV~1.DAT")) returned 0 [0179.029] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.029] GetProcessHeap () returned 0xfd0000 [0179.029] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.030] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc7d69cc9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0179.030] GetProcessHeap () returned 0xfd0000 [0179.030] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc7d69cc9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0179.030] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc7d69cc9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.030] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0179.031] GetProcessHeap () returned 0xfd0000 [0179.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.031] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.031] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0179.031] GetProcessHeap () returned 0xfd0000 [0179.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.031] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.031] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.031] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0179.031] GetProcessHeap () returned 0xfd0000 [0179.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.032] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InPrivate", cAlternateFileName="INPRIV~1")) returned 1 [0179.032] GetProcessHeap () returned 0xfd0000 [0179.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.032] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.032] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0179.032] GetProcessHeap () returned 0xfd0000 [0179.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0179.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\InPrivate\\Desktop\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.034] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.034] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.034] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.034] GetProcessHeap () returned 0xfd0000 [0179.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0179.034] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0 [0179.034] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.034] GetProcessHeap () returned 0xfd0000 [0179.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.034] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InPrivate", cAlternateFileName="INPRIV~1")) returned 0 [0179.034] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.034] GetProcessHeap () returned 0xfd0000 [0179.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.036] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcd561ed0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcd561ed0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0179.036] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0179.036] GetProcessHeap () returned 0xfd0000 [0179.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.037] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0179.037] GetProcessHeap () returned 0xfd0000 [0179.037] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.042] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.042] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.042] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.042] GetProcessHeap () returned 0xfd0000 [0179.042] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.042] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0179.042] GetProcessHeap () returned 0xfd0000 [0179.042] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0179.042] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.042] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.042] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0179.042] GetProcessHeap () returned 0xfd0000 [0179.043] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.043] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc7e3414f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0179.043] GetProcessHeap () returned 0xfd0000 [0179.043] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Vault\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc7e3414f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.043] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc7e3414f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.043] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb71e21, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfb71e21, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfb71e21, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BF4C442-9B8A-41A0-B380-DD4A704DDB28", cAlternateFileName="4BF4C4~1")) returned 1 [0179.043] GetProcessHeap () returned 0xfd0000 [0179.043] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Vault\\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb71e21, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfb71e21, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfb71e21, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb71e21, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfb71e21, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfb71e21, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfb71e21, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfb71e21, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfb71e21, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1 [0179.044] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfb71e21, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfb71e21, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfb71e21, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 0 [0179.044] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.044] GetProcessHeap () returned 0xfd0000 [0179.044] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.044] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfcc934a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfcc934a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserProfileRoaming", cAlternateFileName="USERPR~1")) returned 1 [0179.044] GetProcessHeap () returned 0xfd0000 [0179.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfcc934a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfcc934a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.045] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfcc934a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfcc934a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.045] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfcc934a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfcc934a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x4fbe2de3, ftLastWriteTime.dwHighDateTime=0x1d5e7c1, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Latest.dat", cAlternateFileName="")) returned 1 [0179.045] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfcc934a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfcc934a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x4fbe2de3, ftLastWriteTime.dwHighDateTime=0x1d5e7c1, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Latest.dat", cAlternateFileName="")) returned 0 [0179.045] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.045] GetProcessHeap () returned 0xfd0000 [0179.045] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.045] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfcc934a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfcc934a, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserProfileRoaming", cAlternateFileName="USERPR~1")) returned 0 [0179.045] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.045] GetProcessHeap () returned 0xfd0000 [0179.045] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.045] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee6232d, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xbee6232d, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xbee6232d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1 [0179.045] GetProcessHeap () returned 0xfd0000 [0179.046] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee6232d, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xbee6232d, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc5d6153f, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.046] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee6232d, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xbee6232d, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc5d6153f, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.046] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5d6153f, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xc5d6153f, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xc5dd3c08, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x4fee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content16.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0179.046] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5d6153f, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xc5d6153f, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xc5dd3c08, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x4fee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content16.dat", cAlternateFileName="CONTEN~1.DAT")) returned 0 [0179.046] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.046] GetProcessHeap () returned 0xfd0000 [0179.047] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.047] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0179.047] GetProcessHeap () returned 0xfd0000 [0179.047] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0179.047] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.047] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40b3d3c8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x40b3d3c8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x40b3d3c8, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0179.047] GetProcessHeap () returned 0xfd0000 [0179.047] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\0\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40b3d3c8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x40b3d3c8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x40b3d3c8, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.048] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40b3d3c8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x40b3d3c8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x40b3d3c8, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.048] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40b3d3c8, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x40b3d3c8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x40b3d3c8, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.048] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.049] GetProcessHeap () returned 0xfd0000 [0179.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.049] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8439ba67, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8439ba67, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8439ba67, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0179.050] GetProcessHeap () returned 0xfd0000 [0179.050] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8439ba67, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8439ba67, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x84755547, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.070] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8439ba67, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8439ba67, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x84755547, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.070] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84755547, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x84755547, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x99f9b904, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x64ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0179.070] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84755547, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x84755547, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x99f9b904, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x64ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0179.070] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.070] GetProcessHeap () returned 0xfd0000 [0179.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.070] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa820489, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8dc9f1ef, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8dc9f1ef, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionCenterCache", cAlternateFileName="ACTION~1")) returned 1 [0179.070] GetProcessHeap () returned 0xfd0000 [0179.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa820489, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8dc9f1ef, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8dc9f1ef, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0179.070] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa820489, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8dc9f1ef, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8dc9f1ef, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.070] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa820489, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8dc9f1ef, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8dc9f1ef, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.070] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0179.071] GetProcessHeap () returned 0xfd0000 [0179.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.071] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xc811399a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCache", cAlternateFileName="")) returned 1 [0179.071] GetProcessHeap () returned 0xfd0000 [0179.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\AppCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xc811399a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.085] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xc811399a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.085] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.085] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YNQDHYC9", cAlternateFileName="")) returned 1 [0179.085] GetProcessHeap () returned 0xfd0000 [0179.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YNQDHYC9\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.086] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.086] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.086] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0179.086] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.086] GetProcessHeap () returned 0xfd0000 [0179.086] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.086] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf780a992, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf780a992, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf780a992, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YNQDHYC9", cAlternateFileName="")) returned 0 [0179.086] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.086] GetProcessHeap () returned 0xfd0000 [0179.086] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.086] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3be0e799, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc816182b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application Shortcuts", cAlternateFileName="APPLIC~1")) returned 1 [0179.086] GetProcessHeap () returned 0xfd0000 [0179.086] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3be0e799, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc816182b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.087] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3be0e799, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc816182b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.087] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3be34a00, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3be34a00, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0179.087] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3be34a00, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3be34a00, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0179.087] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.087] GetProcessHeap () returned 0xfd0000 [0179.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.087] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377ff6d0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x388d6143, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x388d6143, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0179.087] GetProcessHeap () returned 0xfd0000 [0179.087] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377ff6d0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x388d6143, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x388d6143, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.088] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377ff6d0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x388d6143, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x388d6143, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.088] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3784bb98, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc816376e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3784bb98, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0179.088] GetProcessHeap () returned 0xfd0000 [0179.088] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3784bb98, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc816376e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3784bb98, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0179.089] GetProcessHeap () returned 0xfd0000 [0179.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.089] GetProcessHeap () returned 0xfd0000 [0179.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x388d6143, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x388d6143, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x388d6143, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.089] GetProcessHeap () returned 0xfd0000 [0179.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.090] GetProcessHeap () returned 0xfd0000 [0179.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.090] GetProcessHeap () returned 0xfd0000 [0179.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7dae3d3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x5293f295, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5293f295, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.092] GetProcessHeap () returned 0xfd0000 [0179.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.092] GetProcessHeap () returned 0xfd0000 [0179.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\CloudStore\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc81b667a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.092] GetProcessHeap () returned 0xfd0000 [0179.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.093] GetProcessHeap () returned 0xfd0000 [0179.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a66ff7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x5480f5c6, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5480f5c6, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.093] GetProcessHeap () returned 0xfd0000 [0179.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\NotifyIcon\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bf5aea4, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8894a33c, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x9ade3514, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.094] GetProcessHeap () returned 0xfd0000 [0179.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.094] GetProcessHeap () returned 0xfd0000 [0179.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ThumbCacheToDelete\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53124ecc, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x5480f5c6, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5480f5c6, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.095] GetProcessHeap () returned 0xfd0000 [0179.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.095] GetProcessHeap () returned 0xfd0000 [0179.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.095] GetProcessHeap () returned 0xfd0000 [0179.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc826d70d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0179.095] GetProcessHeap () returned 0xfd0000 [0179.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.095] GetProcessHeap () returned 0xfd0000 [0179.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc826dcac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1b7a6e36, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.096] GetProcessHeap () returned 0xfd0000 [0179.096] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x436a3c8c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe98c8c83, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe98c8c83, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.100] GetProcessHeap () returned 0xfd0000 [0179.100] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0179.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020071120200712\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb36dae9d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xb36dae9d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb3701183, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.103] GetProcessHeap () returned 0xfd0000 [0179.103] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0179.111] GetProcessHeap () returned 0xfd0000 [0179.111] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.111] GetProcessHeap () returned 0xfd0000 [0179.111] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8d46a6f7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d46a6f7, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.112] GetProcessHeap () returned 0xfd0000 [0179.112] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0179.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8d46a6f7, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d46a6f7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d46a6f7, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.116] GetProcessHeap () returned 0xfd0000 [0179.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0179.116] GetProcessHeap () returned 0xfd0000 [0179.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.116] GetProcessHeap () returned 0xfd0000 [0179.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.118] GetProcessHeap () returned 0xfd0000 [0179.118] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x433480d0, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x433480d0, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.120] GetProcessHeap () returned 0xfd0000 [0179.120] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd588122, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc83128c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8d46a6f7, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0179.124] GetProcessHeap () returned 0xfd0000 [0179.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.124] GetProcessHeap () returned 0xfd0000 [0179.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.124] GetProcessHeap () returned 0xfd0000 [0179.124] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd588122, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x433480d0, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x433480d0, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0179.124] GetProcessHeap () returned 0xfd0000 [0179.124] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd588122, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc8313749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8d490944, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0179.124] GetProcessHeap () returned 0xfd0000 [0179.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.195] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd588122, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc8313749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8d490944, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0179.195] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0179.195] GetProcessHeap () returned 0xfd0000 [0179.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.195] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43858f98, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5c50689e, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5c50689e, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEDownloadHistory", cAlternateFileName="IEDOWN~1")) returned 1 [0179.196] GetProcessHeap () returned 0xfd0000 [0179.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43858f98, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5c50689e, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5c50689e, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.196] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43858f98, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5c50689e, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5c50689e, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.196] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5c50689e, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5c50689e, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5c50689e, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.196] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5c50689e, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5c50689e, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5c50689e, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0179.196] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.196] GetProcessHeap () returned 0xfd0000 [0179.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.196] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xe3955f00, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0179.196] GetProcessHeap () returned 0xfd0000 [0179.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xe3955f00, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0179.196] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xe3955f00, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.196] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xcdae55d7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcdae55d7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcdae55d7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0179.197] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f2d181, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0179.197] GetProcessHeap () returned 0xfd0000 [0179.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f2d181, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.197] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f2d181, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.197] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb213bb5b, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLogFiles", cAlternateFileName="VISIOL~1")) returned 1 [0179.197] GetProcessHeap () returned 0xfd0000 [0179.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0179.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO\\VisioLogFiles\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb213bb5b, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.199] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb213bb5b, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.199] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb213bb5b, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.199] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.199] GetProcessHeap () returned 0xfd0000 [0179.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0179.199] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb213bb5b, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xb213bb5b, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xb213bb5b, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLogFiles", cAlternateFileName="VISIOL~1")) returned 0 [0179.199] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.199] GetProcessHeap () returned 0xfd0000 [0179.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.199] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe3955f00, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xe3955f00, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0179.199] GetProcessHeap () returned 0xfd0000 [0179.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe3955f00, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.200] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe3955f00, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.200] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe3955f00, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0xe3955f00, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.200] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.200] GetProcessHeap () returned 0xfd0000 [0179.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdae55d7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcdae55d7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcdae55d7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="counters2.dat", cAlternateFileName="COUNTE~1.DAT")) returned 1 [0179.200] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcdae55d7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc52ab59a, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc52ab59a, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE", cAlternateFileName="")) returned 1 [0179.200] GetProcessHeap () returned 0xfd0000 [0179.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcdae55d7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc52ab59a, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc52ab59a, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.201] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcdae55d7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc52ab59a, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc52ab59a, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.201] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xce9337cd, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce9337cd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce9337cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.201] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xce9337cd, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce9337cd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce9337cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0179.202] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.202] GetProcessHeap () returned 0xfd0000 [0179.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.202] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd515a18, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0179.202] GetProcessHeap () returned 0xfd0000 [0179.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd515a18, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.202] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd515a18, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.202] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x8d444485, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0179.202] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8d444485, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE", cAlternateFileName="")) returned 1 [0179.202] GetProcessHeap () returned 0xfd0000 [0179.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0179.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8d444485, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.202] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8d444485, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.203] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8d444485, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.203] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0179.203] GetProcessHeap () returned 0xfd0000 [0179.203] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0179.203] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8d444485, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8d444485, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8d444485, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE", cAlternateFileName="")) returned 0 [0179.203] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.203] GetProcessHeap () returned 0xfd0000 [0179.203] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.203] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ccdf089, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0179.203] GetProcessHeap () returned 0xfd0000 [0179.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ccdf089, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.203] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ccdf089, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.203] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccdf089, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ccdf089, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0179.203] GetProcessHeap () returned 0xfd0000 [0179.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0179.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccdf089, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.205] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccdf089, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.205] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0179.205] GetProcessHeap () returned 0xfd0000 [0179.205] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0179.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.206] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.206] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0179.206] GetProcessHeap () returned 0xfd0000 [0179.206] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0179.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.207] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.207] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0179.207] GetProcessHeap () returned 0xfd0000 [0179.207] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0179.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.208] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.208] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0179.208] GetProcessHeap () returned 0xfd0000 [0179.208] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0179.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0179.208] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.208] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0179.208] GetProcessHeap () returned 0xfd0000 [0179.208] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0179.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0179.208] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.208] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0179.209] GetProcessHeap () returned 0xfd0000 [0179.209] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0179.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.209] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.209] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0179.209] GetProcessHeap () returned 0xfd0000 [0179.209] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0179.210] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.210] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.210] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0179.210] GetProcessHeap () returned 0xfd0000 [0179.210] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.210] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ce0dc68, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ce0dc68, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0179.210] GetProcessHeap () returned 0xfd0000 [0179.210] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ce0dc68, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ce0dc68, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0179.211] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ce0dc68, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ce0dc68, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.211] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ce0dc68, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ce0dc68, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.211] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0179.212] GetProcessHeap () returned 0xfd0000 [0179.212] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.212] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ce0dc68, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ce0dc68, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce0dc68, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 0 [0179.212] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.212] GetProcessHeap () returned 0xfd0000 [0179.212] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0179.212] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0179.212] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0179.212] GetProcessHeap () returned 0xfd0000 [0179.212] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0179.213] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0179.213] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0179.213] GetProcessHeap () returned 0xfd0000 [0179.213] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0179.214] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0179.214] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.214] GetProcessHeap () returned 0xfd0000 [0179.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0179.214] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0179.214] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0179.214] GetProcessHeap () returned 0xfd0000 [0179.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0179.215] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0 [0179.215] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.215] GetProcessHeap () returned 0xfd0000 [0179.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0179.216] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd19a0a, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8cd19a0a, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8cd19a0a, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0179.216] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.216] GetProcessHeap () returned 0xfd0000 [0179.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0179.216] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccdf089, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ccdf089, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0 [0179.216] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.216] GetProcessHeap () returned 0xfd0000 [0179.217] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.218] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xcd561ed0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccdf089, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ccdf089, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0179.218] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0179.218] GetProcessHeap () returned 0xfd0000 [0179.218] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.219] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xace8aa06, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xace8aa06, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0179.219] GetProcessHeap () returned 0xfd0000 [0179.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xace8aa06, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xace8aa06, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.222] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xace8aa06, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xace8aa06, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.222] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf08b1bb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xf08b1bb5, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xf08b1bb5, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2TW2FB0X.cookie", cAlternateFileName="2TW2FB~1.COO")) returned 1 [0179.240] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97c1763d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x97c1763d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x97c1763d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x11b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="374U3A1K.cookie", cAlternateFileName="374U3A~1.COO")) returned 1 [0179.240] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97b58c47, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x97b58c47, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x97b58c47, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BI3PPODN.cookie", cAlternateFileName="BI3PPO~1.COO")) returned 1 [0179.240] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdf9f05df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdf9f05df, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdf9f05df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.240] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x433e08f7, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x433e08f7, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DNTException", cAlternateFileName="DNTEXC~1")) returned 1 [0179.240] GetProcessHeap () returned 0xfd0000 [0179.240] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x433e08f7, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x433e08f7, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.248] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x433e08f7, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x433e08f7, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.248] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x433e08f7, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x433e08f7, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x433e08f7, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.249] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0179.249] GetProcessHeap () returned 0xfd0000 [0179.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.250] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.250] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.250] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.250] GetProcessHeap () returned 0xfd0000 [0179.250] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.250] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0179.250] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.250] GetProcessHeap () returned 0xfd0000 [0179.250] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.250] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ce722ba, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8ce722ba, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8ce722ba, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GWJUGATK.cookie", cAlternateFileName="GWJUGA~1.COO")) returned 1 [0179.251] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xacddadd7, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xacddadd7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xacddadd7, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JESBACFH.cookie", cAlternateFileName="JESBAC~1.COO")) returned 1 [0179.251] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a303509, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x5a303509, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x5a303509, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L2Q60DYF.cookie", cAlternateFileName="L2Q60D~1.COO")) returned 1 [0179.251] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc83b6f59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0179.251] GetProcessHeap () returned 0xfd0000 [0179.251] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc83b6f59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.253] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc83b6f59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.253] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc83b6f59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.253] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.253] GetProcessHeap () returned 0xfd0000 [0179.254] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.254] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x904e9952, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x904e9952, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x904e9952, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P9JHL0AF.cookie", cAlternateFileName="P9JHL0~1.COO")) returned 1 [0179.254] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0179.254] GetProcessHeap () returned 0xfd0000 [0179.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.254] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.254] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0179.254] GetProcessHeap () returned 0xfd0000 [0179.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0179.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.254] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.254] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.254] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.255] GetProcessHeap () returned 0xfd0000 [0179.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0179.255] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x430ae156, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x430ae156, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x430ae156, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0179.255] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.255] GetProcessHeap () returned 0xfd0000 [0179.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.255] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x651fe40, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x651fe40, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x651fe40, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T0ICIWVP.cookie", cAlternateFileName="T0ICIW~1.COO")) returned 1 [0179.255] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8faedb8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x8faedb8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x8faedb8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TDJT1R5W.cookie", cAlternateFileName="TDJT1R~1.COO")) returned 1 [0179.255] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x651fe40, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x651fe40, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x651fe40, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UBHR6PKO.cookie", cAlternateFileName="UBHR6P~1.COO")) returned 1 [0179.255] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90109c21, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x90109c21, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x90109c21, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZXBG6NYW.cookie", cAlternateFileName="ZXBG6N~1.COO")) returned 1 [0179.255] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90109c21, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x90109c21, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x90109c21, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZXBG6NYW.cookie", cAlternateFileName="ZXBG6N~1.COO")) returned 0 [0179.255] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.255] GetProcessHeap () returned 0xfd0000 [0179.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.257] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae251d1a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x55bff026, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55bff026, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notifications", cAlternateFileName="NOTIFI~1")) returned 1 [0179.257] GetProcessHeap () returned 0xfd0000 [0179.257] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae251d1a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x55bff026, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55bff026, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.257] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae251d1a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x55bff026, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55bff026, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.258] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5da496a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc5da496a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x6c29747c, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wpndatabase.db", cAlternateFileName="WPNDAT~1.DB")) returned 1 [0179.258] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55bff026, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x55bff026, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x490a2960, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wpndatabase.db-shm", cAlternateFileName="WPNDAT~2.DB-")) returned 1 [0179.258] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc64330fb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc64330fb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbd021adb, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0xc140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wpndatabase.db-wal", cAlternateFileName="WPNDAT~1.DB-")) returned 1 [0179.258] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc069f076, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc84021e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x740cf5bf, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wpnidm", cAlternateFileName="")) returned 1 [0179.258] GetProcessHeap () returned 0xfd0000 [0179.258] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc069f076, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc84021e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x740cf5bf, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.259] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc069f076, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc84021e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x740cf5bf, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.259] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x86a75080, ftCreationTime.dwHighDateTime=0x1d3272d, ftLastAccessTime.dwLowDateTime=0x86a75080, ftLastAccessTime.dwHighDateTime=0x1d3272d, ftLastWriteTime.dwLowDateTime=0x86a75080, ftLastWriteTime.dwHighDateTime=0x1d3272d, nFileSizeHigh=0x0, nFileSizeLow=0x20a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="353d8595.jpg", cAlternateFileName="")) returned 1 [0179.259] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x1d7663a2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1d7663a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1d7663a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a8c77985.jpg", cAlternateFileName="")) returned 1 [0179.259] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb30a9f00, ftCreationTime.dwHighDateTime=0x1d32724, ftLastAccessTime.dwLowDateTime=0xb30a9f00, ftLastAccessTime.dwHighDateTime=0x1d32724, ftLastWriteTime.dwLowDateTime=0xb30a9f00, ftLastWriteTime.dwHighDateTime=0x1d32724, nFileSizeHigh=0x0, nFileSizeLow=0x12d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca910921.jpg", cAlternateFileName="")) returned 1 [0179.259] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb30a9f00, ftCreationTime.dwHighDateTime=0x1d32724, ftLastAccessTime.dwLowDateTime=0xb30a9f00, ftLastAccessTime.dwHighDateTime=0x1d32724, ftLastWriteTime.dwLowDateTime=0xb30a9f00, ftLastWriteTime.dwHighDateTime=0x1d32724, nFileSizeHigh=0x0, nFileSizeLow=0x12d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca910921.jpg", cAlternateFileName="")) returned 0 [0179.259] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.259] GetProcessHeap () returned 0xfd0000 [0179.259] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.259] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc5bb4ac4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc5bb4ac4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4900e4c6, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPNPRMRY.tmp", cAlternateFileName="")) returned 1 [0179.259] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc5bb4ac4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc5bb4ac4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4900e4c6, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WPNPRMRY.tmp", cAlternateFileName="")) returned 0 [0179.278] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0179.278] GetProcessHeap () returned 0xfd0000 [0179.278] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.278] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0179.278] GetProcessHeap () returned 0xfd0000 [0179.278] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.278] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.278] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc924418, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xa6871230, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0xbdca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ModuleAnalysisCache", cAlternateFileName="MODULE~1")) returned 1 [0179.278] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc924418, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xa6871230, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0xbdca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ModuleAnalysisCache", cAlternateFileName="MODULE~1")) returned 0 [0179.279] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.279] GetProcessHeap () returned 0xfd0000 [0179.279] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.279] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca7566ed, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xca7566ed, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRICache", cAlternateFileName="")) returned 1 [0179.279] GetProcessHeap () returned 0xfd0000 [0179.279] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca7566ed, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xca7566ed, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.304] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca7566ed, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xca7566ed, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.379] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6b7131, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a6b7131, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a6b7131, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="1527C7~1.447")) returned 1 [0179.379] GetProcessHeap () returned 0xfd0000 [0179.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6b7131, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a6b7131, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a6b7131, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.396] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6b7131, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a6b7131, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a6b7131, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.396] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6b7131, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a6b7131, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a6b7131, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.396] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.396] GetProcessHeap () returned 0xfd0000 [0179.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.396] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d59771, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83d59771, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="C5E252~1.0_N")) returned 1 [0179.396] GetProcessHeap () returned 0xfd0000 [0179.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d59771, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83d59771, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.396] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d59771, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83d59771, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.396] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d59771, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83d59771, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83d59771, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.396] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.396] GetProcessHeap () returned 0xfd0000 [0179.396] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.397] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83020fb6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83020fb6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83020fb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="CORTAN~1.0_N")) returned 1 [0179.397] GetProcessHeap () returned 0xfd0000 [0179.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83020fb6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83020fb6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83020fb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.413] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83020fb6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83020fb6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83020fb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.413] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83020fb6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83020fb6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83020fb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.413] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.413] GetProcessHeap () returned 0xfd0000 [0179.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.413] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81af8126, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81af8126, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81af8126, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy", cAlternateFileName="DESKTO~2.0_N")) returned 1 [0179.413] GetProcessHeap () returned 0xfd0000 [0179.413] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81af8126, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81af8126, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81af8126, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.421] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81af8126, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81af8126, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81af8126, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.421] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81af8126, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81af8126, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81af8126, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.421] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.421] GetProcessHeap () returned 0xfd0000 [0179.421] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.421] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80ca9f1d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80ca9f1d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80ca9f1d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="DESKTO~1.0_N")) returned 1 [0179.421] GetProcessHeap () returned 0xfd0000 [0179.421] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80ca9f1d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80ca9f1d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80ca9f1d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.421] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80ca9f1d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80ca9f1d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80ca9f1d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.421] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80ca9f1d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80ca9f1d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80ca9f1d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.421] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.421] GetProcessHeap () returned 0xfd0000 [0179.421] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.422] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e84fa9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79e84fa9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79e84fa9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="E2A4F9~1.332")) returned 1 [0179.422] GetProcessHeap () returned 0xfd0000 [0179.422] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e84fa9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79e84fa9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79e84fa9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.422] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e84fa9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79e84fa9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79e84fa9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.422] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79e84fa9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79e84fa9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79e84fa9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.422] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.423] GetProcessHeap () returned 0xfd0000 [0179.423] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.423] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c1636cc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c1636cc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c1636cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="ENVIRO~1.0_N")) returned 1 [0179.423] GetProcessHeap () returned 0xfd0000 [0179.423] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c1636cc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c1636cc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c1636cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.423] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c1636cc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c1636cc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c1636cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.423] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c1636cc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c1636cc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c1636cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.423] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.423] GetProcessHeap () returned 0xfd0000 [0179.423] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.423] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db04be3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db04be3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db04be3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy", cAlternateFileName="HOLOCA~1.5_N")) returned 1 [0179.423] GetProcessHeap () returned 0xfd0000 [0179.423] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db04be3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db04be3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db04be3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.423] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db04be3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db04be3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db04be3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.424] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db04be3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db04be3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db04be3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.424] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.424] GetProcessHeap () returned 0xfd0000 [0179.424] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.424] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3f592b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e3f592b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e3f592b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy", cAlternateFileName="HOLOIT~1.2_N")) returned 1 [0179.424] GetProcessHeap () returned 0xfd0000 [0179.424] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3f592b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e3f592b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e3f592b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.465] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3f592b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e3f592b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e3f592b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.465] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3f592b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e3f592b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e3f592b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.465] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.465] GetProcessHeap () returned 0xfd0000 [0179.465] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.465] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33b5198, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd33b5198, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd33b5198, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~2.0_N")) returned 1 [0179.466] GetProcessHeap () returned 0xfd0000 [0179.466] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33b5198, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd33b5198, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd33b5198, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.469] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33b5198, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd33b5198, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd33b5198, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.469] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33b5198, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd33b5198, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd33b5198, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.469] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.469] GetProcessHeap () returned 0xfd0000 [0179.469] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.469] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80235763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80235763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80235763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy", cAlternateFileName="MICROS~1.447")) returned 1 [0179.469] GetProcessHeap () returned 0xfd0000 [0179.469] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80235763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80235763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80235763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0179.470] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80235763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80235763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80235763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.470] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80235763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80235763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80235763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.470] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0179.470] GetProcessHeap () returned 0xfd0000 [0179.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.470] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb18f1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7cfb18f1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7cfb18f1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="MI2C32~1.0_N")) returned 1 [0179.470] GetProcessHeap () returned 0xfd0000 [0179.470] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb18f1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7cfb18f1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7cfb18f1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.471] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb18f1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7cfb18f1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7cfb18f1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.471] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb18f1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7cfb18f1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7cfb18f1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.471] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.472] GetProcessHeap () returned 0xfd0000 [0179.472] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.472] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7673c617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7673c617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7673c617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="MICEC2~1.0_N")) returned 1 [0179.472] GetProcessHeap () returned 0xfd0000 [0179.472] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7673c617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7673c617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7673c617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0179.472] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7673c617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7673c617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7673c617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.472] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7673c617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7673c617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7673c617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.472] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0179.472] GetProcessHeap () returned 0xfd0000 [0179.472] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.472] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1e4202, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b1e4202, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b1e4202, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="MIC1CC~1.0_N")) returned 1 [0179.472] GetProcessHeap () returned 0xfd0000 [0179.472] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1e4202, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b1e4202, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b1e4202, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.473] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1e4202, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b1e4202, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b1e4202, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.473] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1e4202, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b1e4202, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b1e4202, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.473] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0179.473] GetProcessHeap () returned 0xfd0000 [0179.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.473] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc0dcb3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdbc0dcb3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdbc0dcb3, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_N")) returned 1 [0179.473] GetProcessHeap () returned 0xfd0000 [0179.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc0dcb3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdbc0dcb3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdbc0dcb3, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0179.474] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc0dcb3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdbc0dcb3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdbc0dcb3, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.474] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc0dcb3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdbc0dcb3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdbc0dcb3, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.474] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0179.474] GetProcessHeap () returned 0xfd0000 [0179.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.474] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5fd63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f5fd63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f5fd63a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MI5A4E~1.0_N")) returned 1 [0179.474] GetProcessHeap () returned 0xfd0000 [0179.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5fd63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f5fd63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f5fd63a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.474] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5fd63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f5fd63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f5fd63a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.474] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5fd63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f5fd63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f5fd63a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.474] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.474] GetProcessHeap () returned 0xfd0000 [0179.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.474] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77138478, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77138478, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77138478, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MIFC10~1.0_N")) returned 1 [0179.475] GetProcessHeap () returned 0xfd0000 [0179.475] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77138478, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77138478, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77138478, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.476] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77138478, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77138478, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77138478, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.476] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77138478, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77138478, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77138478, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.476] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.476] GetProcessHeap () returned 0xfd0000 [0179.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.476] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79521b5c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79521b5c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79521b5c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MI189A~1.0_N")) returned 1 [0179.476] GetProcessHeap () returned 0xfd0000 [0179.476] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79521b5c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79521b5c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79521b5c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.477] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79521b5c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79521b5c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79521b5c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.477] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79521b5c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79521b5c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79521b5c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.477] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0179.477] GetProcessHeap () returned 0xfd0000 [0179.477] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.477] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc62ee79, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcc62ee79, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcc62ee79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.0_N")) returned 1 [0179.477] GetProcessHeap () returned 0xfd0000 [0179.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc62ee79, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcc62ee79, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcc62ee79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.477] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc62ee79, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcc62ee79, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcc62ee79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.477] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc62ee79, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcc62ee79, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcc62ee79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.477] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0179.477] GetProcessHeap () returned 0xfd0000 [0179.477] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.477] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd942a48, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdd942a48, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdd942a48, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~4.0_N")) returned 1 [0179.477] GetProcessHeap () returned 0xfd0000 [0179.477] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd942a48, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdd942a48, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdd942a48, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.478] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd942a48, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdd942a48, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdd942a48, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.478] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd942a48, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdd942a48, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdd942a48, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.478] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.478] GetProcessHeap () returned 0xfd0000 [0179.479] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.479] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eb2cb6, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd9eb2cb6, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd9eb2cb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.150")) returned 1 [0179.479] GetProcessHeap () returned 0xfd0000 [0179.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eb2cb6, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd9eb2cb6, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd9eb2cb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.479] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eb2cb6, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd9eb2cb6, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd9eb2cb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.479] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eb2cb6, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd9eb2cb6, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd9eb2cb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.479] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.479] GetProcessHeap () returned 0xfd0000 [0179.479] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.479] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75db2f08, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75db2f08, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75db2f08, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MI98FA~1.0_N")) returned 1 [0179.479] GetProcessHeap () returned 0xfd0000 [0179.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75db2f08, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75db2f08, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75db2f08, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.480] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75db2f08, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75db2f08, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75db2f08, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.480] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75db2f08, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75db2f08, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75db2f08, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.480] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.480] GetProcessHeap () returned 0xfd0000 [0179.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.480] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753b713c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x753b713c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x753b713c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MIC120~1.0_N")) returned 1 [0179.480] GetProcessHeap () returned 0xfd0000 [0179.480] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753b713c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x753b713c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x753b713c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.481] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753b713c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x753b713c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x753b713c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.481] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753b713c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x753b713c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x753b713c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.481] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.481] GetProcessHeap () returned 0xfd0000 [0179.481] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.481] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a7a048, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74a7a048, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74a7a048, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="MI7DAE~1.0_N")) returned 1 [0179.481] GetProcessHeap () returned 0xfd0000 [0179.481] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a7a048, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74a7a048, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74a7a048, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.482] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a7a048, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74a7a048, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74a7a048, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.482] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74a7a048, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74a7a048, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74a7a048, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.482] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0179.482] GetProcessHeap () returned 0xfd0000 [0179.482] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.482] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7407e16d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7407e16d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7407e16d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="MID492~1.0_N")) returned 1 [0179.482] GetProcessHeap () returned 0xfd0000 [0179.482] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7407e16d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7407e16d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7407e16d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.483] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7407e16d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7407e16d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7407e16d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.483] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7407e16d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7407e16d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7407e16d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.483] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.483] GetProcessHeap () returned 0xfd0000 [0179.483] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.483] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x733f9bba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x733f9bba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x733f9bba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MI6FCD~1.0_N")) returned 1 [0179.483] GetProcessHeap () returned 0xfd0000 [0179.483] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x733f9bba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x733f9bba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x733f9bba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.484] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x733f9bba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x733f9bba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x733f9bba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.484] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x733f9bba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x733f9bba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x733f9bba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.484] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.484] GetProcessHeap () returned 0xfd0000 [0179.484] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.484] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x725392b3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x725392b3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x725392b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy", cAlternateFileName="MI3009~1.0_N")) returned 1 [0179.484] GetProcessHeap () returned 0xfd0000 [0179.484] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x725392b3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x725392b3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x725392b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0179.485] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x725392b3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x725392b3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x725392b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.485] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x725392b3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x725392b3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x725392b3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.485] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0179.486] GetProcessHeap () returned 0xfd0000 [0179.486] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.486] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d619bd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70d619bd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70d619bd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy", cAlternateFileName="MI2456~1.0_N")) returned 1 [0179.486] GetProcessHeap () returned 0xfd0000 [0179.486] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d619bd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70d619bd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70d619bd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.487] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d619bd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70d619bd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70d619bd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.487] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d619bd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70d619bd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70d619bd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.487] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.487] GetProcessHeap () returned 0xfd0000 [0179.487] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.487] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x701e842d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x701e842d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x701e842d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MI829F~1.0_N")) returned 1 [0179.487] GetProcessHeap () returned 0xfd0000 [0179.487] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x701e842d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x701e842d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x701e842d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.487] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x701e842d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x701e842d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x701e842d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.488] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x701e842d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x701e842d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x701e842d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.488] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0179.488] GetProcessHeap () returned 0xfd0000 [0179.488] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.488] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd55d4d1e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd55d4d1e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd55d4d1e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.332")) returned 1 [0179.488] GetProcessHeap () returned 0xfd0000 [0179.488] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd55d4d1e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd55d4d1e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd55d4d1e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.488] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd55d4d1e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd55d4d1e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd55d4d1e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.488] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd55d4d1e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd55d4d1e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd55d4d1e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.488] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.488] GetProcessHeap () returned 0xfd0000 [0179.488] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.488] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c4851d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c4851d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c4851d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy", cAlternateFileName="MICROS~2.332")) returned 1 [0179.488] GetProcessHeap () returned 0xfd0000 [0179.488] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c4851d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c4851d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c4851d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.489] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c4851d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c4851d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c4851d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.489] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c4851d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c4851d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c4851d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.489] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.489] GetProcessHeap () returned 0xfd0000 [0179.489] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.489] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f34dd66, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f34dd66, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f34dd66, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MIB10B~1.0_N")) returned 1 [0179.489] GetProcessHeap () returned 0xfd0000 [0179.489] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f34dd66, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f34dd66, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f34dd66, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.490] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f34dd66, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f34dd66, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f34dd66, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.490] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f34dd66, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f34dd66, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f34dd66, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.490] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.490] GetProcessHeap () returned 0xfd0000 [0179.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.490] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7871fddf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7871fddf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7871fddf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="WINDOW~2.0_N")) returned 1 [0179.490] GetProcessHeap () returned 0xfd0000 [0179.490] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7871fddf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7871fddf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7871fddf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.491] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7871fddf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7871fddf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7871fddf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.491] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7871fddf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7871fddf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7871fddf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.491] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0179.491] GetProcessHeap () returned 0xfd0000 [0179.491] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.491] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd855dc57, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd855dc57, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd855dc57, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.0_N")) returned 1 [0179.491] GetProcessHeap () returned 0xfd0000 [0179.491] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PRICache\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd855dc57, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd855dc57, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd855dc57, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.492] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd855dc57, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd855dc57, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd855dc57, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.492] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd855dc57, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd855dc57, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd855dc57, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.492] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.492] GetProcessHeap () returned 0xfd0000 [0179.492] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.492] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd855dc57, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd855dc57, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd855dc57, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.0_N")) returned 0 [0179.492] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.492] GetProcessHeap () returned 0xfd0000 [0179.492] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.492] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce2cb2cd, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce2cb2cd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0179.493] GetProcessHeap () returned 0xfd0000 [0179.493] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce2cb2cd, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce2cb2cd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.493] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce2cb2cd, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce2cb2cd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.493] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce2cb2cd, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce2cb2cd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.493] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.493] GetProcessHeap () returned 0xfd0000 [0179.493] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.493] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc86f09cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x440792d0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingTiles", cAlternateFileName="ROAMIN~1")) returned 1 [0179.494] GetProcessHeap () returned 0xfd0000 [0179.494] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\RoamingTiles\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc86f09cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x440792d0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.494] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc86f09cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x440792d0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.494] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc86f09cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x440792d0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0179.494] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0179.495] GetProcessHeap () returned 0xfd0000 [0179.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.495] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xdbe2f3df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc86f1244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdbf3a457, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingSync", cAlternateFileName="SETTIN~1")) returned 1 [0179.495] GetProcessHeap () returned 0xfd0000 [0179.495] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xdbe2f3df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc86f1244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdbf3a457, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0179.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xdbe2f3df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc86f1244, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdbf3a457, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf3a457, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeee51a18, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeee51a18, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="metastore", cAlternateFileName="METAST~1")) returned 1 [0179.496] GetProcessHeap () returned 0xfd0000 [0179.496] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf3a457, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeee51a18, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeee51a18, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf3a457, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeee51a18, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeee51a18, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcedfba4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcedfba4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdd784592, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf606c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7daa5ce, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xaef28414, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf606c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdbf606c9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe7e42f17, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf606c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcbe4e66, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeeeea374, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00002.log", cAlternateFileName="")) returned 1 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcbe4e66, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcbe4e66, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdcbe4e66, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0179.498] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcbe4e66, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcbe4e66, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdce20ff6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0179.499] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbf606c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeee51a18, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xaef4e666, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0179.664] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb8a55c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddb8a55c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xaef28414, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x160000, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta.edb", cAlternateFileName="")) returned 1 [0179.664] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb8a55c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddb8a55c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xaef28414, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x160000, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta.edb", cAlternateFileName="")) returned 0 [0179.673] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0179.677] GetProcessHeap () returned 0xfd0000 [0179.677] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.677] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf3a457, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeee51a18, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeee51a18, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="metastore", cAlternateFileName="METAST~1")) returned 0 [0179.677] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0179.677] GetProcessHeap () returned 0xfd0000 [0179.677] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.677] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc877b8ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1 [0179.678] GetProcessHeap () returned 0xfd0000 [0179.678] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Shell\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc877b8ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.679] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc877b8ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9bc987, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21191ff2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21191ff2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21191ff2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21191ff2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1be33, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 0 [0179.679] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.679] GetProcessHeap () returned 0xfd0000 [0179.679] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6e2eece, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x4b1fd59d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x4b1fd59d, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UPPS", cAlternateFileName="")) returned 1 [0179.679] GetProcessHeap () returned 0xfd0000 [0179.679] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\UPPS\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6e2eece, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x4b1fd59d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x4b1fd59d, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.679] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6e2eece, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x4b1fd59d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x4b1fd59d, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1d7426, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x4b1d7426, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x4b1d7426, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UPPS.bin", cAlternateFileName="")) returned 1 [0179.679] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1d7426, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x4b1d7426, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x4b1d7426, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UPPS.bin", cAlternateFileName="")) returned 0 [0179.679] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0179.680] GetProcessHeap () returned 0xfd0000 [0179.680] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x21276e07, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6c4f9bc0, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6c4f9bc0, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21276e07, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21276e07, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21276e07, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21276e07, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21276e07, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21276e07, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21276e07, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21276e07, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2186cc90, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat{fae993f8-933c-11e7-a51d-e8daaaf0a0ed}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21276e07, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21276e07, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2186cc90, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat{fae993f8-933c-11e7-a51d-e8daaaf0a0ed}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21276e07, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21276e07, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2186cc90, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat{fae993f8-933c-11e7-a51d-e8daaaf0a0ed}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0179.680] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x39f10df7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6b89269d, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0x6b89269d, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WebCache", cAlternateFileName="")) returned 1 [0179.680] GetProcessHeap () returned 0xfd0000 [0179.680] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WebCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x39f10df7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x6b89269d, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0x6b89269d, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0179.681] GetProcessHeap () returned 0xfd0000 [0179.681] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.681] GetProcessHeap () returned 0xfd0000 [0179.681] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fa64c01, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.682] GetProcessHeap () returned 0xfd0000 [0179.682] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fa64c01, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa8ae29, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.683] GetProcessHeap () returned 0xfd0000 [0179.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.683] GetProcessHeap () returned 0xfd0000 [0179.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.683] GetProcessHeap () returned 0xfd0000 [0179.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc87ee20a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0179.683] GetProcessHeap () returned 0xfd0000 [0179.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2fcdc89b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2fcdc89b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.683] GetProcessHeap () returned 0xfd0000 [0179.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.683] GetProcessHeap () returned 0xfd0000 [0179.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2fdc1691, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2fdc1691, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.691] GetProcessHeap () returned 0xfd0000 [0179.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.691] GetProcessHeap () returned 0xfd0000 [0179.691] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0179.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x347b8201, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x71128d69, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71128d69, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0179.694] GetProcessHeap () returned 0xfd0000 [0179.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0179.694] GetProcessHeap () returned 0xfd0000 [0179.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.694] GetProcessHeap () returned 0xfd0000 [0179.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.696] GetProcessHeap () returned 0xfd0000 [0179.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows Live\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3e54fc1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc88b17c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3e54fc1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0179.697] GetProcessHeap () returned 0xfd0000 [0179.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3e54fc1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x887ccec4, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x887ccec4, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0179.702] GetProcessHeap () returned 0xfd0000 [0179.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.702] GetProcessHeap () returned 0xfd0000 [0179.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.702] GetProcessHeap () returned 0xfd0000 [0179.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x306b22ce, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x306b22ce, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0179.703] GetProcessHeap () returned 0xfd0000 [0179.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fa56c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.703] GetProcessHeap () returned 0xfd0000 [0179.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.703] GetProcessHeap () returned 0xfd0000 [0179.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.703] GetProcessHeap () returned 0xfd0000 [0179.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0179.703] GetProcessHeap () returned 0xfd0000 [0179.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0179.703] GetProcessHeap () returned 0xfd0000 [0179.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0179.705] GetProcessHeap () returned 0xfd0000 [0179.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0179.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0179.710] GetProcessHeap () returned 0xfd0000 [0179.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0179.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0179.713] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.713] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_bingpagedata", cAlternateFileName="MICROS~4")) returned 1 [0179.713] GetProcessHeap () returned 0xfd0000 [0179.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0179.714] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.714] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98c6f7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c6f7b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c6f7b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0179.714] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98c6f7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c6f7b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c6f7b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0179.714] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0179.715] GetProcessHeap () returned 0xfd0000 [0179.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0179.715] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_DNTException", cAlternateFileName="MI18F7~1")) returned 1 [0179.715] GetProcessHeap () returned 0xfd0000 [0179.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0179.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.381] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.381] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x909a2acc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.381] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x909a2acc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0180.381] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.381] GetProcessHeap () returned 0xfd0000 [0180.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.381] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_EmieSiteList", cAlternateFileName="MICFB7~1")) returned 1 [0180.381] GetProcessHeap () returned 0xfd0000 [0180.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.382] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.382] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.382] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0180.382] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.382] GetProcessHeap () returned 0xfd0000 [0180.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.382] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_EmieUserList", cAlternateFileName="MI15A7~1")) returned 1 [0180.382] GetProcessHeap () returned 0xfd0000 [0180.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0180.383] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92b04223, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92b04223, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0180.383] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0180.383] GetProcessHeap () returned 0xfd0000 [0180.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.383] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompat", cAlternateFileName="MICROS~1")) returned 1 [0180.383] GetProcessHeap () returned 0xfd0000 [0180.383] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.384] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0889c9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x31bb6535, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x132e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData.xml", cAlternateFileName="IECOMP~1.XML")) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0889c9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x31bb6535, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x132e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData.xml", cAlternateFileName="IECOMP~1.XML")) returned 0 [0180.384] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.384] GetProcessHeap () returned 0xfd0000 [0180.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.384] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompatua", cAlternateFileName="MICROS~2")) returned 1 [0180.384] GetProcessHeap () returned 0xfd0000 [0180.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.385] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0180.385] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.385] GetProcessHeap () returned 0xfd0000 [0180.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.385] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_ieflipahead", cAlternateFileName="MICROS~3")) returned 1 [0180.385] GetProcessHeap () returned 0xfd0000 [0180.385] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.386] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.386] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58ffddd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0180.386] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58ffddd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0180.386] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.386] GetProcessHeap () returned 0xfd0000 [0180.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.386] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_ieflipahead", cAlternateFileName="MICROS~3")) returned 0 [0180.386] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.387] GetProcessHeap () returned 0xfd0000 [0180.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.387] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0180.387] GetProcessHeap () returned 0xfd0000 [0180.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.387] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.387] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0180.387] GetProcessHeap () returned 0xfd0000 [0180.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\Default\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.388] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.388] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.388] GetProcessHeap () returned 0xfd0000 [0180.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 0 [0180.388] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.388] GetProcessHeap () returned 0xfd0000 [0180.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.388] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0180.388] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0180.388] GetProcessHeap () returned 0xfd0000 [0180.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0180.390] FindNextFileW (in: hFindFile=0x10b7c80, lpFindFileData=0x349edd0 | out: lpFindFileData=0x349edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0180.390] GetProcessHeap () returned 0xfd0000 [0180.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0180.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.392] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.392] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0180.392] GetProcessHeap () returned 0xfd0000 [0180.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0180.392] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.392] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa92ca6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa92ca6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdd9723cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="postSigningData", cAlternateFileName="POSTSI~1")) returned 1 [0180.392] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0180.392] GetProcessHeap () returned 0xfd0000 [0180.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0180.394] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.394] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322ee0f, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb322ee0f, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1 [0180.394] GetProcessHeap () returned 0xfd0000 [0180.394] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322ee0f, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb322ee0f, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0180.396] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322ee0f, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb322ee0f, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.396] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaf5d7185, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xaf5d7185, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache2", cAlternateFileName="")) returned 1 [0180.396] GetProcessHeap () returned 0xfd0000 [0180.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0180.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaf5d7185, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x622d70f7, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.397] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaf5d7185, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x622d70f7, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.397] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50d3b341, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x50d3b341, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="doomed", cAlternateFileName="")) returned 1 [0180.397] GetProcessHeap () returned 0xfd0000 [0180.397] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0180.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\doomed\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50d3b341, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x537b2ea6, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.399] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50d3b341, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x537b2ea6, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.399] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50d3b341, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x537b2ea6, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.399] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.399] GetProcessHeap () returned 0xfd0000 [0180.399] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0180.399] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50ca277f, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x50ca277f, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="entries", cAlternateFileName="")) returned 1 [0180.399] GetProcessHeap () returned 0xfd0000 [0180.399] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0180.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50ca277f, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x50e6c48e, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0180.402] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x50ca277f, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x50e6c48e, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.405] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a491c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4a491c9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcafbc1b0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="013C507F8C6DC51CF18CC10ABECAC5868407766A", cAlternateFileName="013C50~1")) returned 1 [0180.405] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="017020BFB3471E12709C39371D58E8123BCF28FB", cAlternateFileName="017020~1")) returned 1 [0180.405] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6966619, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6966619, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6982762, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79", cAlternateFileName="019B3F~1")) returned 1 [0180.405] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="020A4F3A0F6F161908D148AEB21A124C4BADFD41", cAlternateFileName="020A4F~1")) returned 1 [0180.405] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ae569d, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xc4ae569d, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xc4ae569d, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x1a65d, dwReserved0=0x0, dwReserved1=0x0, cFileName="02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C", cAlternateFileName="02ABD0~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e6aa7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc47e6aa7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc480cd0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="055BC3539A35CF182A96E6F1F1F7C0168BEE66FE", cAlternateFileName="055BC3~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b38178, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="05C341B704CB1060501AA0B43D83F975ECBB85F2", cAlternateFileName="05C341~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x48c9ac43, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x0, cFileName="062AD3657B516BAF21B6D366104D405078541BA6", cAlternateFileName="062AD3~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1165, dwReserved0=0x0, dwReserved1=0x0, cFileName="062B04E15EAFB2D212062ECE2F5B56DAE65BAE22", cAlternateFileName="062B04~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359ce54, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x359ce54, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x35aa535, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0718303207D0267173EECAE48EF1BA3EE0CCAF92", cAlternateFileName="071830~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="086D90F358405509D6EAA39BC422393A31BDE8CA", cAlternateFileName="086D90~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c8f7d5, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45c8f7d5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45c8f7d5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="097326CA201DC4FEED987C8C534C04EF1E14A3DC", cAlternateFileName="097326~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4000ddb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4000ddb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3", cAlternateFileName="0A55BC~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x747, dwReserved0=0x0, dwReserved1=0x0, cFileName="0A774848D5BE9E32A6789642784FD4DAFCD580F5", cAlternateFileName="0A7748~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1167, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61", cAlternateFileName="0AC9F7~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x428b2b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x428b2b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x428b2b53, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x158e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B59963DF9BAE2D2E93964FC3500B450212202AA", cAlternateFileName="0B5996~1")) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1164, dwReserved0=0x0, dwReserved1=0x0, cFileName="0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89", cAlternateFileName="0C77EE~1")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefa, dwReserved0=0x0, dwReserved1=0x0, cFileName="0C8C626D4A0FA2C1F538E447383CFE3F820ADE06", cAlternateFileName="0C8C62~1")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4407a35c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4407a35c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4407a35c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x0, dwReserved1=0x0, cFileName="0DE853B708EF02DB762AC1E3D2424A69E631431C", cAlternateFileName="0DE853~1")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0E0AA719737925C65439EF8199433AD2A3826055", cAlternateFileName="0E0AA7~1")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74078, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e74078, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb777d4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F", cAlternateFileName="0EDDF8~1")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898c851, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x898c851, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x898dba9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4812, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FEBD8BDBFAC8B82791945DC7E04F675419B2F42", cAlternateFileName="0FEBD8~1")) returned 1 [0180.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef43c89, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef43c89, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x450ca7ce, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="108573E2B07FF25FFCAFE37F58D375561A47424D", cAlternateFileName="108573~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1380A3F977C9CB8D60BD5A90243F6A04E42FAD04", cAlternateFileName="1380A3~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2e8f28, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e2e8f28, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e30f171, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="140445A2980512A346F4FF5725C0D44440B68C0A", cAlternateFileName="140445~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x0, dwReserved1=0x0, cFileName="14BA7A2A080D9B70E5991F61EC521D7B59DB545E", cAlternateFileName="14BA7A~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x72924653, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1", cAlternateFileName="14BF1B~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d869ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2d869ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2d869ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xadb, dwReserved0=0x0, dwReserved1=0x0, cFileName="150EB071D854D5071A223EEB0639B4597C92FB45", cAlternateFileName="150EB0~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455c940b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x455c940b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x455c940b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x0, dwReserved1=0x0, cFileName="152707BF9D0E3D40EE384F6696E826A52171E312", cAlternateFileName="152707~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b94c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb3e1aa6f, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb3e1aa6f, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA", cAlternateFileName="156A5C~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9", cAlternateFileName="15FFFE~1")) returned 1 [0180.412] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a98146, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a98146, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4aa1d97, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="1600A1E0F302711ACE755C1F40E790A8A4071644", cAlternateFileName="1600A1~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6745d71, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6745d71, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6781aab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C", cAlternateFileName="164AA0~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x0, dwReserved1=0x0, cFileName="1722A63DF48E38B5DC308AE741FBFA24F762D8AC", cAlternateFileName="1722A6~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36514b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc36514b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc36514b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x0, cFileName="179F6D8969C48967D77229126C8892C5E40DBC29", cAlternateFileName="179F6D~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3243cbd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3243cbd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x325c36f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1948A617BE08C70F70E0A406F640FD839A720820", cAlternateFileName="1948A6~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x387d231, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x387d231, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x389cde0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xfe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="196BCA845E91608F7B4CA6127A60D20AF55413AC", cAlternateFileName="196BCA~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="1A7C641FFE043BB811768257AF97546A0C7F3B55", cAlternateFileName="1A7C64~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1B5F6673E35017BD0F3AFD7E5FAA954323582ACC", cAlternateFileName="1B5F66~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc45381d7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc45381d7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc455e324, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD", cAlternateFileName="1B7A33~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f507bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2f507bc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3999, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BCAD7DC01C28C00520186316B38E1165ADC4D1E", cAlternateFileName="1BCAD7~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ed75c7, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x61ed75c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x61ed75c7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x24707, dwReserved0=0x0, dwReserved1=0x0, cFileName="1C069501161F85F05DFE519ADECB1BAFD807156F", cAlternateFileName="1C0695~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54227b5, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xc54227b5, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xc54227b5, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x56722, dwReserved0=0x0, dwReserved1=0x0, cFileName="1C58BCC50FD90DA569C25964A2E2FCBF9F9461AA", cAlternateFileName="1C58BC~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3fb491e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3fb491e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3fb491e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F", cAlternateFileName="1D4EE0~1")) returned 1 [0180.413] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621f871c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x621f871c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x621f871c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC", cAlternateFileName="1D79D2~1")) returned 1 [0180.414] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e3eac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc32e3eac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc330a0fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E", cAlternateFileName="1D9E8D~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B", cAlternateFileName="1E2EF8~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7", cAlternateFileName="1E4C1D~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5", cAlternateFileName="1EB2E4~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC", cAlternateFileName="1F58B2~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd957e2a, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xcd957e2a, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xcd957e2a, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1F59FFA0509B1DDF3464D30BCC5B9FB7F946ADD4", cAlternateFileName="1F59FF~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4329e9f1, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4329e9f1, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4329e9f1, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39", cAlternateFileName="1F9E7E~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23b0e52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc23b0e52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f903f2d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x235d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2002896BDFC9D08F61F19B61E28302E004E659C6", cAlternateFileName="200289~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346a7252, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x346a7252, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x348249e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="2084506A70CA3A1F0B77218D89A9FEF723A36E38", cAlternateFileName="208450~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4329e9f1, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4329e9f1, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4329e9f1, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="208483D2803117F885B3B730B35024666396680C", cAlternateFileName="208483~1")) returned 1 [0180.417] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbd536, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcafbd536, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x149e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2119417A1C9E8DA14601959E96C1123DBD536A0E", cAlternateFileName="211941~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a510, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436a510, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4372d93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x21c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="23235518CD38CB3D10B0AC591123694C9D398B7F", cAlternateFileName="232355~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x0, dwReserved1=0x0, cFileName="23DA68590AFA0C21CFF070CAD97C0AA75858A2D7", cAlternateFileName="23DA68~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c21097, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4630, dwReserved0=0x0, dwReserved1=0x0, cFileName="23E137DFD51BC10A5A373603EA1ED32314D43850", cAlternateFileName="23E137~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2414045942C11CC3E304204DAE2B8DFA27711F3F", cAlternateFileName="241404~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4386e489, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4386e489, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4386e489, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x54c, dwReserved0=0x0, dwReserved1=0x0, cFileName="24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6", cAlternateFileName="24BE47~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430faed6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x430faed6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x430faed6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="24C5A11C7C55D609ED86B6E31E2C94301D075CB3", cAlternateFileName="24C5A1~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c8f4c8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4c8f4c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e69094, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x12126, dwReserved0=0x0, dwReserved1=0x0, cFileName="24F9514653FD834D9D33E21B4C0AECB308550A9A", cAlternateFileName="24F951~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69183c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x69183c7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x692337c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="254686BCA69ED43CB6F2FD35C26758AA2D993329", cAlternateFileName="254686~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45d74626, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45d74626, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45d74626, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E", cAlternateFileName="2598A1~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc997b2b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc997b2b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc997b2b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1867, dwReserved0=0x0, dwReserved1=0x0, cFileName="26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98", cAlternateFileName="26DCBF~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="28DD73A864C09949BE5B625DFA4CF2CC8D7B0272", cAlternateFileName="28DD73~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc28032b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc28032b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3fb40231, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf756, dwReserved0=0x0, dwReserved1=0x0, cFileName="292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8", cAlternateFileName="292C4D~1")) returned 1 [0180.418] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2020fe1, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xc2020fe1, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xc2093736, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x90a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="29F68B7BF650D5F8B01D50A3B8BA7457BA01E0FF", cAlternateFileName="29F68B~1")) returned 1 [0180.420] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2A0C541C7E9FC0F629A45F976215EB2A8AE994F3", cAlternateFileName="2A0C54~1")) returned 1 [0180.420] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x0, dwReserved1=0x0, cFileName="2A2631B4E21DE0654F50C86D5D9258EBDB245D08", cAlternateFileName="2A2631~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A", cAlternateFileName="2A650C~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c100ef, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42c100ef, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42c100ef, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2A7F9C218AF57C32B146B82864B7FBDB08B612DA", cAlternateFileName="2A7F9C~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36514b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc36514b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A", cAlternateFileName="2AEEA3~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee9549, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7ee9549, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x856d77b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B24068915A6A6D77F01D72F7883D0A5FF0907B6", cAlternateFileName="2B2406~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b94c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1d6b94c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e6a43d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2", cAlternateFileName="2B784C~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435e1c2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435e1c2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x43706bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2562, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C1C3006E308780316B46ECD995A5336C781BEE6", cAlternateFileName="2C1C30~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C416B78A7C89B5CDB81D93B1A303A39C7E34723", cAlternateFileName="2C416B~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c21097, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C6468600265AB1F5F8363AFD96F4AE7E91EE790", cAlternateFileName="2C6468~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x0, dwReserved1=0x0, cFileName="2CA5871C48087826D8608DA52BA892CBBA1FC30E", cAlternateFileName="2CA587~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE", cAlternateFileName="2D7DB1~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d0cd3a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43d0cd3a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43d0cd3a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1794, dwReserved0=0x0, dwReserved1=0x0, cFileName="2E08CDAEE955A40889AC5877BE194C7EF12394A5", cAlternateFileName="2E08CD~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45", cAlternateFileName="2EAFF2~1")) returned 1 [0180.421] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32979d2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc32979d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc32bdc47, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x53c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EEF955B1888DD216711A407C2CA7C4F0AEFD623", cAlternateFileName="2EEF95~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1163, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6", cAlternateFileName="2EF13D~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba081c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3ba081c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3ba1ba5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x17d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4", cAlternateFileName="2F08D4~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e4570d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2e4570d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2e4570d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F803861A862CED3B233D955BAE181A1838202B7", cAlternateFileName="2F8038~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5581a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e5581a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x54989d6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e52, dwReserved0=0x0, dwReserved1=0x0, cFileName="2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78", cAlternateFileName="2FC942~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="2FD61AE1BA24124CC1923ECAFD4AAC3D50447717", cAlternateFileName="2FD61A~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90c92ac, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="31279F1295868B1758188226BB765EF87F3F8DB8", cAlternateFileName="31279F~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e07506, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc1e07506, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f24f4ed, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x0, dwReserved1=0x0, cFileName="31592C8B017CA0508B5F0339E7E1EA46376F2D31", cAlternateFileName="31592C~1")) returned 1 [0180.422] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="32AFE38EED991EA004851E7C968397C7D9EA501C", cAlternateFileName="32AFE3~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bb580e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43bb580e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43bb580e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="32B6927A1EB46E83B230070265358A1C5B788D11", cAlternateFileName="32B692~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7bf2c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef7bf2c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x45166c41, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x911d, dwReserved0=0x0, dwReserved1=0x0, cFileName="339A4E96E26DFFA4704F0AF081D2B85B12D03939", cAlternateFileName="339A4E~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x0, dwReserved1=0x0, cFileName="33A34037B96BD19CC90C0A382CEDF384EE052FCC", cAlternateFileName="33A340~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a57cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc48a57cd, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc493dfe5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc42, dwReserved0=0x0, dwReserved1=0x0, cFileName="34647CED6D78CD19DDE8B8B095D71A8525D25F62", cAlternateFileName="34647C~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30818ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc30818ec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcb02c6f6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2cf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="3502F57243FBD8F9D25E093A72D603074783A304", cAlternateFileName="3502F5~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69a5eeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc69a5eeb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc69a5eeb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x64, dwReserved0=0x0, dwReserved1=0x0, cFileName="356FCE9F932692DC643481DBA1ABEA937B629F58", cAlternateFileName="356FCE~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb134c0a6, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xb134c0a6, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb134c0a6, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x0, cFileName="36C9697884893424CB8526E64A77FF22D98957EE", cAlternateFileName="36C969~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="37D63D8E3209E1320DA8FE39BB8886154CC74653", cAlternateFileName="37D63D~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcadc5135, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4fcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="39CC8AA9054EC6244CA281EEA4BD937517E2861D", cAlternateFileName="39CC8A~1")) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefd, dwReserved0=0x0, dwReserved1=0x0, cFileName="3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59", cAlternateFileName="3A0ECB~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x0, dwReserved1=0x0, cFileName="3A24CBE07E70F6A875538D4584254A734BA5E7FE", cAlternateFileName="3A24CB~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x0, cFileName="3A4E2A71FA2039E9791193EE5E177FC69FFD31AD", cAlternateFileName="3A4E2A~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc61e643d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc61e643d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x128b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3AE6C68D35ADDCA7C407967B028013E0D14C1CAA", cAlternateFileName="3AE6C6~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4806032, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4806032, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4806032, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x15e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3BEE3D0AFFDC410177D8F779928D53F5B4B92118", cAlternateFileName="3BEE3D~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6919750, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6919750, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x692472e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83", cAlternateFileName="3CA20D~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb58b1d6, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xbb58b1d6, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xbb58b1d6, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CEFC94E181174BC594E8020023DC579496C4396", cAlternateFileName="3CEFC9~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1167, dwReserved0=0x0, dwReserved1=0x0, cFileName="3DCFED4321069AB90BA910DD348E0CD9794C6635", cAlternateFileName="3DCFED~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x73, dwReserved0=0x0, dwReserved1=0x0, cFileName="3E42820479FADF666581B0704FA4AF901AE0E045", cAlternateFileName="3E4282~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435f53f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435f53f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x43706bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b52, dwReserved0=0x0, dwReserved1=0x0, cFileName="3E538CAC2C914514ECC5B580E31B0737FF540EB1", cAlternateFileName="3E538C~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43383676, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43383676, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43383676, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="3E96AE69B2C845D9D81E26B170F62BCD71497329", cAlternateFileName="3E96AE~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1100, dwReserved0=0x0, dwReserved1=0x0, cFileName="3E98EE3664479D9428247C5B706A39C5F495B7AE", cAlternateFileName="3E98EE~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1810b80, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xb1810b80, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb1810b80, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x39ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ED4C17B39225E63690A3AD4B1E90E0981F8C51B", cAlternateFileName="3ED4C1~1")) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44ae95de, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x44ae95de, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44c19b26, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x57af, dwReserved0=0x0, dwReserved1=0x0, cFileName="3FD2DE34D9F3B37F5EE298934463B811B5F45B88", cAlternateFileName="3FD2DE~1")) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a510, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436a510, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4372d93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1a4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="4041F3B87A7EBA953DFE4576B8DB14478B01F9A4", cAlternateFileName="4041F3~1")) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A", cAlternateFileName="407EB4~1")) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b38178, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="43A641B524487AFDAC7A8AF548EE196228BF6EAE", cAlternateFileName="43A641~1")) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33565af, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc33565af, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xca6c2fff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119f, dwReserved0=0x0, dwReserved1=0x0, cFileName="44437BAE601C72F5ED96953EAE92C527D4C2D46F", cAlternateFileName="44437B~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="445E695F447CA967C4DAE00C80034130290F80EA", cAlternateFileName="445E69~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x0, dwReserved1=0x0, cFileName="45461427D6D9EC3BD8D179493325388E78C31FA4", cAlternateFileName="454614~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433cfb20, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433cfb20, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433cfb20, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="45C64E5C2E9809667C5FC9F06FC42641326DF768", cAlternateFileName="45C64E~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="46DBA23158169F447D071A5138BFF6E70402F9D1", cAlternateFileName="46DBA2~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc449f849, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc449f849, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc449f849, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="47005A21A17AFE54769573B5138702C9FB8E0E87", cAlternateFileName="47005A~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x387beb1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x387beb1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x389ba70, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4764521F6FB23F694297C1319251B844AE508AB7", cAlternateFileName="476452~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42fbcea, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc42fbcea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcb257f55, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xba06, dwReserved0=0x0, dwReserved1=0x0, cFileName="47D194343D81BB87B63E3776058D0709ADA9FE0B", cAlternateFileName="47D194~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84060c4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc84060c4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc842c220, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x521, dwReserved0=0x0, dwReserved1=0x0, cFileName="483516ABA24A455AA0EF7181B6F831FC7494E7A3", cAlternateFileName="483516~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44f10e1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb15623dd, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb15623dd, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="4851C58D9C640F303B306BABB9DBE67261F15F08", cAlternateFileName="4851C5~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441ab626, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x441ab626, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x441ab626, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="48D18A403364708B74676D0C5068809EE47BCF43", cAlternateFileName="48D18A~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x491d, dwReserved0=0x0, dwReserved1=0x0, cFileName="491DECD15F6DA1F39C25E411B302418495F1B28F", cAlternateFileName="491DEC~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d595830, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d595830, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2d595830, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x523, dwReserved0=0x0, dwReserved1=0x0, cFileName="49772025B554A1B58F236C062A67C6F401269337", cAlternateFileName="497720~1")) returned 1 [0180.474] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa907ce07, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa907ce07, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa907ce07, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="4996B3A4E4609BF5C760674E0477DC3B5B31E7BB", cAlternateFileName="4996B3~1")) returned 1 [0180.475] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45425a1e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45425a1e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4544bc83, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="49BEF680B849DB26256F9DA3DDFF8948DC33EB78", cAlternateFileName="49BEF6~1")) returned 1 [0180.475] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ce6ad8, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43ce6ad8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43ce6ad8, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4A46AC76F0CCC4293CC380999116F3B7911F85BE", cAlternateFileName="4A46AC~1")) returned 1 [0180.475] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B18B5ADA8BF2E475961694931BE215AED8ECBD5", cAlternateFileName="4B18B5~1")) returned 1 [0180.475] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79724a0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x79724a0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb777d4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BA0471095F4C3DB3F7C817993B07112EBDB3F59", cAlternateFileName="4BA047~1")) returned 1 [0180.475] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113c, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF", cAlternateFileName="4BA0EA~1")) returned 1 [0180.475] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45793056, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45793056, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x457b9283, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C2BFD9D85D0C1B7527A1BAD0613676DA6222786", cAlternateFileName="4C2BFD~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fead850, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3fead850, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3fead850, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xada, dwReserved0=0x0, dwReserved1=0x0, cFileName="4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5", cAlternateFileName="4D7A41~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d284c4, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xb9d284c4, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb9d4e53b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DB6555CE1C0E287947C1C0ABFE8FE8A91AB5913", cAlternateFileName="4DB655~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f92a134, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3f92a134, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3f92a134, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4E4FE439C561F79240EC3AB7AE886C122ADED94A", cAlternateFileName="4E4FE4~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3bd4bec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3bd4bec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3bd4bec, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x48d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4E62B77ABD78ADC557B61986D9E366B41273F2AE", cAlternateFileName="4E62B7~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a8452e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43a8452e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43a8452e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="4EB19FA3D8CEAD68F6470D09587A1393AA88100C", cAlternateFileName="4EB19F~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c05d84, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3c05d84, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x416710e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1cbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="4ED140178E492EA87CC63B79854E2794790379DF", cAlternateFileName="4ED140~1")) returned 1 [0180.480] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x0, dwReserved1=0x0, cFileName="4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC", cAlternateFileName="4EFB15~1")) returned 1 [0180.481] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x0, dwReserved1=0x0, cFileName="4F0C54EEF677196E2899E5E79B4F3A906E46F926", cAlternateFileName="4F0C54~1")) returned 1 [0180.481] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5c99, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x70f5c99, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7100c8d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94", cAlternateFileName="4F5B7C~1")) returned 1 [0180.481] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9", cAlternateFileName="4F680E~1")) returned 1 [0180.481] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45471edf, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45471edf, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45530aa0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18", cAlternateFileName="4FBCDA~1")) returned 1 [0180.481] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ae200, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x74ae200, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x74b0916, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="4FC87940361F2B04B3366CC184210D87808060BF", cAlternateFileName="4FC879~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440eca7b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x440eca7b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x440eca7b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xab58, dwReserved0=0x0, dwReserved1=0x0, cFileName="4FCA54FC9B5C08F4A61C96D6642C029B00E50F17", cAlternateFileName="4FCA54~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436dfc5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436dfc5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e767b4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1658, dwReserved0=0x0, dwReserved1=0x0, cFileName="50368CB52EB7460247084562523D1AE6E2D6FF15", cAlternateFileName="50368C~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433cfb20, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433cfb20, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433cfb20, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x0, dwReserved1=0x0, cFileName="514D7C625328106E43CEC7FD7CF71AEDA0A3101F", cAlternateFileName="514D7C~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe27, dwReserved0=0x0, dwReserved1=0x0, cFileName="522FF036651FEA29F227BFB14BD934175DDBA62A", cAlternateFileName="522FF0~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3", cAlternateFileName="529CD0~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fad502d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2096f70d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2096f70d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="52DA3BAA6D4D709B01D171773AD7B03240F54458", cAlternateFileName="52DA3B~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a0fac7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc0a0fac7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc0a0fac7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="53276735904DF669A90B5F1543E4FBB2A1927E85", cAlternateFileName="532767~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc208fcfa, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc208fcfa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f29b99e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2bd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="53DAE4B1D7BFF6744CCAF7207DE631267F9883DC", cAlternateFileName="53DAE4~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="53FE39FDB590D11DCF5D36416A9314CCABB2C284", cAlternateFileName="53FE39~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c1b07b, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xc1c1b07b, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xc1c1b07b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="55B4A2B18050F8CB88F290EE3BD1062FDF39D628", cAlternateFileName="55B4A2~1")) returned 1 [0180.482] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe25, dwReserved0=0x0, dwReserved1=0x0, cFileName="56C1D667A6AFD5406F830882D54923461E079C1B", cAlternateFileName="56C1D6~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3aefdc3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3aefdc3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x554c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5754A981D1B97D4C45C91BFDCC6C62D72CF625EF", cAlternateFileName="5754A9~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440c680d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x440c680d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x440c680d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="579EC9227C4A988DCC4894D82AA161957107515D", cAlternateFileName="579EC9~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4964228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4964228, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcaf78f3b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="57E662573FD9E42D3972BE92D3DF0557C7B2E836", cAlternateFileName="57E662~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5994EFBA690009A711CB274682E4797710EC767B", cAlternateFileName="5994EF~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a29c76, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x44a29c76, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44a29c76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3798, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9", cAlternateFileName="5A39FC~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A78256218E560B4D9035CC52A989756691DFAEC", cAlternateFileName="5A7825~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435baa6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435baa6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x436f332, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2817, dwReserved0=0x0, dwReserved1=0x0, cFileName="5B9196645BD157422AF27C7DAA67799558B3FDF3", cAlternateFileName="5B9196~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="5CC1482042EA552D42DB375CF62E1959EDFD4F33", cAlternateFileName="5CC148~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2a2eca, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x1f2a2eca, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1f2a2eca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2", cAlternateFileName="5D226B~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c47318, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c47318, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c6d56d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5D3521E1D174FCB4103705B4338E3AB106525CC9", cAlternateFileName="5D3521~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8bd1c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef8bd1c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x451b00b9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2198, dwReserved0=0x0, dwReserved1=0x0, cFileName="5D44AC703C53CC7EE6356F698FD1B03DA81FFE47", cAlternateFileName="5D44AC~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9899a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6f9899a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6f99d11, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x447d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5E4954707B44E5A4B4ACF5F22B52219A1DCA477F", cAlternateFileName="5E4954~1")) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6ac3a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3e6ac3a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41684cf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0x0, dwReserved1=0x0, cFileName="5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C", cAlternateFileName="5F48FA~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x458be9ed, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x458be9ed, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5F6CA4B735A819E20BF4C478266384C8A4B7C158", cAlternateFileName="5F6CA4~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e767b4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e767b4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e767b4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1161, dwReserved0=0x0, dwReserved1=0x0, cFileName="5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4", cAlternateFileName="5FE82A~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6769b93, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc6769b93, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6c2e6d2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="616AB700BF5ED4A444798148DA26984F3B31D83A", cAlternateFileName="616AB7~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19daa34, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xb19daa34, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb1a00b2c, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="61954513912567BF01D8C3952743950BD5414206", cAlternateFileName="619545~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca61cf5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xca61cf5c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2eab, dwReserved0=0x0, dwReserved1=0x0, cFileName="62326019F9C99B9A93D51B48A1F63BC2D075A6B9", cAlternateFileName="623260~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4386e489, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4386e489, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4386e489, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1abb, dwReserved0=0x0, dwReserved1=0x0, cFileName="635EAE5D2B518F168607E2A8D67845079C2A7DF0", cAlternateFileName="635EAE~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42dfff70, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42dfff70, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42dfff70, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="63ACFE8698FC61908B016C5D661F8E6F430E32B6", cAlternateFileName="63ACFE~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34ab24a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5090ee5a, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x5090ee5a, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x1313, dwReserved0=0x0, dwReserved1=0x0, cFileName="63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1", cAlternateFileName="63F48F~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047323, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7047323, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7049b25, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="644E400521E4BFD78E4063E539A97F0C19A5EF01", cAlternateFileName="644E40~1")) returned 1 [0180.487] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="6730E7D38947125CF79CAEB391A7C2548F883DD9", cAlternateFileName="6730E7~1")) returned 1 [0180.495] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ed95f4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4ed95f4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4eda97d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="698AC159A6BCBA0D13FE6F10F1A38E498F826F33", cAlternateFileName="698AC1~1")) returned 1 [0180.495] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42e261bf, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42e261bf, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42e261bf, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x155c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6B59D88F10856ABB980993D7332F49AB71BD33B8", cAlternateFileName="6B59D8~1")) returned 1 [0180.495] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BFE0EB337F328928E30DD51C1084B7FD4937D99", cAlternateFileName="6BFE0E~1")) returned 1 [0180.495] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="6E70D64994FC50847D02A3C844407DE8C2A71039", cAlternateFileName="6E70D6~1")) returned 1 [0180.495] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe27, dwReserved0=0x0, dwReserved1=0x0, cFileName="6E737977754F860FE206E1BDA7E561C5EFCF040B", cAlternateFileName="6E7379~1")) returned 1 [0180.495] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43121106, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43121106, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43121106, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="6F4FA43590A63EB51F16A747B6869FEA664D492D", cAlternateFileName="6F4FA4~1")) returned 1 [0180.496] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90c92ac, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="6F8476F0E7F6646593363B49CE1F1A061176132D", cAlternateFileName="6F8476~1")) returned 1 [0180.496] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa873fde8, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa873fde8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="6FED260138400FD12677C90F90A961644A731AAC", cAlternateFileName="6FED26~1")) returned 1 [0180.496] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa6bfb9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcaa6bfb9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcaa6e6c6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x7afd, dwReserved0=0x0, dwReserved1=0x0, cFileName="705E490FDB59514DC9A1DEE2B8DE64728A905979", cAlternateFileName="705E49~1")) returned 1 [0180.496] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="71C7F05A4972DA343C7410BEC996469B4D9B1EC1", cAlternateFileName="71C7F0~1")) returned 1 [0180.496] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f8e6cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3f8e6cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcae5797a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc302, dwReserved0=0x0, dwReserved1=0x0, cFileName="730732921FB223938F8FC50951AF7C51CCEA61B0", cAlternateFileName="730732~1")) returned 1 [0180.519] GetProcessHeap () returned 0xfd0000 [0180.519] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0180.519] GetProcessHeap () returned 0xfd0000 [0180.519] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0180.519] GetProcessHeap () returned 0xfd0000 [0180.519] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0180.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xf7dd7182, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xf7dd7182, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.523] GetProcessHeap () returned 0xfd0000 [0180.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0180.523] GetProcessHeap () returned 0xfd0000 [0180.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0180.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfcae9ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0180.524] GetProcessHeap () returned 0xfd0000 [0180.524] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0180.524] GetProcessHeap () returned 0xfd0000 [0180.524] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0180.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3080cc6, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xb3208b9d, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb3208b9d, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.555] GetProcessHeap () returned 0xfd0000 [0180.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0180.555] GetProcessHeap () returned 0xfd0000 [0180.555] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0180.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4016fa00, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb644042c, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xb644042c, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.559] GetProcessHeap () returned 0xfd0000 [0180.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0180.559] GetProcessHeap () returned 0xfd0000 [0180.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0180.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\thumbnails\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe53ad66, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe53ad66, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe53ad66, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0180.559] GetProcessHeap () returned 0xfd0000 [0180.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0180.560] GetProcessHeap () returned 0xfd0000 [0180.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.626] GetProcessHeap () returned 0xfd0000 [0180.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.626] GetProcessHeap () returned 0xfd0000 [0180.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.627] GetProcessHeap () returned 0xfd0000 [0180.627] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.627] GetProcessHeap () returned 0xfd0000 [0180.627] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0180.628] GetProcessHeap () returned 0xfd0000 [0180.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.628] GetProcessHeap () returned 0xfd0000 [0180.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.628] GetProcessHeap () returned 0xfd0000 [0180.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0180.630] GetProcessHeap () returned 0xfd0000 [0180.630] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0180.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0180.631] GetProcessHeap () returned 0xfd0000 [0180.631] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.633] GetProcessHeap () returned 0xfd0000 [0180.633] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0180.637] GetProcessHeap () returned 0xfd0000 [0180.637] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.638] GetProcessHeap () returned 0xfd0000 [0180.638] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.638] GetProcessHeap () returned 0xfd0000 [0180.638] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.638] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.638] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.638] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.638] GetProcessHeap () returned 0xfd0000 [0180.638] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.638] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0180.639] GetProcessHeap () returned 0xfd0000 [0180.639] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.639] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.639] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.639] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.639] GetProcessHeap () returned 0xfd0000 [0180.639] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.639] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0180.639] GetProcessHeap () returned 0xfd0000 [0180.639] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.639] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.639] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.640] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0180.640] GetProcessHeap () returned 0xfd0000 [0180.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.640] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0180.640] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0180.640] GetProcessHeap () returned 0xfd0000 [0180.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.640] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.640] GetProcessHeap () returned 0xfd0000 [0180.640] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.641] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.641] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.641] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.641] GetProcessHeap () returned 0xfd0000 [0180.641] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.641] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.641] GetProcessHeap () returned 0xfd0000 [0180.641] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.641] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.641] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.641] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.641] GetProcessHeap () returned 0xfd0000 [0180.642] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.642] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.642] GetProcessHeap () returned 0xfd0000 [0180.642] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.642] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.642] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.642] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.642] GetProcessHeap () returned 0xfd0000 [0180.642] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.642] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.642] GetProcessHeap () returned 0xfd0000 [0180.642] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0180.643] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.643] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.643] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0180.643] GetProcessHeap () returned 0xfd0000 [0180.643] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.643] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.643] GetProcessHeap () returned 0xfd0000 [0180.643] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.643] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.643] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0180.644] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0180.644] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0180.644] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.644] GetProcessHeap () returned 0xfd0000 [0180.644] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.644] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.644] GetProcessHeap () returned 0xfd0000 [0180.644] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.645] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.645] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.645] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.647] GetProcessHeap () returned 0xfd0000 [0180.647] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.647] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.647] GetProcessHeap () returned 0xfd0000 [0180.647] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.648] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.648] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.648] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.648] GetProcessHeap () returned 0xfd0000 [0180.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.648] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.648] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.648] GetProcessHeap () returned 0xfd0000 [0180.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.649] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9E2F88E3.Twitter_wgeqdkkx372wm", cAlternateFileName="9E2F88~1.TWI")) returned 1 [0180.649] GetProcessHeap () returned 0xfd0000 [0180.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.652] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.652] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x309d358f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0180.652] GetProcessHeap () returned 0xfd0000 [0180.652] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x309d358f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.656] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x309d358f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.656] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0180.656] GetProcessHeap () returned 0xfd0000 [0180.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.657] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.657] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.657] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.658] GetProcessHeap () returned 0xfd0000 [0180.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.658] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0180.658] GetProcessHeap () returned 0xfd0000 [0180.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0180.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.658] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.658] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0180.658] GetProcessHeap () returned 0xfd0000 [0180.658] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.658] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0180.658] GetProcessHeap () returned 0xfd0000 [0180.658] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.659] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.659] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.659] GetProcessHeap () returned 0xfd0000 [0180.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.659] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0180.659] GetProcessHeap () returned 0xfd0000 [0180.659] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.659] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.659] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.659] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0180.659] GetProcessHeap () returned 0xfd0000 [0180.659] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.659] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0180.659] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.659] GetProcessHeap () returned 0xfd0000 [0180.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.660] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.660] GetProcessHeap () returned 0xfd0000 [0180.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.660] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.660] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.660] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.660] GetProcessHeap () returned 0xfd0000 [0180.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.660] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b1aa9e9, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.660] GetProcessHeap () returned 0xfd0000 [0180.660] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b1aa9e9, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.660] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b1aa9e9, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.660] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b1aa9e9, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.661] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.661] GetProcessHeap () returned 0xfd0000 [0180.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.661] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b15e23b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.661] GetProcessHeap () returned 0xfd0000 [0180.661] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b15e23b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.661] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b15e23b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b15e23b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.662] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.662] GetProcessHeap () returned 0xfd0000 [0180.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.662] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.662] GetProcessHeap () returned 0xfd0000 [0180.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.662] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.662] GetProcessHeap () returned 0xfd0000 [0180.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.662] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.662] GetProcessHeap () returned 0xfd0000 [0180.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.664] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.664] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3b278594, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0180.665] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b1d0afa, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0180.665] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x880df65b, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x880df65b, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x880df65b, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0180.665] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x880df65b, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x880df65b, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x880df65b, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0180.665] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x880df65b, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x880df65b, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x880df65b, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0180.665] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.666] GetProcessHeap () returned 0xfd0000 [0180.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.666] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.666] GetProcessHeap () returned 0xfd0000 [0180.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.666] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.666] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.667] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.667] GetProcessHeap () returned 0xfd0000 [0180.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.667] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.667] GetProcessHeap () returned 0xfd0000 [0180.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.667] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.667] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.667] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.667] GetProcessHeap () returned 0xfd0000 [0180.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.753] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.753] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.754] GetProcessHeap () returned 0xfd0000 [0180.754] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.755] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0180.755] GetProcessHeap () returned 0xfd0000 [0180.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.756] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.756] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.757] GetProcessHeap () returned 0xfd0000 [0180.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.757] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.758] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagOutputDir", cAlternateFileName="DIAGOU~1")) returned 1 [0180.758] GetProcessHeap () returned 0xfd0000 [0180.758] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\DiagOutputDir\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.758] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.758] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.758] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.758] GetProcessHeap () returned 0xfd0000 [0180.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.758] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagOutputDir", cAlternateFileName="DIAGOU~1")) returned 0 [0180.758] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.758] GetProcessHeap () returned 0xfd0000 [0180.758] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.758] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 0 [0180.759] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.759] GetProcessHeap () returned 0xfd0000 [0180.759] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.759] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy", cAlternateFileName="C5E252~1")) returned 1 [0180.759] GetProcessHeap () returned 0xfd0000 [0180.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.769] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.769] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0180.769] GetProcessHeap () returned 0xfd0000 [0180.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.772] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.773] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0180.773] GetProcessHeap () returned 0xfd0000 [0180.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.783] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.783] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.783] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.783] GetProcessHeap () returned 0xfd0000 [0180.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.784] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0180.784] GetProcessHeap () returned 0xfd0000 [0180.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.791] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.791] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.791] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.791] GetProcessHeap () returned 0xfd0000 [0180.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.791] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0180.791] GetProcessHeap () returned 0xfd0000 [0180.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.791] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.791] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.791] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.791] GetProcessHeap () returned 0xfd0000 [0180.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.792] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0180.792] GetProcessHeap () returned 0xfd0000 [0180.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.792] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.792] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.792] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.792] GetProcessHeap () returned 0xfd0000 [0180.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.792] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0180.792] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.792] GetProcessHeap () returned 0xfd0000 [0180.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.792] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.792] GetProcessHeap () returned 0xfd0000 [0180.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0180.793] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.793] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.793] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0180.793] GetProcessHeap () returned 0xfd0000 [0180.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.793] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.793] GetProcessHeap () returned 0xfd0000 [0180.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.798] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.798] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.798] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.798] GetProcessHeap () returned 0xfd0000 [0180.798] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.798] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.798] GetProcessHeap () returned 0xfd0000 [0180.798] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.798] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.798] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.798] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.799] GetProcessHeap () returned 0xfd0000 [0180.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.799] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.799] GetProcessHeap () returned 0xfd0000 [0180.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0180.799] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.799] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.799] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0180.799] GetProcessHeap () returned 0xfd0000 [0180.799] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.799] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.799] GetProcessHeap () returned 0xfd0000 [0180.799] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.800] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.800] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0180.800] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0180.800] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0180.800] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.800] GetProcessHeap () returned 0xfd0000 [0180.800] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.800] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.800] GetProcessHeap () returned 0xfd0000 [0180.800] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.800] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.800] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.800] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.800] GetProcessHeap () returned 0xfd0000 [0180.800] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.800] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.801] GetProcessHeap () returned 0xfd0000 [0180.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.801] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.801] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.801] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.801] GetProcessHeap () returned 0xfd0000 [0180.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.801] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.801] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.801] GetProcessHeap () returned 0xfd0000 [0180.801] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.802] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CortanaListenUIApp_cw5n1h2txyewy", cAlternateFileName="CORTAN~1")) returned 1 [0180.802] GetProcessHeap () returned 0xfd0000 [0180.802] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.805] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.805] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0180.805] GetProcessHeap () returned 0xfd0000 [0180.805] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.811] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.811] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0180.811] GetProcessHeap () returned 0xfd0000 [0180.811] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.814] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.814] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.814] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.814] GetProcessHeap () returned 0xfd0000 [0180.814] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.814] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0180.814] GetProcessHeap () returned 0xfd0000 [0180.814] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.821] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.822] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.822] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.822] GetProcessHeap () returned 0xfd0000 [0180.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.822] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0180.822] GetProcessHeap () returned 0xfd0000 [0180.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.822] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.822] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.822] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.822] GetProcessHeap () returned 0xfd0000 [0180.822] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.822] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0180.822] GetProcessHeap () returned 0xfd0000 [0180.822] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.823] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.823] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.823] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.823] GetProcessHeap () returned 0xfd0000 [0180.823] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.823] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0180.823] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.823] GetProcessHeap () returned 0xfd0000 [0180.823] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.823] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.823] GetProcessHeap () returned 0xfd0000 [0180.823] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.823] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.823] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.823] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.823] GetProcessHeap () returned 0xfd0000 [0180.823] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.824] GetProcessHeap () returned 0xfd0000 [0180.824] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.827] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.827] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.827] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.828] GetProcessHeap () returned 0xfd0000 [0180.828] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.828] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8306d465, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.828] GetProcessHeap () returned 0xfd0000 [0180.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8306d465, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8306d465, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.828] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8306d465, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.828] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.828] GetProcessHeap () returned 0xfd0000 [0180.828] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.828] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.828] GetProcessHeap () returned 0xfd0000 [0180.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0180.829] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.829] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.829] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0180.829] GetProcessHeap () returned 0xfd0000 [0180.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.829] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.829] GetProcessHeap () returned 0xfd0000 [0180.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.829] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.829] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0180.829] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0180.830] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0180.830] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.830] GetProcessHeap () returned 0xfd0000 [0180.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.830] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.830] GetProcessHeap () returned 0xfd0000 [0180.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.830] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.830] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.830] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0180.830] GetProcessHeap () returned 0xfd0000 [0180.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.830] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.831] GetProcessHeap () returned 0xfd0000 [0180.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.831] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.831] GetProcessHeap () returned 0xfd0000 [0180.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.831] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.831] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.831] GetProcessHeap () returned 0xfd0000 [0180.831] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.832] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopLearning_cw5n1h2txyewy", cAlternateFileName="DESKTO~2")) returned 1 [0180.832] GetProcessHeap () returned 0xfd0000 [0180.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.841] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.841] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0180.841] GetProcessHeap () returned 0xfd0000 [0180.841] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.885] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.885] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0180.885] GetProcessHeap () returned 0xfd0000 [0180.885] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0180.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.886] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.886] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0180.886] GetProcessHeap () returned 0xfd0000 [0180.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.886] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0180.886] GetProcessHeap () returned 0xfd0000 [0180.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.886] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.886] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.887] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.887] GetProcessHeap () returned 0xfd0000 [0180.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.887] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0180.887] GetProcessHeap () returned 0xfd0000 [0180.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.887] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.887] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.887] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0180.887] GetProcessHeap () returned 0xfd0000 [0180.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.887] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0180.887] GetProcessHeap () returned 0xfd0000 [0180.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0180.888] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.888] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.888] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0180.888] GetProcessHeap () returned 0xfd0000 [0180.888] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.888] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0180.888] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.888] GetProcessHeap () returned 0xfd0000 [0180.888] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.888] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.888] GetProcessHeap () returned 0xfd0000 [0180.888] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.889] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.889] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.889] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.889] GetProcessHeap () returned 0xfd0000 [0180.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.889] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.889] GetProcessHeap () returned 0xfd0000 [0180.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.890] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.890] GetProcessHeap () returned 0xfd0000 [0180.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.890] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.890] GetProcessHeap () returned 0xfd0000 [0180.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.890] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0180.890] GetProcessHeap () returned 0xfd0000 [0180.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.890] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.890] GetProcessHeap () returned 0xfd0000 [0180.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.891] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0180.891] GetProcessHeap () returned 0xfd0000 [0180.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.891] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.891] GetProcessHeap () returned 0xfd0000 [0180.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.891] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.891] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0180.892] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0180.892] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0180.892] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.892] GetProcessHeap () returned 0xfd0000 [0180.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.892] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.892] GetProcessHeap () returned 0xfd0000 [0180.892] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.892] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.892] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.892] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.892] GetProcessHeap () returned 0xfd0000 [0180.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.892] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.892] GetProcessHeap () returned 0xfd0000 [0180.892] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0180.893] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.893] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.893] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0180.893] GetProcessHeap () returned 0xfd0000 [0180.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.893] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.893] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.893] GetProcessHeap () returned 0xfd0000 [0180.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.894] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopView_cw5n1h2txyewy", cAlternateFileName="DESKTO~1")) returned 1 [0180.894] GetProcessHeap () returned 0xfd0000 [0180.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.897] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.897] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0180.897] GetProcessHeap () returned 0xfd0000 [0180.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.900] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.900] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0180.900] GetProcessHeap () returned 0xfd0000 [0180.900] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0180.901] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.901] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.901] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0180.901] GetProcessHeap () returned 0xfd0000 [0180.901] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.901] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0180.901] GetProcessHeap () returned 0xfd0000 [0180.901] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.901] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.901] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.901] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0180.902] GetProcessHeap () returned 0xfd0000 [0180.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.902] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0180.902] GetProcessHeap () returned 0xfd0000 [0180.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.902] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.902] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.902] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0180.902] GetProcessHeap () returned 0xfd0000 [0180.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.902] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0180.902] GetProcessHeap () returned 0xfd0000 [0180.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.903] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.903] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.903] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.903] GetProcessHeap () returned 0xfd0000 [0180.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.903] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0180.903] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.903] GetProcessHeap () returned 0xfd0000 [0180.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.903] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.903] GetProcessHeap () returned 0xfd0000 [0180.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0180.904] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.904] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.904] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0180.904] GetProcessHeap () returned 0xfd0000 [0180.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.904] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.904] GetProcessHeap () returned 0xfd0000 [0180.904] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0180.904] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.904] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.904] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0180.904] GetProcessHeap () returned 0xfd0000 [0180.904] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.904] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.904] GetProcessHeap () returned 0xfd0000 [0180.904] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.905] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.905] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.905] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.905] GetProcessHeap () returned 0xfd0000 [0180.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.905] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.905] GetProcessHeap () returned 0xfd0000 [0180.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.905] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.905] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.905] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0180.905] GetProcessHeap () returned 0xfd0000 [0180.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.905] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.905] GetProcessHeap () returned 0xfd0000 [0180.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0180.906] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.906] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0180.906] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0180.906] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0180.906] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0180.906] GetProcessHeap () returned 0xfd0000 [0180.906] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.906] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.906] GetProcessHeap () returned 0xfd0000 [0180.906] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.906] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.906] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.907] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0180.907] GetProcessHeap () returned 0xfd0000 [0180.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.907] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.907] GetProcessHeap () returned 0xfd0000 [0180.907] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0180.907] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.907] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0180.907] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0180.907] GetProcessHeap () returned 0xfd0000 [0180.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.907] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.907] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0180.907] GetProcessHeap () returned 0xfd0000 [0180.907] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.909] GetProcessHeap () returned 0xfd0000 [0180.909] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f1d90f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0180.911] GetProcessHeap () returned 0xfd0000 [0180.911] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f1d90f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.914] GetProcessHeap () returned 0xfd0000 [0180.914] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0180.915] GetProcessHeap () returned 0xfd0000 [0180.915] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.915] GetProcessHeap () returned 0xfd0000 [0180.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.915] GetProcessHeap () returned 0xfd0000 [0180.915] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.915] GetProcessHeap () returned 0xfd0000 [0180.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.916] GetProcessHeap () returned 0xfd0000 [0180.916] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.916] GetProcessHeap () returned 0xfd0000 [0180.916] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.916] GetProcessHeap () returned 0xfd0000 [0180.916] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.916] GetProcessHeap () returned 0xfd0000 [0180.916] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.916] GetProcessHeap () returned 0xfd0000 [0180.916] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.917] GetProcessHeap () returned 0xfd0000 [0180.917] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.917] GetProcessHeap () returned 0xfd0000 [0180.917] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0180.918] GetProcessHeap () returned 0xfd0000 [0180.918] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.918] GetProcessHeap () returned 0xfd0000 [0180.918] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.918] GetProcessHeap () returned 0xfd0000 [0180.918] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.918] GetProcessHeap () returned 0xfd0000 [0180.918] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0180.919] GetProcessHeap () returned 0xfd0000 [0180.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.919] GetProcessHeap () returned 0xfd0000 [0180.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0180.919] GetProcessHeap () returned 0xfd0000 [0180.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.919] GetProcessHeap () returned 0xfd0000 [0180.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0180.919] GetProcessHeap () returned 0xfd0000 [0180.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.920] GetProcessHeap () returned 0xfd0000 [0180.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.920] GetProcessHeap () returned 0xfd0000 [0180.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0180.920] GetProcessHeap () returned 0xfd0000 [0180.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0180.921] GetProcessHeap () returned 0xfd0000 [0180.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0180.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0180.995] GetProcessHeap () returned 0xfd0000 [0180.995] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0180.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0180.998] GetProcessHeap () returned 0xfd0000 [0180.998] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0180.999] GetProcessHeap () returned 0xfd0000 [0180.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0180.999] GetProcessHeap () returned 0xfd0000 [0180.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0180.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0181.000] GetProcessHeap () returned 0xfd0000 [0181.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.000] GetProcessHeap () returned 0xfd0000 [0181.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.001] GetProcessHeap () returned 0xfd0000 [0181.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.001] GetProcessHeap () returned 0xfd0000 [0181.001] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.001] GetProcessHeap () returned 0xfd0000 [0181.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.001] GetProcessHeap () returned 0xfd0000 [0181.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.001] GetProcessHeap () returned 0xfd0000 [0181.001] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0181.002] GetProcessHeap () returned 0xfd0000 [0181.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.002] GetProcessHeap () returned 0xfd0000 [0181.002] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0181.003] GetProcessHeap () returned 0xfd0000 [0181.003] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.003] GetProcessHeap () returned 0xfd0000 [0181.003] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.003] GetProcessHeap () returned 0xfd0000 [0181.003] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.004] GetProcessHeap () returned 0xfd0000 [0181.004] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.004] GetProcessHeap () returned 0xfd0000 [0181.004] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.004] GetProcessHeap () returned 0xfd0000 [0181.004] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.004] GetProcessHeap () returned 0xfd0000 [0181.004] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.004] GetProcessHeap () returned 0xfd0000 [0181.004] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.005] GetProcessHeap () returned 0xfd0000 [0181.005] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.005] GetProcessHeap () returned 0xfd0000 [0181.005] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.005] GetProcessHeap () returned 0xfd0000 [0181.005] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.005] GetProcessHeap () returned 0xfd0000 [0181.005] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.007] GetProcessHeap () returned 0xfd0000 [0181.007] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.009] GetProcessHeap () returned 0xfd0000 [0181.009] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.015] GetProcessHeap () returned 0xfd0000 [0181.015] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.016] GetProcessHeap () returned 0xfd0000 [0181.016] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.016] GetProcessHeap () returned 0xfd0000 [0181.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.016] GetProcessHeap () returned 0xfd0000 [0181.016] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.016] GetProcessHeap () returned 0xfd0000 [0181.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.017] GetProcessHeap () returned 0xfd0000 [0181.017] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.017] GetProcessHeap () returned 0xfd0000 [0181.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.018] GetProcessHeap () returned 0xfd0000 [0181.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.018] GetProcessHeap () returned 0xfd0000 [0181.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.018] GetProcessHeap () returned 0xfd0000 [0181.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.018] GetProcessHeap () returned 0xfd0000 [0181.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.018] GetProcessHeap () returned 0xfd0000 [0181.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.023] GetProcessHeap () returned 0xfd0000 [0181.023] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.023] GetProcessHeap () returned 0xfd0000 [0181.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.024] GetProcessHeap () returned 0xfd0000 [0181.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.024] GetProcessHeap () returned 0xfd0000 [0181.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.024] GetProcessHeap () returned 0xfd0000 [0181.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.024] GetProcessHeap () returned 0xfd0000 [0181.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.025] GetProcessHeap () returned 0xfd0000 [0181.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.025] GetProcessHeap () returned 0xfd0000 [0181.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.025] GetProcessHeap () returned 0xfd0000 [0181.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.025] GetProcessHeap () returned 0xfd0000 [0181.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.025] GetProcessHeap () returned 0xfd0000 [0181.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.026] GetProcessHeap () returned 0xfd0000 [0181.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.027] GetProcessHeap () returned 0xfd0000 [0181.027] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.029] GetProcessHeap () returned 0xfd0000 [0181.029] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e4b4510, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.032] GetProcessHeap () returned 0xfd0000 [0181.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.033] GetProcessHeap () returned 0xfd0000 [0181.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.033] GetProcessHeap () returned 0xfd0000 [0181.033] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e4b4510, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e4b4510, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.033] GetProcessHeap () returned 0xfd0000 [0181.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.033] GetProcessHeap () returned 0xfd0000 [0181.034] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.034] GetProcessHeap () returned 0xfd0000 [0181.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.034] GetProcessHeap () returned 0xfd0000 [0181.034] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.034] GetProcessHeap () returned 0xfd0000 [0181.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.034] GetProcessHeap () returned 0xfd0000 [0181.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.035] GetProcessHeap () returned 0xfd0000 [0181.035] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.035] GetProcessHeap () returned 0xfd0000 [0181.035] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.035] GetProcessHeap () returned 0xfd0000 [0181.035] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.036] GetProcessHeap () returned 0xfd0000 [0181.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.036] GetProcessHeap () returned 0xfd0000 [0181.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0181.036] GetProcessHeap () returned 0xfd0000 [0181.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.036] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.036] GetProcessHeap () returned 0xfd0000 [0181.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.037] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.037] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.037] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.037] GetProcessHeap () returned 0xfd0000 [0181.037] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.037] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.037] GetProcessHeap () returned 0xfd0000 [0181.037] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.037] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.037] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.037] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.037] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0181.037] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.037] GetProcessHeap () returned 0xfd0000 [0181.037] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.037] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.038] GetProcessHeap () returned 0xfd0000 [0181.038] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.038] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.038] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.038] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.038] GetProcessHeap () returned 0xfd0000 [0181.038] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.038] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.038] GetProcessHeap () returned 0xfd0000 [0181.038] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.152] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.158] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.158] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0181.161] GetProcessHeap () returned 0xfd0000 [0181.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.161] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.161] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.161] GetProcessHeap () returned 0xfd0000 [0181.161] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.162] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HoloShell_cw5n1h2txyewy", cAlternateFileName="HOLOSH~1")) returned 1 [0181.162] GetProcessHeap () returned 0xfd0000 [0181.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.165] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.165] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.165] GetProcessHeap () returned 0xfd0000 [0181.165] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.167] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.167] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.167] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.167] GetProcessHeap () returned 0xfd0000 [0181.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.167] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.167] GetProcessHeap () returned 0xfd0000 [0181.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.168] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.168] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.168] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0181.168] GetProcessHeap () returned 0xfd0000 [0181.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.168] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.168] GetProcessHeap () returned 0xfd0000 [0181.168] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.169] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.169] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.169] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0181.169] GetProcessHeap () returned 0xfd0000 [0181.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.169] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.169] GetProcessHeap () returned 0xfd0000 [0181.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.169] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.169] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.169] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.169] GetProcessHeap () returned 0xfd0000 [0181.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.169] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.169] GetProcessHeap () returned 0xfd0000 [0181.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0181.170] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.170] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.170] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0181.170] GetProcessHeap () returned 0xfd0000 [0181.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.170] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.170] GetProcessHeap () returned 0xfd0000 [0181.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.170] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.170] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.170] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.170] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0181.171] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0181.171] GetProcessHeap () returned 0xfd0000 [0181.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.171] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.171] GetProcessHeap () returned 0xfd0000 [0181.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0181.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.171] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.171] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0181.171] GetProcessHeap () returned 0xfd0000 [0181.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.171] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.171] GetProcessHeap () returned 0xfd0000 [0181.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.172] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.172] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.172] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.172] GetProcessHeap () returned 0xfd0000 [0181.172] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.172] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.172] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.172] GetProcessHeap () returned 0xfd0000 [0181.172] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.172] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3DB")) returned 1 [0181.172] GetProcessHeap () returned 0xfd0000 [0181.172] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.174] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.174] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30cf4720, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.174] GetProcessHeap () returned 0xfd0000 [0181.174] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30cf4720, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.179] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30cf4720, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.179] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.179] GetProcessHeap () returned 0xfd0000 [0181.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0181.180] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.180] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0181.181] GetProcessHeap () returned 0xfd0000 [0181.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.181] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.181] GetProcessHeap () returned 0xfd0000 [0181.181] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.181] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.181] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.181] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.181] GetProcessHeap () returned 0xfd0000 [0181.181] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.181] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.181] GetProcessHeap () returned 0xfd0000 [0181.181] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.181] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.182] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.182] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.182] GetProcessHeap () returned 0xfd0000 [0181.182] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.182] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.182] GetProcessHeap () returned 0xfd0000 [0181.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.183] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.183] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.183] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.183] GetProcessHeap () returned 0xfd0000 [0181.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.183] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.183] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.183] GetProcessHeap () returned 0xfd0000 [0181.183] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.183] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.183] GetProcessHeap () returned 0xfd0000 [0181.183] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.183] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.183] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.184] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.184] GetProcessHeap () returned 0xfd0000 [0181.184] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.184] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50915689, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b882e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50915689, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.184] GetProcessHeap () returned 0xfd0000 [0181.184] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50915689, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b882e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50915689, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.185] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50915689, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b882e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50915689, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.185] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50915689, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b882e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50915689, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.185] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.185] GetProcessHeap () returned 0xfd0000 [0181.185] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.185] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b8f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.185] GetProcessHeap () returned 0xfd0000 [0181.185] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b8f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.186] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b8f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.186] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b8f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.186] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.186] GetProcessHeap () returned 0xfd0000 [0181.186] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.186] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b960c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.186] GetProcessHeap () returned 0xfd0000 [0181.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b960c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.186] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b960c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.187] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b960c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.187] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.187] GetProcessHeap () returned 0xfd0000 [0181.187] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.187] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5093b894, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.187] GetProcessHeap () returned 0xfd0000 [0181.187] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5093b894, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.188] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5093b894, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.188] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x509d4298, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.188] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5093b894, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.189] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92e33fd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x92e33fd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x92e33fd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0181.189] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92e33fd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x92e33fd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x92e33fd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0181.189] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92e33fd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x92e33fd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x92e33fd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0181.189] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.190] GetProcessHeap () returned 0xfd0000 [0181.190] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.190] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120fb2e2, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x120fb2e2, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.190] GetProcessHeap () returned 0xfd0000 [0181.190] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120fb2e2, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x120fb2e2, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0181.191] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120fb2e2, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x120fb2e2, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.191] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120fb2e2, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x120fb2e2, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.191] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0181.191] GetProcessHeap () returned 0xfd0000 [0181.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.191] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.191] GetProcessHeap () returned 0xfd0000 [0181.191] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.191] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.191] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.191] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.191] GetProcessHeap () returned 0xfd0000 [0181.191] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.191] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.192] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.192] GetProcessHeap () returned 0xfd0000 [0181.192] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.193] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1 [0181.193] GetProcessHeap () returned 0xfd0000 [0181.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.194] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.194] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6420df31, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x30fa3191, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30fa3191, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.194] GetProcessHeap () returned 0xfd0000 [0181.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6420df31, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x30fa3191, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30fa3191, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.196] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6420df31, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x30fa3191, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30fa3191, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.196] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4427, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.196] GetProcessHeap () returned 0xfd0000 [0181.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4427, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.197] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4427, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.197] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4427, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.197] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.197] GetProcessHeap () returned 0xfd0000 [0181.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.197] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4fbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.198] GetProcessHeap () returned 0xfd0000 [0181.198] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4fbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.198] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4fbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.198] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4fbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.199] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.199] GetProcessHeap () returned 0xfd0000 [0181.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.199] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad5c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.199] GetProcessHeap () returned 0xfd0000 [0181.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad5c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.199] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad5c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.200] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad5c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.200] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.200] GetProcessHeap () returned 0xfd0000 [0181.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.200] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.200] GetProcessHeap () returned 0xfd0000 [0181.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.494] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.494] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.494] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.494] GetProcessHeap () returned 0xfd0000 [0181.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.495] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6578, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x64234147, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.495] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.495] GetProcessHeap () returned 0xfd0000 [0181.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.495] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6eef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.495] GetProcessHeap () returned 0xfd0000 [0181.495] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6eef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.495] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6eef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.496] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6eef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.496] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.499] GetProcessHeap () returned 0xfd0000 [0181.499] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.499] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a937435, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad762a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a937435, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.499] GetProcessHeap () returned 0xfd0000 [0181.499] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a937435, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad762a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a937435, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.500] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a937435, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad762a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a937435, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.500] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a937435, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad762a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a937435, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.500] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.500] GetProcessHeap () returned 0xfd0000 [0181.500] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.500] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad7ee5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a89eb27, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.500] GetProcessHeap () returned 0xfd0000 [0181.500] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad7ee5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a89eb27, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.501] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad7ee5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a89eb27, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.501] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad7ee5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a89eb27, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.501] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0181.501] GetProcessHeap () returned 0xfd0000 [0181.501] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.501] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8c4d57, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad883d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a8c4d57, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.501] GetProcessHeap () returned 0xfd0000 [0181.501] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8c4d57, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad883d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a8c4d57, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.502] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8c4d57, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad883d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a8c4d57, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.502] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8c4d57, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad883d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a8c4d57, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.502] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.502] GetProcessHeap () returned 0xfd0000 [0181.502] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.502] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.502] GetProcessHeap () returned 0xfd0000 [0181.502] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.512] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.512] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4a95d68a, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.512] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd759da94, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.512] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6453c428, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6453c428, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6453c428, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0181.512] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6453c428, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6453c428, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6453c428, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0181.512] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6453c428, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6453c428, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6453c428, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0181.513] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0181.513] GetProcessHeap () returned 0xfd0000 [0181.513] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.513] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd411e595, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd411e595, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.513] GetProcessHeap () returned 0xfd0000 [0181.513] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd411e595, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd411e595, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.514] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd411e595, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd411e595, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.514] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd411e595, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd411e595, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.514] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.514] GetProcessHeap () returned 0xfd0000 [0181.514] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.514] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.514] GetProcessHeap () returned 0xfd0000 [0181.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.514] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.514] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.514] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.514] GetProcessHeap () returned 0xfd0000 [0181.514] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.514] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.515] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0181.515] GetProcessHeap () returned 0xfd0000 [0181.515] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.516] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1 [0181.516] GetProcessHeap () returned 0xfd0000 [0181.516] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.534] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.534] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.534] GetProcessHeap () returned 0xfd0000 [0181.534] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.537] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.537] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.537] GetProcessHeap () returned 0xfd0000 [0181.537] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0181.538] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.538] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0181.538] GetProcessHeap () returned 0xfd0000 [0181.538] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.538] GetProcessHeap () returned 0xfd0000 [0181.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0181.539] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.539] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0181.539] GetProcessHeap () returned 0xfd0000 [0181.539] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.539] GetProcessHeap () returned 0xfd0000 [0181.539] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.539] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.539] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.540] GetProcessHeap () returned 0xfd0000 [0181.540] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.540] GetProcessHeap () returned 0xfd0000 [0181.540] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.540] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.540] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.540] GetProcessHeap () returned 0xfd0000 [0181.540] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1eb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62879dc0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.540] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.540] GetProcessHeap () returned 0xfd0000 [0181.540] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.540] GetProcessHeap () returned 0xfd0000 [0181.540] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.541] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.541] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.541] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0181.541] GetProcessHeap () returned 0xfd0000 [0181.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.541] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.541] GetProcessHeap () returned 0xfd0000 [0181.541] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.572] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.572] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.572] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.572] GetProcessHeap () returned 0xfd0000 [0181.572] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.572] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.572] GetProcessHeap () returned 0xfd0000 [0181.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.573] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.573] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.573] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0181.573] GetProcessHeap () returned 0xfd0000 [0181.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.573] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.573] GetProcessHeap () returned 0xfd0000 [0181.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.574] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.574] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.574] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.574] GetProcessHeap () returned 0xfd0000 [0181.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.574] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.574] GetProcessHeap () returned 0xfd0000 [0181.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.576] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6282d938, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7b21061, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd759da94, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd759da94, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd759da94, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd759da94, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd759da94, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd759da94, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd759da94, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd759da94, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd759da94, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0181.577] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.577] GetProcessHeap () returned 0xfd0000 [0181.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.577] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.577] GetProcessHeap () returned 0xfd0000 [0181.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0181.578] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.578] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.578] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0181.578] GetProcessHeap () returned 0xfd0000 [0181.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.578] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.578] GetProcessHeap () returned 0xfd0000 [0181.578] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0181.578] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.578] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.578] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0181.579] GetProcessHeap () returned 0xfd0000 [0181.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.579] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.579] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.579] GetProcessHeap () returned 0xfd0000 [0181.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.580] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XAM")) returned 1 [0181.580] GetProcessHeap () returned 0xfd0000 [0181.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0181.581] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.581] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.581] GetProcessHeap () returned 0xfd0000 [0181.581] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.673] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.673] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.673] GetProcessHeap () returned 0xfd0000 [0181.673] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.673] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.673] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.673] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.673] GetProcessHeap () returned 0xfd0000 [0181.673] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.673] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.674] GetProcessHeap () returned 0xfd0000 [0181.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0181.674] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.674] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.675] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0181.675] GetProcessHeap () returned 0xfd0000 [0181.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.675] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.675] GetProcessHeap () returned 0xfd0000 [0181.675] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.675] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.675] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.675] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.675] GetProcessHeap () returned 0xfd0000 [0181.675] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.675] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.675] GetProcessHeap () returned 0xfd0000 [0181.675] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.676] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.676] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.676] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.676] GetProcessHeap () returned 0xfd0000 [0181.676] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.676] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.676] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.676] GetProcessHeap () returned 0xfd0000 [0181.676] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.676] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 0 [0181.676] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0181.676] GetProcessHeap () returned 0xfd0000 [0181.676] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.677] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.APP")) returned 1 [0181.678] GetProcessHeap () returned 0xfd0000 [0181.678] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.755] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.755] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31572d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31572d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.755] GetProcessHeap () returned 0xfd0000 [0181.755] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31572d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31572d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.758] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31572d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31572d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.759] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6bd50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.759] GetProcessHeap () returned 0xfd0000 [0181.759] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6bd50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.760] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6bd50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.760] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6bd50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.760] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0181.760] GetProcessHeap () returned 0xfd0000 [0181.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.760] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6c8aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.760] GetProcessHeap () returned 0xfd0000 [0181.760] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6c8aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.761] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6c8aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.761] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6c8aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.761] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.761] GetProcessHeap () returned 0xfd0000 [0181.761] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.761] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d227, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.761] GetProcessHeap () returned 0xfd0000 [0181.761] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d227, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.761] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d227, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.761] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d227, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d0c1c24, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.762] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.762] GetProcessHeap () returned 0xfd0000 [0181.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.762] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.762] GetProcessHeap () returned 0xfd0000 [0181.762] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.762] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.762] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.762] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0181.762] GetProcessHeap () returned 0xfd0000 [0181.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.762] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6d9f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d09b9ce, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.762] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.762] GetProcessHeap () returned 0xfd0000 [0181.762] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.762] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e222, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.763] GetProcessHeap () returned 0xfd0000 [0181.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e222, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.763] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e222, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.763] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e222, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.763] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.763] GetProcessHeap () returned 0xfd0000 [0181.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.763] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e9b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.763] GetProcessHeap () returned 0xfd0000 [0181.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e9b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.764] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e9b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.764] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e9b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.764] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.764] GetProcessHeap () returned 0xfd0000 [0181.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.764] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6f1e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cf90959, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.764] GetProcessHeap () returned 0xfd0000 [0181.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6f1e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cf90959, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.764] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6f1e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cf90959, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.764] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6f1e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cf90959, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.764] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.764] GetProcessHeap () returned 0xfd0000 [0181.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.765] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6fc14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.765] GetProcessHeap () returned 0xfd0000 [0181.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6fc14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0181.765] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6fc14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.765] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6fc14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.765] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0181.765] GetProcessHeap () returned 0xfd0000 [0181.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.765] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.766] GetProcessHeap () returned 0xfd0000 [0181.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.767] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.767] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x4d04f565, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.767] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.767] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9055b337, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9055b337, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x9055b337, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0181.767] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9055b337, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9055b337, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x9055b337, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0181.768] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9055b337, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9055b337, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x9055b337, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0181.768] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0181.768] GetProcessHeap () returned 0xfd0000 [0181.768] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.768] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafb82b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.768] GetProcessHeap () returned 0xfd0000 [0181.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafb82b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.769] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafb82b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.769] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafb82b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.769] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0181.769] GetProcessHeap () returned 0xfd0000 [0181.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.770] GetProcessHeap () returned 0xfd0000 [0181.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.770] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.770] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.770] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0181.770] GetProcessHeap () returned 0xfd0000 [0181.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.770] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.770] GetProcessHeap () returned 0xfd0000 [0181.770] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.771] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.BIN")) returned 1 [0181.772] GetProcessHeap () returned 0xfd0000 [0181.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0181.774] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.774] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31821783, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31821783, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.774] GetProcessHeap () returned 0xfd0000 [0181.774] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31821783, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31821783, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0181.776] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31821783, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31821783, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.776] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff15f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.776] GetProcessHeap () returned 0xfd0000 [0181.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff15f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.777] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff15f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.777] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff15f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.778] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.778] GetProcessHeap () returned 0xfd0000 [0181.778] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.778] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b150b51, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff19dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b150b51, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.778] GetProcessHeap () returned 0xfd0000 [0181.778] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b150b51, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff19dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b150b51, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.778] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b150b51, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff19dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b150b51, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.778] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b150b51, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff19dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b150b51, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.778] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.783] GetProcessHeap () returned 0xfd0000 [0181.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.783] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff1da3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.783] GetProcessHeap () returned 0xfd0000 [0181.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff1da3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.783] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff1da3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.783] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff1da3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.783] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.784] GetProcessHeap () returned 0xfd0000 [0181.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.784] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff24d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.784] GetProcessHeap () returned 0xfd0000 [0181.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff24d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.784] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff24d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b12a8ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.784] GetProcessHeap () returned 0xfd0000 [0181.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.784] GetProcessHeap () returned 0xfd0000 [0181.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.784] GetProcessHeap () returned 0xfd0000 [0181.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0b81eb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff29c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b0b81eb, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.785] GetProcessHeap () returned 0xfd0000 [0181.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.785] GetProcessHeap () returned 0xfd0000 [0181.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff2e34, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.786] GetProcessHeap () returned 0xfd0000 [0181.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.786] GetProcessHeap () returned 0xfd0000 [0181.786] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff32b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.787] GetProcessHeap () returned 0xfd0000 [0181.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.787] GetProcessHeap () returned 0xfd0000 [0181.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff36d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.787] GetProcessHeap () returned 0xfd0000 [0181.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.787] GetProcessHeap () returned 0xfd0000 [0181.787] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0181.791] GetProcessHeap () returned 0xfd0000 [0181.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.791] GetProcessHeap () returned 0xfd0000 [0181.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89dadb, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0181.794] GetProcessHeap () returned 0xfd0000 [0181.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.794] GetProcessHeap () returned 0xfd0000 [0181.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca1c28a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.794] GetProcessHeap () returned 0xfd0000 [0181.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.794] GetProcessHeap () returned 0xfd0000 [0181.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.795] GetProcessHeap () returned 0xfd0000 [0181.795] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xa0d44ca, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.797] GetProcessHeap () returned 0xfd0000 [0181.797] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31ad021b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31ad021b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0181.801] GetProcessHeap () returned 0xfd0000 [0181.801] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca20d3de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.802] GetProcessHeap () returned 0xfd0000 [0181.802] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.802] GetProcessHeap () returned 0xfd0000 [0181.918] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca20dd83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.919] GetProcessHeap () returned 0xfd0000 [0181.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.919] GetProcessHeap () returned 0xfd0000 [0181.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca20e795, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.919] GetProcessHeap () returned 0xfd0000 [0181.919] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.919] GetProcessHeap () returned 0xfd0000 [0181.919] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca266ba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x497af639, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.920] GetProcessHeap () returned 0xfd0000 [0181.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.921] GetProcessHeap () returned 0xfd0000 [0181.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.921] GetProcessHeap () returned 0xfd0000 [0181.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4973cf32, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca268344, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4973cf32, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.921] GetProcessHeap () returned 0xfd0000 [0181.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.922] GetProcessHeap () returned 0xfd0000 [0181.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca268bb4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.922] GetProcessHeap () returned 0xfd0000 [0181.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.922] GetProcessHeap () returned 0xfd0000 [0181.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca26947a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.922] GetProcessHeap () returned 0xfd0000 [0181.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.922] GetProcessHeap () returned 0xfd0000 [0181.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca269b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.923] GetProcessHeap () returned 0xfd0000 [0181.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.923] GetProcessHeap () returned 0xfd0000 [0181.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.926] GetProcessHeap () returned 0xfd0000 [0181.926] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.926] GetProcessHeap () returned 0xfd0000 [0181.926] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d1ab98, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x9d1ab98, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x9d1ab98, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0181.927] GetProcessHeap () returned 0xfd0000 [0181.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.927] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.927] GetProcessHeap () returned 0xfd0000 [0181.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.928] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.928] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.928] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.928] GetProcessHeap () returned 0xfd0000 [0181.928] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.928] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.928] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.928] GetProcessHeap () returned 0xfd0000 [0181.928] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.929] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.BIN")) returned 1 [0181.929] GetProcessHeap () returned 0xfd0000 [0181.929] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0181.932] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.932] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x45323b1a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31d0c581, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31d0c581, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.932] GetProcessHeap () returned 0xfd0000 [0181.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x45323b1a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31d0c581, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31d0c581, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.935] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x45323b1a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31d0c581, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31d0c581, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.935] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca385f25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.935] GetProcessHeap () returned 0xfd0000 [0181.935] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca385f25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.936] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca385f25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.936] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca385f25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.936] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.936] GetProcessHeap () returned 0xfd0000 [0181.936] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.936] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3864a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.936] GetProcessHeap () returned 0xfd0000 [0181.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3864a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.937] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3864a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.937] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3864a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.937] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.937] GetProcessHeap () returned 0xfd0000 [0181.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.937] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38699f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.938] GetProcessHeap () returned 0xfd0000 [0181.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38699f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.938] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38699f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.938] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38699f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.938] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.938] GetProcessHeap () returned 0xfd0000 [0181.938] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.938] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.938] GetProcessHeap () returned 0xfd0000 [0181.938] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.938] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.938] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.938] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0181.939] GetProcessHeap () returned 0xfd0000 [0181.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.939] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45349d8f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca386f77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45349d8f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.939] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.939] GetProcessHeap () returned 0xfd0000 [0181.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.939] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38763a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.939] GetProcessHeap () returned 0xfd0000 [0181.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38763a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.939] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38763a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.939] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38763a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.939] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.939] GetProcessHeap () returned 0xfd0000 [0181.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.939] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca387c66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.939] GetProcessHeap () returned 0xfd0000 [0181.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca387c66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca387c66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.940] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca387c66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.940] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.940] GetProcessHeap () returned 0xfd0000 [0181.940] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.940] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38822f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.940] GetProcessHeap () returned 0xfd0000 [0181.940] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38822f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.941] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38822f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.941] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38822f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.941] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.941] GetProcessHeap () returned 0xfd0000 [0181.941] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.941] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca388810, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.941] GetProcessHeap () returned 0xfd0000 [0181.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca388810, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0181.942] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca388810, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.942] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca388810, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.942] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0181.942] GetProcessHeap () returned 0xfd0000 [0181.942] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.942] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.942] GetProcessHeap () returned 0xfd0000 [0181.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0181.945] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x452d76b7, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45159ed1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8dd15e50, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8dd15e50, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8dd15e50, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8dd15e50, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8dd15e50, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8dd15e50, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8dd15e50, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8dd15e50, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8dd15e50, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0181.945] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0181.946] GetProcessHeap () returned 0xfd0000 [0181.946] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.946] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556dcf4, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.946] GetProcessHeap () returned 0xfd0000 [0181.946] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556dcf4, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.947] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556dcf4, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.947] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556dcf4, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.947] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.947] GetProcessHeap () returned 0xfd0000 [0181.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.947] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.947] GetProcessHeap () returned 0xfd0000 [0181.947] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0181.947] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.947] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.947] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0181.947] GetProcessHeap () returned 0xfd0000 [0181.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.947] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.947] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0181.947] GetProcessHeap () returned 0xfd0000 [0181.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0181.949] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.BIN")) returned 1 [0181.949] GetProcessHeap () returned 0xfd0000 [0181.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0181.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0181.951] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.951] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42facab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x320074c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x320074c2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0181.951] GetProcessHeap () returned 0xfd0000 [0181.951] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42facab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x320074c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x320074c2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0181.954] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42facab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x320074c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x320074c2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.954] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4649fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0181.954] GetProcessHeap () returned 0xfd0000 [0181.954] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4649fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0181.955] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4649fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.955] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4649fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.955] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0181.955] GetProcessHeap () returned 0xfd0000 [0181.955] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.955] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465360, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0181.955] GetProcessHeap () returned 0xfd0000 [0181.955] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465360, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.956] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465360, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.956] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465360, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.956] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.956] GetProcessHeap () returned 0xfd0000 [0181.956] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.956] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465811, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0181.956] GetProcessHeap () returned 0xfd0000 [0181.956] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465811, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.957] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465811, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.957] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca465811, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.957] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.957] GetProcessHeap () returned 0xfd0000 [0181.957] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.957] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0181.957] GetProcessHeap () returned 0xfd0000 [0181.957] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0181.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0181.962] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.962] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0181.962] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0181.962] GetProcessHeap () returned 0xfd0000 [0181.962] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0181.962] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c0048, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0181.962] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0181.962] GetProcessHeap () returned 0xfd0000 [0181.962] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0181.963] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c15c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.963] GetProcessHeap () returned 0xfd0000 [0181.963] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0181.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c15c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.012] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c15c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.012] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c15c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.012] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.012] GetProcessHeap () returned 0xfd0000 [0182.012] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.012] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c21f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.012] GetProcessHeap () returned 0xfd0000 [0182.012] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c21f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.012] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c21f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.012] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c21f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.012] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.013] GetProcessHeap () returned 0xfd0000 [0182.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.013] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c2a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.013] GetProcessHeap () returned 0xfd0000 [0182.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c2a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.013] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c2a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.013] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c2a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.013] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.013] GetProcessHeap () returned 0xfd0000 [0182.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.013] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c321d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.013] GetProcessHeap () returned 0xfd0000 [0182.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c321d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.024] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c321d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.024] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c321d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.024] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.024] GetProcessHeap () returned 0xfd0000 [0182.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.024] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428f80b8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.024] GetProcessHeap () returned 0xfd0000 [0182.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428f80b8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428f80b8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x42f3a393, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe603213b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xe603213b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xb7a9027b, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xb7a9027b, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xb7a9027b, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xb7a9027b, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xb7a9027b, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xb7a9027b, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.026] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xb7a9027b, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xb7a9027b, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xb7a9027b, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.026] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.027] GetProcessHeap () returned 0xfd0000 [0182.027] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.027] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f21db7, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x2f21db7, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2f21db7, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.027] GetProcessHeap () returned 0xfd0000 [0182.027] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f21db7, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x2f21db7, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2f21db7, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.031] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f21db7, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x2f21db7, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2f21db7, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.032] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f21db7, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x2f21db7, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2f21db7, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.032] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0182.032] GetProcessHeap () returned 0xfd0000 [0182.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.032] GetProcessHeap () returned 0xfd0000 [0182.032] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.032] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.032] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.032] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.032] GetProcessHeap () returned 0xfd0000 [0182.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.032] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.032] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.032] GetProcessHeap () returned 0xfd0000 [0182.032] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.034] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1 [0182.044] GetProcessHeap () returned 0xfd0000 [0182.044] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.058] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.058] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x66e5ce0c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3221d58d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3221d58d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.058] GetProcessHeap () returned 0xfd0000 [0182.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x66e5ce0c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3221d58d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3221d58d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.066] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x66e5ce0c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3221d58d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3221d58d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.067] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a3ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.067] GetProcessHeap () returned 0xfd0000 [0182.067] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a3ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.069] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a3ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.069] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a3ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.069] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.069] GetProcessHeap () returned 0xfd0000 [0182.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.069] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a44b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.069] GetProcessHeap () returned 0xfd0000 [0182.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a44b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.070] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a44b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.070] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a44b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.070] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.070] GetProcessHeap () returned 0xfd0000 [0182.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.070] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a4b13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.070] GetProcessHeap () returned 0xfd0000 [0182.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a4b13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.070] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a4b13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.070] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x66ea929e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a4b13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66ea929e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.070] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.071] GetProcessHeap () returned 0xfd0000 [0182.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.071] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.071] GetProcessHeap () returned 0xfd0000 [0182.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.071] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.071] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.071] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.071] GetProcessHeap () returned 0xfd0000 [0182.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.071] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66e830be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5253, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66e830be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.071] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.071] GetProcessHeap () returned 0xfd0000 [0182.071] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.071] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5ad5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.071] GetProcessHeap () returned 0xfd0000 [0182.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5ad5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.072] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5ad5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.072] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5ad5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.072] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.072] GetProcessHeap () returned 0xfd0000 [0182.072] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.072] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a60fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.072] GetProcessHeap () returned 0xfd0000 [0182.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a60fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.074] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a60fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.074] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a60fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.074] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.074] GetProcessHeap () returned 0xfd0000 [0182.074] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.074] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a66f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.074] GetProcessHeap () returned 0xfd0000 [0182.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a66f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.076] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a66f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.076] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a66f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.076] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.076] GetProcessHeap () returned 0xfd0000 [0182.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.076] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a6cdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.076] GetProcessHeap () returned 0xfd0000 [0182.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a6cdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.076] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a6cdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.076] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a6cdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.076] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.077] GetProcessHeap () returned 0xfd0000 [0182.077] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.077] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.077] GetProcessHeap () returned 0xfd0000 [0182.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.079] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x66d9e251, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd81af838, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd7f26fed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd7f26fed, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd7f26fed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd7f26fed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd7f26fed, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd7f26fed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd7f26fed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd7f26fed, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd7f26fed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.079] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.080] GetProcessHeap () returned 0xfd0000 [0182.080] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.080] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d0704ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.080] GetProcessHeap () returned 0xfd0000 [0182.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d0704ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0182.080] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d0704ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.080] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d0704ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.080] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0182.080] GetProcessHeap () returned 0xfd0000 [0182.080] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.080] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.081] GetProcessHeap () returned 0xfd0000 [0182.081] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.081] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.081] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.081] GetProcessHeap () returned 0xfd0000 [0182.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.081] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.081] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.081] GetProcessHeap () returned 0xfd0000 [0182.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.083] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.COM")) returned 1 [0182.083] GetProcessHeap () returned 0xfd0000 [0182.083] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.085] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.085] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e08c85a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x323c0f2b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x323c0f2b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.085] GetProcessHeap () returned 0xfd0000 [0182.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e08c85a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x323c0f2b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x323c0f2b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.088] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e08c85a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x323c0f2b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x323c0f2b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.088] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cf480, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.088] GetProcessHeap () returned 0xfd0000 [0182.088] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cf480, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.089] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cf480, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.089] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cf480, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.089] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.089] GetProcessHeap () returned 0xfd0000 [0182.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.089] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cffdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.089] GetProcessHeap () returned 0xfd0000 [0182.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cffdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.090] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cffdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.090] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6cffdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.090] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.090] GetProcessHeap () returned 0xfd0000 [0182.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.090] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d0dee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.090] GetProcessHeap () returned 0xfd0000 [0182.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d0dee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.090] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d0dee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.090] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d0dee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.090] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.090] GetProcessHeap () returned 0xfd0000 [0182.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.090] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.090] GetProcessHeap () returned 0xfd0000 [0182.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0182.091] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.091] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.091] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0182.091] GetProcessHeap () returned 0xfd0000 [0182.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.091] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0b2ab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d16e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e0b2ab2, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.091] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.091] GetProcessHeap () returned 0xfd0000 [0182.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.091] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.193] GetProcessHeap () returned 0xfd0000 [0182.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.194] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.194] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.194] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.194] GetProcessHeap () returned 0xfd0000 [0182.194] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.194] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.194] GetProcessHeap () returned 0xfd0000 [0182.194] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.194] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.194] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45c1491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c1491b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xc7b8c94, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsBackgroundTaskLog.etl", cAlternateFileName="CALLSB~1.ETL")) returned 1 [0182.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5429a336, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5429a336, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x90a59ea9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsBackgroundTaskLog.last.etl", cAlternateFileName="CALLSB~2.ETL")) returned 1 [0182.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5429a336, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5429a336, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x90a59ea9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CallsBackgroundTaskLog.last.etl", cAlternateFileName="CALLSB~2.ETL")) returned 0 [0182.195] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.195] GetProcessHeap () returned 0xfd0000 [0182.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.195] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.195] GetProcessHeap () returned 0xfd0000 [0182.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.195] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.195] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.195] GetProcessHeap () returned 0xfd0000 [0182.195] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.195] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.195] GetProcessHeap () returned 0xfd0000 [0182.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.196] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.196] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.196] GetProcessHeap () returned 0xfd0000 [0182.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.196] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.197] GetProcessHeap () returned 0xfd0000 [0182.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.198] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.198] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3e040428, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.198] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc82b533, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x550c2349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.198] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x45ff45a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45ff45a0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x45ff45a0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.198] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x45ff45a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45ff45a0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x45ff45a0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.199] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x45ff45a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45ff45a0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x45ff45a0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.199] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.199] GetProcessHeap () returned 0xfd0000 [0182.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.199] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3e4ab, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xf3e4ab, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xf3e4ab, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.199] GetProcessHeap () returned 0xfd0000 [0182.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3e4ab, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xf3e4ab, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xf3e4ab, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.200] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3e4ab, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xf3e4ab, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xf3e4ab, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.200] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3e4ab, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xf3e4ab, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xf3e4ab, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.200] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.200] GetProcessHeap () returned 0xfd0000 [0182.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.200] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.201] GetProcessHeap () returned 0xfd0000 [0182.201] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.201] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.201] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.201] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.201] GetProcessHeap () returned 0xfd0000 [0182.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.201] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.201] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.201] GetProcessHeap () returned 0xfd0000 [0182.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.202] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.CON")) returned 1 [0182.202] GetProcessHeap () returned 0xfd0000 [0182.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.205] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.205] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ab2580c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x325b0df7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x325b0df7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.205] GetProcessHeap () returned 0xfd0000 [0182.205] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ab2580c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x325b0df7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x325b0df7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.208] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ab2580c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x325b0df7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x325b0df7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.208] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d1fb6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.208] GetProcessHeap () returned 0xfd0000 [0182.208] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d1fb6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.209] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d1fb6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.209] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d1fb6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.209] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.209] GetProcessHeap () returned 0xfd0000 [0182.209] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.209] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d27c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.209] GetProcessHeap () returned 0xfd0000 [0182.209] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d27c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0182.210] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d27c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.210] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d27c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.210] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0182.210] GetProcessHeap () returned 0xfd0000 [0182.210] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.210] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d31f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.210] GetProcessHeap () returned 0xfd0000 [0182.210] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d31f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.210] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d31f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.210] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d31f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.210] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.210] GetProcessHeap () returned 0xfd0000 [0182.210] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.210] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.210] GetProcessHeap () returned 0xfd0000 [0182.211] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.211] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.211] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.211] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.211] GetProcessHeap () returned 0xfd0000 [0182.211] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.211] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab4ba5c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d39c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3ab4ba5c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.211] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0182.211] GetProcessHeap () returned 0xfd0000 [0182.211] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.211] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d40cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.211] GetProcessHeap () returned 0xfd0000 [0182.211] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d40cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.211] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d40cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.212] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d40cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.212] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.212] GetProcessHeap () returned 0xfd0000 [0182.212] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.212] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d43eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aa1a750, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.212] GetProcessHeap () returned 0xfd0000 [0182.212] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d43eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aa1a750, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.213] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d43eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aa1a750, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.213] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d43eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aa1a750, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.213] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.213] GetProcessHeap () returned 0xfd0000 [0182.213] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.213] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.213] GetProcessHeap () returned 0xfd0000 [0182.213] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.214] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.214] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.214] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.214] GetProcessHeap () returned 0xfd0000 [0182.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.214] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4d6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.214] GetProcessHeap () returned 0xfd0000 [0182.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4d6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.214] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4d6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.214] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4d6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.214] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.214] GetProcessHeap () returned 0xfd0000 [0182.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.215] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.215] GetProcessHeap () returned 0xfd0000 [0182.215] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.217] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.217] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3aad9349, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.217] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.217] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x868db057, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x868db057, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x868db057, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.217] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x868db057, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x868db057, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x868db057, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.217] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x868db057, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x868db057, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x868db057, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.217] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.218] GetProcessHeap () returned 0xfd0000 [0182.218] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.218] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffafa43f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffafa43f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.218] GetProcessHeap () returned 0xfd0000 [0182.218] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffafa43f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffafa43f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0182.219] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffafa43f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffafa43f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.219] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffafa43f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffafa43f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.219] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0182.219] GetProcessHeap () returned 0xfd0000 [0182.219] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.219] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.219] GetProcessHeap () returned 0xfd0000 [0182.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.219] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.219] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.219] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0182.220] GetProcessHeap () returned 0xfd0000 [0182.220] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.220] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.220] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.220] GetProcessHeap () returned 0xfd0000 [0182.220] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.221] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CredDialogHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CRE")) returned 1 [0182.246] GetProcessHeap () returned 0xfd0000 [0182.246] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.249] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.249] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.249] GetProcessHeap () returned 0xfd0000 [0182.249] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.252] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.252] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.252] GetProcessHeap () returned 0xfd0000 [0182.252] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.253] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.253] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.253] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.253] GetProcessHeap () returned 0xfd0000 [0182.253] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.253] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.253] GetProcessHeap () returned 0xfd0000 [0182.253] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.254] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.254] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.254] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.254] GetProcessHeap () returned 0xfd0000 [0182.254] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.254] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.254] GetProcessHeap () returned 0xfd0000 [0182.254] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.254] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.254] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x76821433, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.254] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0182.255] GetProcessHeap () returned 0xfd0000 [0182.255] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.255] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.255] GetProcessHeap () returned 0xfd0000 [0182.255] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.255] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.255] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.255] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.256] GetProcessHeap () returned 0xfd0000 [0182.256] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.256] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.256] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.256] GetProcessHeap () returned 0xfd0000 [0182.256] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.256] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.256] GetProcessHeap () returned 0xfd0000 [0182.256] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0182.256] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.256] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.256] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0182.256] GetProcessHeap () returned 0xfd0000 [0182.256] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.256] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.257] GetProcessHeap () returned 0xfd0000 [0182.257] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0182.345] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.346] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.353] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0182.353] GetProcessHeap () returned 0xfd0000 [0182.353] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.353] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.365] GetProcessHeap () returned 0xfd0000 [0182.365] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0182.373] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.376] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.376] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0182.376] GetProcessHeap () returned 0xfd0000 [0182.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.376] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.376] GetProcessHeap () returned 0xfd0000 [0182.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0182.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.377] GetProcessHeap () returned 0xfd0000 [0182.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.377] GetProcessHeap () returned 0xfd0000 [0182.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.377] GetProcessHeap () returned 0xfd0000 [0182.377] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.377] GetProcessHeap () returned 0xfd0000 [0182.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.378] GetProcessHeap () returned 0xfd0000 [0182.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.378] GetProcessHeap () returned 0xfd0000 [0182.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.378] GetProcessHeap () returned 0xfd0000 [0182.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.378] GetProcessHeap () returned 0xfd0000 [0182.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.381] GetProcessHeap () returned 0xfd0000 [0182.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.384] GetProcessHeap () returned 0xfd0000 [0182.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.387] GetProcessHeap () returned 0xfd0000 [0182.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.387] GetProcessHeap () returned 0xfd0000 [0182.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.388] GetProcessHeap () returned 0xfd0000 [0182.388] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.388] GetProcessHeap () returned 0xfd0000 [0182.388] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.388] GetProcessHeap () returned 0xfd0000 [0182.388] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.388] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.388] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.389] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.389] GetProcessHeap () returned 0xfd0000 [0182.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.389] GetProcessHeap () returned 0xfd0000 [0182.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.389] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.389] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.389] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.389] GetProcessHeap () returned 0xfd0000 [0182.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.389] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.389] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.389] GetProcessHeap () returned 0xfd0000 [0182.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.389] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.389] GetProcessHeap () returned 0xfd0000 [0182.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.390] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.390] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.390] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.391] GetProcessHeap () returned 0xfd0000 [0182.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.391] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.391] GetProcessHeap () returned 0xfd0000 [0182.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.391] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.391] GetProcessHeap () returned 0xfd0000 [0182.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.391] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.391] GetProcessHeap () returned 0xfd0000 [0182.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.391] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.392] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.392] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.392] GetProcessHeap () returned 0xfd0000 [0182.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.392] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.392] GetProcessHeap () returned 0xfd0000 [0182.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.392] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.392] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.392] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.392] GetProcessHeap () returned 0xfd0000 [0182.392] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.392] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.392] GetProcessHeap () returned 0xfd0000 [0182.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.393] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.393] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.393] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.393] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0182.393] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.393] GetProcessHeap () returned 0xfd0000 [0182.393] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.393] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.393] GetProcessHeap () returned 0xfd0000 [0182.393] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.393] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.393] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.393] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.393] GetProcessHeap () returned 0xfd0000 [0182.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.394] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.394] GetProcessHeap () returned 0xfd0000 [0182.394] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.394] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.394] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.394] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.394] GetProcessHeap () returned 0xfd0000 [0182.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.394] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.394] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.394] GetProcessHeap () returned 0xfd0000 [0182.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.396] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.GET")) returned 1 [0182.396] GetProcessHeap () returned 0xfd0000 [0182.396] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0182.398] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38951974, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3281324d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3281324d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.398] GetProcessHeap () returned 0xfd0000 [0182.398] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38951974, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3281324d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3281324d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0182.400] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38951974, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3281324d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3281324d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.400] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa72db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.400] GetProcessHeap () returned 0xfd0000 [0182.400] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa72db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.408] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa72db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.408] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa72db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.408] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.408] GetProcessHeap () returned 0xfd0000 [0182.408] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.408] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa731c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.408] GetProcessHeap () returned 0xfd0000 [0182.408] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa731c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.409] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa731c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.409] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa731c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.409] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.409] GetProcessHeap () returned 0xfd0000 [0182.409] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.409] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.409] GetProcessHeap () returned 0xfd0000 [0182.409] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.410] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.410] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.410] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.410] GetProcessHeap () returned 0xfd0000 [0182.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.410] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.410] GetProcessHeap () returned 0xfd0000 [0182.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.410] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.410] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.410] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.410] GetProcessHeap () returned 0xfd0000 [0182.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.410] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38977bdf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa73a8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38977bdf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.410] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0182.410] GetProcessHeap () returned 0xfd0000 [0182.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.410] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74099, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.410] GetProcessHeap () returned 0xfd0000 [0182.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74099, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.411] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74099, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.411] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74099, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.411] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.411] GetProcessHeap () returned 0xfd0000 [0182.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa746ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.411] GetProcessHeap () returned 0xfd0000 [0182.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa746ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.413] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa746ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.413] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa746ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.414] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.414] GetProcessHeap () returned 0xfd0000 [0182.414] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.414] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74ddb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x388df267, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.414] GetProcessHeap () returned 0xfd0000 [0182.414] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74ddb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x388df267, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.414] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74ddb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x388df267, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.414] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74ddb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x388df267, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.414] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.414] GetProcessHeap () returned 0xfd0000 [0182.414] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.414] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa75343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.414] GetProcessHeap () returned 0xfd0000 [0182.414] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa75343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.415] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa75343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.415] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa75343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.415] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.415] GetProcessHeap () returned 0xfd0000 [0182.415] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.415] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.415] GetProcessHeap () returned 0xfd0000 [0182.415] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3890844a, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbc583fcd, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xbc583fcd, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xbc583fcd, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbc583fcd, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xbc583fcd, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xbc583fcd, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.417] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbc583fcd, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xbc583fcd, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xbc583fcd, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.417] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.418] GetProcessHeap () returned 0xfd0000 [0182.418] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.418] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67825a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd67825a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.418] GetProcessHeap () returned 0xfd0000 [0182.418] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67825a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd67825a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.419] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67825a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd67825a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.419] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67825a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd67825a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.419] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.419] GetProcessHeap () returned 0xfd0000 [0182.419] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.419] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.419] GetProcessHeap () returned 0xfd0000 [0182.419] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.419] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.419] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.419] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.419] GetProcessHeap () returned 0xfd0000 [0182.419] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.419] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.419] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0182.419] GetProcessHeap () returned 0xfd0000 [0182.419] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.421] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1 [0182.421] GetProcessHeap () returned 0xfd0000 [0182.421] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.466] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.466] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x695b3be8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x32a294bc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32a294bc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.466] GetProcessHeap () returned 0xfd0000 [0182.466] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x695b3be8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x32a294bc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32a294bc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.469] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x695b3be8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x32a294bc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32a294bc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.469] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafcd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.469] GetProcessHeap () returned 0xfd0000 [0182.469] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafcd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.470] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafcd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.470] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafcd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.470] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.470] GetProcessHeap () returned 0xfd0000 [0182.470] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.470] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd21d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.470] GetProcessHeap () returned 0xfd0000 [0182.470] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd21d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.471] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd21d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.471] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd21d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.471] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.471] GetProcessHeap () returned 0xfd0000 [0182.471] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.471] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd7c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.471] GetProcessHeap () returned 0xfd0000 [0182.471] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd7c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.471] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd7c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.471] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcaafd7c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.471] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.471] GetProcessHeap () returned 0xfd0000 [0182.471] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.471] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.472] GetProcessHeap () returned 0xfd0000 [0182.472] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.472] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.472] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.472] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.473] GetProcessHeap () returned 0xfd0000 [0182.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.473] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696262c9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4dc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x696262c9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.473] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.473] GetProcessHeap () returned 0xfd0000 [0182.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.473] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4e926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.473] GetProcessHeap () returned 0xfd0000 [0182.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4e926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.473] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4e926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.473] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4e926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.473] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.473] GetProcessHeap () returned 0xfd0000 [0182.473] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.473] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f07a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.473] GetProcessHeap () returned 0xfd0000 [0182.473] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f07a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.474] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f07a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.474] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f07a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.474] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.474] GetProcessHeap () returned 0xfd0000 [0182.474] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.474] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f626, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.474] GetProcessHeap () returned 0xfd0000 [0182.474] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f626, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.475] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f626, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.475] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f626, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.475] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.475] GetProcessHeap () returned 0xfd0000 [0182.475] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.475] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4fd13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.475] GetProcessHeap () returned 0xfd0000 [0182.475] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4fd13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.475] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4fd13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.475] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4fd13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.476] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.476] GetProcessHeap () returned 0xfd0000 [0182.476] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.476] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.476] GetProcessHeap () returned 0xfd0000 [0182.476] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0182.478] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x69567730, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd81af838, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd81af838, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd81af838, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd81af838, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd81af838, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd81af838, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd81af838, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd81af838, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd81af838, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.478] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0182.479] GetProcessHeap () returned 0xfd0000 [0182.479] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.479] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b2c8ffc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b2c8ffc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.479] GetProcessHeap () returned 0xfd0000 [0182.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b2c8ffc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b2c8ffc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.479] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b2c8ffc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b2c8ffc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.479] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b2c8ffc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b2c8ffc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.479] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.479] GetProcessHeap () returned 0xfd0000 [0182.479] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.479] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.479] GetProcessHeap () returned 0xfd0000 [0182.479] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.480] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.480] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.480] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.480] GetProcessHeap () returned 0xfd0000 [0182.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.480] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.480] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.480] GetProcessHeap () returned 0xfd0000 [0182.480] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.481] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MES")) returned 1 [0182.481] GetProcessHeap () returned 0xfd0000 [0182.481] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.483] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.483] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32d4a634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32d4a634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.483] GetProcessHeap () returned 0xfd0000 [0182.483] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32d4a634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32d4a634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.486] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32d4a634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32d4a634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.486] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x43eeca81, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.486] GetProcessHeap () returned 0xfd0000 [0182.486] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x43eeca81, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.488] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x43eeca81, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.488] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3086106f, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3086106f, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x3086106f, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0182.488] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3086106f, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3086106f, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x3086106f, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0182.488] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.489] GetProcessHeap () returned 0xfd0000 [0182.489] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.489] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac7208c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3092ed16, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.489] GetProcessHeap () returned 0xfd0000 [0182.489] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac7208c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3092ed16, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.489] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac7208c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3092ed16, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.489] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3092ed16, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3092ed16, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x3092ed16, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0182.489] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3092ed16, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3092ed16, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x3092ed16, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0182.489] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.489] GetProcessHeap () returned 0xfd0000 [0182.489] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.489] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac72437, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35314053, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.490] GetProcessHeap () returned 0xfd0000 [0182.490] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac72437, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35314053, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.490] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac72437, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35314053, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.490] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x35314053, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcac72437, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35314053, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.490] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.490] GetProcessHeap () returned 0xfd0000 [0182.490] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.490] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcac7286c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0182.490] GetProcessHeap () returned 0xfd0000 [0182.490] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\Microsoft\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcac7286c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.491] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcac7286c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.492] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f119eb, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0182.492] GetProcessHeap () returned 0xfd0000 [0182.492] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f119eb, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.492] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f119eb, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.492] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x966e0be5, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x966e0be5, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0182.492] GetProcessHeap () returned 0xfd0000 [0182.492] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x966e0be5, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x966e0be5, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.495] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x966e0be5, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x966e0be5, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.495] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x966e0be5, ftCreationTime.dwHighDateTime=0x1d3273c, ftLastAccessTime.dwLowDateTime=0x966e0be5, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x967bb4cd, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f119eb, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F", cAlternateFileName="6BADA8~1")) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 0 [0182.496] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.497] GetProcessHeap () returned 0xfd0000 [0182.497] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.497] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x963d1e0c, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x963d1e0c, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0182.497] GetProcessHeap () returned 0xfd0000 [0182.497] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x963d1e0c, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x963d1e0c, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.498] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x963d1e0c, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x963d1e0c, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.498] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x963d1e0c, ftCreationTime.dwHighDateTime=0x1d3273c, ftLastAccessTime.dwLowDateTime=0x963d1e0c, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0xba4e7fcd, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0182.498] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0182.499] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f119eb, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F", cAlternateFileName="6BADA8~1")) returned 1 [0182.499] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x9a767de4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0182.499] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 1 [0182.499] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x30f37b51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f37b51, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f37b51, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 0 [0182.499] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.499] GetProcessHeap () returned 0xfd0000 [0182.499] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.500] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x963d1e0c, ftLastAccessTime.dwHighDateTime=0x1d3273c, ftLastWriteTime.dwLowDateTime=0x963d1e0c, ftLastWriteTime.dwHighDateTime=0x1d3273c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0182.500] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.500] GetProcessHeap () returned 0xfd0000 [0182.500] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.500] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30f119eb, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x30f119eb, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x30f119eb, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 0 [0182.500] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.500] GetProcessHeap () returned 0xfd0000 [0182.500] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.502] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.502] GetProcessHeap () returned 0xfd0000 [0182.502] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.524] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.530] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.536] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.536] GetProcessHeap () returned 0xfd0000 [0182.536] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.536] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad79be4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352eddd8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.536] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.542] GetProcessHeap () returned 0xfd0000 [0182.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad7a98d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.542] GetProcessHeap () returned 0xfd0000 [0182.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad7a98d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.549] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad7a98d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.549] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad7a98d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.549] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.549] GetProcessHeap () returned 0xfd0000 [0182.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.549] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x432e06f1, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x432e06f1, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.549] GetProcessHeap () returned 0xfd0000 [0182.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x432e06f1, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x432e06f1, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.553] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x432e06f1, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x432e06f1, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.553] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41db781c, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x432ba5e8, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x432e06f1, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HasRegisteredAsDefaultApp.setting", cAlternateFileName="HASREG~1.SET")) returned 1 [0182.553] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44901b03, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x44901b03, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf175751c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingBackgroundTaskLog.etl", cAlternateFileName="MESSAG~1.ETL")) returned 1 [0182.553] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefaf88c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xfefaf88c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x68f09cc9, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessagingBackgroundTaskLog.last.etl", cAlternateFileName="MESSAG~2.ETL")) returned 1 [0182.553] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x477cbe66, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x47c90a09, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x47d29387, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivateTransportId.setting", cAlternateFileName="PRIVAT~1.SET")) returned 1 [0182.554] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c28409, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51c28409, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51c28409, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransportIdList.setting", cAlternateFileName="TRANSP~1.SET")) returned 1 [0182.554] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c28409, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51c28409, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51c28409, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransportIdList.setting", cAlternateFileName="TRANSP~1.SET")) returned 0 [0182.554] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.554] GetProcessHeap () returned 0xfd0000 [0182.554] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.554] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32e556a9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32e556a9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.554] GetProcessHeap () returned 0xfd0000 [0182.555] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32e556a9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32e556a9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.556] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32e556a9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32e556a9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.556] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d98576a, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcaddc3d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2da533b7, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataRv", cAlternateFileName="")) returned 1 [0182.556] GetProcessHeap () returned 0xfd0000 [0182.557] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d98576a, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcaddc3d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2da533b7, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.558] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d98576a, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcaddc3d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2da533b7, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.558] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9dbaf3, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x2d9dbaf3, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x74d6b97e, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x200818, dwReserved0=0x0, dwReserved1=0x0, cFileName="offline-storage-ecs.data", cAlternateFileName="OFFLIN~1.DAT")) returned 1 [0182.558] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da533b7, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x2da533b7, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x50cbc548, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x300c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="offline-storage.data", cAlternateFileName="OFFLIN~2.DAT")) returned 1 [0182.558] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da533b7, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x2da533b7, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x50cbc548, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x300c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="offline-storage.data", cAlternateFileName="OFFLIN~2.DAT")) returned 0 [0182.558] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.558] GetProcessHeap () returned 0xfd0000 [0182.558] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.558] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x277eae51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcaddcc98, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x278838e6, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0182.558] GetProcessHeap () returned 0xfd0000 [0182.558] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\RootTools\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x277eae51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcaddcc98, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x278838e6, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.560] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x277eae51, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcaddcc98, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x278838e6, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278838e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x278838e6, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x27b0c132, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278838e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x278838e6, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x27b0c132, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0 [0182.560] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.560] GetProcessHeap () returned 0xfd0000 [0182.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29bd4d56, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x29bd4d56, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x29bd4d56, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shared.lck", cAlternateFileName="")) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b24e25c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x2b24e25c, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x32771c19, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="shared.xml", cAlternateFileName="")) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6f4e10, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3e6f4e10, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x8b48dd70, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.log", cAlternateFileName="")) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6f4e10, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3e6f4e10, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x8b48dd70, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.log", cAlternateFileName="")) returned 0 [0182.560] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.560] GetProcessHeap () returned 0xfd0000 [0182.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.560] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaddd25d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3517066f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.560] GetProcessHeap () returned 0xfd0000 [0182.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaddd25d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3517066f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.561] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaddd25d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3517066f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.561] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaddd25d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3517066f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.561] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0182.561] GetProcessHeap () returned 0xfd0000 [0182.561] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.561] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.561] GetProcessHeap () returned 0xfd0000 [0182.561] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.563] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.563] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3525549b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.563] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x351bcb14, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf24bf83c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xf24bf83c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.563] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x42fd2d0e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x42fd2d0e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x42fd2d0e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0182.563] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x42ff8fca, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x42ff8fca, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x42ff8fca, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0182.563] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x42ff8fca, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x42ff8fca, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x42ff8fca, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0182.563] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.564] GetProcessHeap () returned 0xfd0000 [0182.564] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.564] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.564] GetProcessHeap () returned 0xfd0000 [0182.564] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.564] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.564] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.565] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.565] GetProcessHeap () returned 0xfd0000 [0182.565] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.565] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.565] GetProcessHeap () returned 0xfd0000 [0182.565] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.565] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.565] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.565] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0182.565] GetProcessHeap () returned 0xfd0000 [0182.565] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.565] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.565] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.565] GetProcessHeap () returned 0xfd0000 [0182.565] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.567] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe", cAlternateFileName="MIC2FD~1.MIC")) returned 1 [0182.567] GetProcessHeap () returned 0xfd0000 [0182.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.569] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.569] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.569] GetProcessHeap () returned 0xfd0000 [0182.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.572] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.572] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.572] GetProcessHeap () returned 0xfd0000 [0182.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.573] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.573] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.573] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.573] GetProcessHeap () returned 0xfd0000 [0182.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.573] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.573] GetProcessHeap () returned 0xfd0000 [0182.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.573] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.573] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.573] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0182.573] GetProcessHeap () returned 0xfd0000 [0182.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.573] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0182.573] GetProcessHeap () returned 0xfd0000 [0182.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0182.574] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.574] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.574] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0182.574] GetProcessHeap () returned 0xfd0000 [0182.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.574] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0182.574] GetProcessHeap () returned 0xfd0000 [0182.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.574] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.574] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.574] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.574] GetProcessHeap () returned 0xfd0000 [0182.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.574] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0182.574] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.574] GetProcessHeap () returned 0xfd0000 [0182.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.575] GetProcessHeap () returned 0xfd0000 [0182.575] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.575] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.575] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.575] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.575] GetProcessHeap () returned 0xfd0000 [0182.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.576] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.576] GetProcessHeap () returned 0xfd0000 [0182.576] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.576] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.576] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.576] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0182.576] GetProcessHeap () returned 0xfd0000 [0182.576] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.576] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.576] GetProcessHeap () returned 0xfd0000 [0182.576] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.576] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.576] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.576] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.576] GetProcessHeap () returned 0xfd0000 [0182.576] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.576] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.577] GetProcessHeap () returned 0xfd0000 [0182.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.577] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.577] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0182.577] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0182.577] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0182.577] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0182.577] GetProcessHeap () returned 0xfd0000 [0182.577] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.577] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.577] GetProcessHeap () returned 0xfd0000 [0182.577] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.577] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.577] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.577] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0182.578] GetProcessHeap () returned 0xfd0000 [0182.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.578] GetProcessHeap () returned 0xfd0000 [0182.578] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.578] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.578] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.578] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0182.578] GetProcessHeap () returned 0xfd0000 [0182.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0182.578] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.578] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0182.578] GetProcessHeap () returned 0xfd0000 [0182.578] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0182.579] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1 [0182.579] GetProcessHeap () returned 0xfd0000 [0182.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0182.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0182.582] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.582] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0182.582] GetProcessHeap () returned 0xfd0000 [0182.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0182.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0182.584] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.584] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcafaf3be, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x124e2b77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#!001", cAlternateFileName="")) returned 1 [0182.584] GetProcessHeap () returned 0xfd0000 [0182.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcafaf3be, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x124e2b77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0182.647] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcafaf3be, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x124e2b77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.648] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0182.648] GetProcessHeap () returned 0xfd0000 [0182.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.654] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.654] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0182.655] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0182.655] GetProcessHeap () returned 0xfd0000 [0182.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.655] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0182.655] GetProcessHeap () returned 0xfd0000 [0182.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetCookies\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0182.655] GetProcessHeap () returned 0xfd0000 [0182.655] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.655] GetProcessHeap () returned 0xfd0000 [0182.655] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetHistory\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.656] GetProcessHeap () returned 0xfd0000 [0182.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.656] GetProcessHeap () returned 0xfd0000 [0182.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5775632, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.656] GetProcessHeap () returned 0xfd0000 [0182.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5775632, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0182.661] GetProcessHeap () returned 0xfd0000 [0182.661] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.661] GetProcessHeap () returned 0xfd0000 [0182.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.662] GetProcessHeap () returned 0xfd0000 [0182.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x124e2b77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x124e2b77, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12fc3730, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.665] GetProcessHeap () returned 0xfd0000 [0182.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x12fc3730, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12fc3730, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12fc3730, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.667] GetProcessHeap () returned 0xfd0000 [0182.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0182.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x12fc3730, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf8ac62e7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x8cd6d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.676] GetProcessHeap () returned 0xfd0000 [0182.676] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0182.676] GetProcessHeap () returned 0xfd0000 [0182.676] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0182.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x12fc3730, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8cd6d4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x8cd6d4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0182.683] GetProcessHeap () returned 0xfd0000 [0182.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0182.683] GetProcessHeap () returned 0xfd0000 [0182.683] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.683] GetProcessHeap () returned 0xfd0000 [0182.683] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Microsoft\\Windows\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x124e2b77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x124e2b77, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x124e2b77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0182.684] GetProcessHeap () returned 0xfd0000 [0182.684] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.684] GetProcessHeap () returned 0xfd0000 [0182.684] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.686] GetProcessHeap () returned 0xfd0000 [0182.686] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9d06badc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d06badc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0182.688] GetProcessHeap () returned 0xfd0000 [0182.688] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x43eeca81, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.689] GetProcessHeap () returned 0xfd0000 [0182.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.690] GetProcessHeap () returned 0xfd0000 [0182.690] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbe330de9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbe330de9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.694] GetProcessHeap () returned 0xfd0000 [0182.694] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.694] GetProcessHeap () returned 0xfd0000 [0182.694] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1047542f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.695] GetProcessHeap () returned 0xfd0000 [0182.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.695] GetProcessHeap () returned 0xfd0000 [0182.695] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.695] GetProcessHeap () returned 0xfd0000 [0182.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.695] GetProcessHeap () returned 0xfd0000 [0182.695] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.695] GetProcessHeap () returned 0xfd0000 [0182.695] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.695] GetProcessHeap () returned 0xfd0000 [0182.695] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9d06badc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d075730, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.696] GetProcessHeap () returned 0xfd0000 [0182.696] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.696] GetProcessHeap () returned 0xfd0000 [0182.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12508dd9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.697] GetProcessHeap () returned 0xfd0000 [0182.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0182.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9367da0c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9367da0c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.697] GetProcessHeap () returned 0xfd0000 [0182.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0182.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12555287, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12555287, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12555287, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.698] GetProcessHeap () returned 0xfd0000 [0182.698] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\LIZT0JBF\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12555287, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12555287, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12555287, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.698] GetProcessHeap () returned 0xfd0000 [0182.698] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.698] GetProcessHeap () returned 0xfd0000 [0182.698] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0182.698] GetProcessHeap () returned 0xfd0000 [0182.698] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0182.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\DOMStore\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdd03ea98, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdd06839e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdd06839e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.700] GetProcessHeap () returned 0xfd0000 [0182.700] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\DOMStore\\1SZDY5N2\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdd067005, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf65af0bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xf65af0bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0182.701] GetProcessHeap () returned 0xfd0000 [0182.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.701] GetProcessHeap () returned 0xfd0000 [0182.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\DOMStore\\BX0MAZEI\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdd065c7c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe66027c3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe66027c3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0182.701] GetProcessHeap () returned 0xfd0000 [0182.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.701] GetProcessHeap () returned 0xfd0000 [0182.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\DOMStore\\JGMDXSN8\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdd067005, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd3de1dfa, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd3de1dfa, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0182.702] GetProcessHeap () returned 0xfd0000 [0182.702] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.702] GetProcessHeap () returned 0xfd0000 [0182.702] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\DOMStore\\N2SFDMZ3\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdd065c7c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9a45a84f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9a45a84f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.705] GetProcessHeap () returned 0xfd0000 [0182.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.706] GetProcessHeap () returned 0xfd0000 [0182.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0182.706] GetProcessHeap () returned 0xfd0000 [0182.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0182.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\EmieSiteList\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9367da0c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9367da0c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.706] GetProcessHeap () returned 0xfd0000 [0182.706] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0182.706] GetProcessHeap () returned 0xfd0000 [0182.706] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0182.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\EmieUserList\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9367da0c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x936a3c7f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x936a3c7f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0182.707] GetProcessHeap () returned 0xfd0000 [0182.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0182.707] GetProcessHeap () returned 0xfd0000 [0182.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0182.708] GetProcessHeap () returned 0xfd0000 [0182.708] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.709] GetProcessHeap () returned 0xfd0000 [0182.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.709] GetProcessHeap () returned 0xfd0000 [0182.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\Temp\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.710] GetProcessHeap () returned 0xfd0000 [0182.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.710] GetProcessHeap () returned 0xfd0000 [0182.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\TempState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xfa79661, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.710] GetProcessHeap () returned 0xfd0000 [0182.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.710] GetProcessHeap () returned 0xfd0000 [0182.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0182.712] GetProcessHeap () returned 0xfd0000 [0182.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0182.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcc74b84d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1318d398, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0182.788] GetProcessHeap () returned 0xfd0000 [0182.788] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12803cff, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0182.789] GetProcessHeap () returned 0xfd0000 [0182.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.789] GetProcessHeap () returned 0xfd0000 [0182.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetCookies\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12803cff, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.789] GetProcessHeap () returned 0xfd0000 [0182.789] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.789] GetProcessHeap () returned 0xfd0000 [0182.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetHistory\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12803cff, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.790] GetProcessHeap () returned 0xfd0000 [0182.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.790] GetProcessHeap () returned 0xfd0000 [0182.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\LocalState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcc74e357, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x12803cff, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.829] GetProcessHeap () returned 0xfd0000 [0182.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.829] GetProcessHeap () returned 0xfd0000 [0182.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\Microsoft\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x1318d398, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f359339, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f359339, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.830] GetProcessHeap () returned 0xfd0000 [0182.830] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x1318d398, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1318d398, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1318d398, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.832] GetProcessHeap () returned 0xfd0000 [0182.832] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0182.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x1318d398, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31e3117a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x32177899, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.834] GetProcessHeap () returned 0xfd0000 [0182.834] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0182.834] GetProcessHeap () returned 0xfd0000 [0182.834] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0182.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x1318d398, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32177899, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x32177899, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0182.837] GetProcessHeap () returned 0xfd0000 [0182.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0182.837] GetProcessHeap () returned 0xfd0000 [0182.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.837] GetProcessHeap () returned 0xfd0000 [0182.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\Microsoft\\Windows\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3f359339, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3f359339, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f359339, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.838] GetProcessHeap () returned 0xfd0000 [0182.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.838] GetProcessHeap () returned 0xfd0000 [0182.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0182.840] GetProcessHeap () returned 0xfd0000 [0182.840] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0182.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd7afa00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0182.843] GetProcessHeap () returned 0xfd0000 [0182.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd27f87, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfdd27f87, ftLastWriteTime.dwHighDateTime=0x1d39f5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.845] GetProcessHeap () returned 0xfd0000 [0182.845] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.845] GetProcessHeap () returned 0xfd0000 [0182.845] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33b04a57, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x33b70a8f, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.848] GetProcessHeap () returned 0xfd0000 [0182.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.848] GetProcessHeap () returned 0xfd0000 [0182.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1e5c710a, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0182.848] GetProcessHeap () returned 0xfd0000 [0182.848] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.848] GetProcessHeap () returned 0xfd0000 [0182.848] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.912] GetProcessHeap () returned 0xfd0000 [0182.912] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.912] GetProcessHeap () returned 0xfd0000 [0182.912] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.912] GetProcessHeap () returned 0xfd0000 [0182.913] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.913] GetProcessHeap () returned 0xfd0000 [0182.913] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd7afa00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.913] GetProcessHeap () returned 0xfd0000 [0182.913] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0182.913] GetProcessHeap () returned 0xfd0000 [0182.913] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0182.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f7729b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0182.914] GetProcessHeap () returned 0xfd0000 [0182.914] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0182.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f48a671, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f48a671, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0182.914] GetProcessHeap () returned 0xfd0000 [0182.914] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0182.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f9d52c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0182.915] GetProcessHeap () returned 0xfd0000 [0182.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12f9d52c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30e480bc, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x35ed1eeb, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.915] GetProcessHeap () returned 0xfd0000 [0182.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0182.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\1\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd5bc6e6b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd706a1c4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd70716e4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.932] GetProcessHeap () returned 0xfd0000 [0182.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0182.932] GetProcessHeap () returned 0xfd0000 [0182.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0182.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\VCC8D03D\\3\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x30e480bc, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x3240007a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x324262a8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.935] GetProcessHeap () returned 0xfd0000 [0182.935] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0182.935] GetProcessHeap () returned 0xfd0000 [0182.935] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.935] GetProcessHeap () returned 0xfd0000 [0182.935] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0182.936] GetProcessHeap () returned 0xfd0000 [0182.936] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0182.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd31f6e8b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd4e91dab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd4e91dab, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0182.998] GetProcessHeap () returned 0xfd0000 [0182.998] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\34PQH7NK\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd4e91dab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd4eb8004, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd4eb8004, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0182.999] GetProcessHeap () returned 0xfd0000 [0182.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0182.999] GetProcessHeap () returned 0xfd0000 [0182.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0182.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\HWEDH2TP\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd4d9bf19, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccc7d671, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd4d9bf19, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.000] GetProcessHeap () returned 0xfd0000 [0183.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0183.000] GetProcessHeap () returned 0xfd0000 [0183.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0183.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\NSV9PRJU\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd4e91dab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd51e7bef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd51e7bef, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.000] GetProcessHeap () returned 0xfd0000 [0183.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0183.000] GetProcessHeap () returned 0xfd0000 [0183.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0183.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\UDXR7IEB\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd33f542c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccc7e75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd33f542c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.001] GetProcessHeap () returned 0xfd0000 [0183.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0183.001] GetProcessHeap () returned 0xfd0000 [0183.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.001] GetProcessHeap () returned 0xfd0000 [0183.001] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0183.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\EmieSiteList\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f4643b5, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3f48a671, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f48a671, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0183.002] GetProcessHeap () returned 0xfd0000 [0183.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.002] GetProcessHeap () returned 0xfd0000 [0183.002] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0183.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\EmieUserList\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f48a671, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3f48a671, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f48a671, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.002] GetProcessHeap () returned 0xfd0000 [0183.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.002] GetProcessHeap () returned 0xfd0000 [0183.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.088] GetProcessHeap () returned 0xfd0000 [0183.088] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.089] GetProcessHeap () returned 0xfd0000 [0183.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.090] GetProcessHeap () returned 0xfd0000 [0183.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\Temp\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12803cff, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0183.090] GetProcessHeap () returned 0xfd0000 [0183.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.090] GetProcessHeap () returned 0xfd0000 [0183.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\TempState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12829f55, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12829f55, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12829f55, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.090] GetProcessHeap () returned 0xfd0000 [0183.090] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.091] GetProcessHeap () returned 0xfd0000 [0183.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.092] GetProcessHeap () returned 0xfd0000 [0183.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x926657f3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.094] GetProcessHeap () returned 0xfd0000 [0183.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.095] GetProcessHeap () returned 0xfd0000 [0183.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.095] GetProcessHeap () returned 0xfd0000 [0183.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCookies\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.095] GetProcessHeap () returned 0xfd0000 [0183.095] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.095] GetProcessHeap () returned 0xfd0000 [0183.095] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetHistory\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.096] GetProcessHeap () returned 0xfd0000 [0183.096] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.096] GetProcessHeap () returned 0xfd0000 [0183.096] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\LocalState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.096] GetProcessHeap () returned 0xfd0000 [0183.096] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.096] GetProcessHeap () returned 0xfd0000 [0183.096] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\Temp\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926657f3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x926657f3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x926657f3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.096] GetProcessHeap () returned 0xfd0000 [0183.096] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.097] GetProcessHeap () returned 0xfd0000 [0183.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\TempState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9268ba69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.097] GetProcessHeap () returned 0xfd0000 [0183.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.097] GetProcessHeap () returned 0xfd0000 [0183.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.097] GetProcessHeap () returned 0xfd0000 [0183.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9af0a0eb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.099] GetProcessHeap () returned 0xfd0000 [0183.099] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.099] GetProcessHeap () returned 0xfd0000 [0183.099] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.100] GetProcessHeap () returned 0xfd0000 [0183.100] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCookies\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0183.100] GetProcessHeap () returned 0xfd0000 [0183.100] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.100] GetProcessHeap () returned 0xfd0000 [0183.100] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetHistory\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.100] GetProcessHeap () returned 0xfd0000 [0183.100] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.100] GetProcessHeap () returned 0xfd0000 [0183.100] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\LocalState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.101] GetProcessHeap () returned 0xfd0000 [0183.101] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.101] GetProcessHeap () returned 0xfd0000 [0183.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb220f800, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.101] GetProcessHeap () returned 0xfd0000 [0183.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9af0a0eb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.113] GetProcessHeap () returned 0xfd0000 [0183.113] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.113] GetProcessHeap () returned 0xfd0000 [0183.113] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb220f800, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.114] GetProcessHeap () returned 0xfd0000 [0183.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.114] GetProcessHeap () returned 0xfd0000 [0183.114] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb322b8d4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.114] GetProcessHeap () returned 0xfd0000 [0183.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.115] GetProcessHeap () returned 0xfd0000 [0183.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.115] GetProcessHeap () returned 0xfd0000 [0183.115] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\Temp\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.115] GetProcessHeap () returned 0xfd0000 [0183.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.115] GetProcessHeap () returned 0xfd0000 [0183.115] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\TempState\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.115] GetProcessHeap () returned 0xfd0000 [0183.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.115] GetProcessHeap () returned 0xfd0000 [0183.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.117] GetProcessHeap () returned 0xfd0000 [0183.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf6895, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.174] GetProcessHeap () returned 0xfd0000 [0183.174] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.175] GetProcessHeap () returned 0xfd0000 [0183.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf70e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.175] GetProcessHeap () returned 0xfd0000 [0183.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.175] GetProcessHeap () returned 0xfd0000 [0183.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xccdf7d9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a49a72f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0183.175] GetProcessHeap () returned 0xfd0000 [0183.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.175] GetProcessHeap () returned 0xfd0000 [0183.175] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07d8a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcce3d76e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf8d9fb88, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.176] GetProcessHeap () returned 0xfd0000 [0183.176] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xd93aa125, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd93aef57, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd93aef57, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.177] GetProcessHeap () returned 0xfd0000 [0183.177] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xd93aef57, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x313616dd, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x313616dd, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.181] GetProcessHeap () returned 0xfd0000 [0183.182] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.182] GetProcessHeap () returned 0xfd0000 [0183.182] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xd93ac83b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x313616dd, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x313616dd, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.185] GetProcessHeap () returned 0xfd0000 [0183.185] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.185] GetProcessHeap () returned 0xfd0000 [0183.185] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.185] GetProcessHeap () returned 0xfd0000 [0183.185] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf8d9fb88, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf8da70ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf8da70ab, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.185] GetProcessHeap () returned 0xfd0000 [0183.185] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf8da70ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf8dbbcd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf8dbbcd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.186] GetProcessHeap () returned 0xfd0000 [0183.186] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf8dae5e6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1febac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf8dae5e6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf8db0d05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1ff4a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf8db0d05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf8dbbcd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1ffd47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf8dbbcd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.189] GetProcessHeap () returned 0xfd0000 [0183.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.192] GetProcessHeap () returned 0xfd0000 [0183.192] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Microsoft\\Windows\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07d8a0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf07d8a0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf07d8a0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.193] GetProcessHeap () returned 0xfd0000 [0183.193] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.193] GetProcessHeap () returned 0xfd0000 [0183.193] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.193] GetProcessHeap () returned 0xfd0000 [0183.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.195] GetProcessHeap () returned 0xfd0000 [0183.195] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf988ece2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98f07b0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.196] GetProcessHeap () returned 0xfd0000 [0183.196] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.196] GetProcessHeap () returned 0xfd0000 [0183.196] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdc693c1, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfdc693c1, ftLastWriteTime.dwHighDateTime=0x1d39f5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.196] GetProcessHeap () returned 0xfd0000 [0183.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.197] GetProcessHeap () returned 0xfd0000 [0183.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd8fcbe3e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.197] GetProcessHeap () returned 0xfd0000 [0183.197] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.197] GetProcessHeap () returned 0xfd0000 [0183.197] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9889eb9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf9889eb9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf988b242, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.198] GetProcessHeap () returned 0xfd0000 [0183.198] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.199] GetProcessHeap () returned 0xfd0000 [0183.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Extensions\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.199] GetProcessHeap () returned 0xfd0000 [0183.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.199] GetProcessHeap () returned 0xfd0000 [0183.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf352567, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0183.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf352567, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.199] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.199] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0183.200] GetProcessHeap () returned 0xfd0000 [0183.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.200] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0183.200] GetProcessHeap () returned 0xfd0000 [0183.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.200] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.200] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf48383b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.200] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf48383b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.200] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.200] GetProcessHeap () returned 0xfd0000 [0183.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.200] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatUaCache", cAlternateFileName="IECOMP~2")) returned 1 [0183.200] GetProcessHeap () returned 0xfd0000 [0183.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.200] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.201] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf56864e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.201] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf56864e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.201] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.201] GetProcessHeap () returned 0xfd0000 [0183.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.201] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0183.201] GetProcessHeap () returned 0xfd0000 [0183.201] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.201] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.201] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58d8cc7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.202] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58d8cc7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.202] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.202] GetProcessHeap () returned 0xfd0000 [0183.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.202] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0183.202] GetProcessHeap () returned 0xfd0000 [0183.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0183.203] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.203] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InPrivate", cAlternateFileName="INPRIV~1")) returned 1 [0183.203] GetProcessHeap () returned 0xfd0000 [0183.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\InPrivate\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.205] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.205] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.205] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.205] GetProcessHeap () returned 0xfd0000 [0183.205] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.205] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InPrivate", cAlternateFileName="INPRIV~1")) returned 0 [0183.205] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0183.205] GetProcessHeap () returned 0xfd0000 [0183.205] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.205] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0183.205] GetProcessHeap () returned 0xfd0000 [0183.205] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.205] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.205] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0183.205] GetProcessHeap () returned 0xfd0000 [0183.205] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0183.207] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.207] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserImport", cAlternateFileName="BROWSE~1")) returned 1 [0183.207] GetProcessHeap () returned 0xfd0000 [0183.207] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\BrowserImport\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.207] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.208] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.208] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.208] GetProcessHeap () returned 0xfd0000 [0183.208] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.208] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataStore", cAlternateFileName="DATAST~1")) returned 1 [0183.208] GetProcessHeap () returned 0xfd0000 [0183.208] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.208] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.208] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0183.208] GetProcessHeap () returned 0xfd0000 [0183.208] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0183.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.210] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.210] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nouser1", cAlternateFileName="")) returned 1 [0183.210] GetProcessHeap () returned 0xfd0000 [0183.210] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0183.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.210] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.210] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2dfe57, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2dfe57, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="120712-0049", cAlternateFileName="120712~1")) returned 1 [0183.210] GetProcessHeap () returned 0xfd0000 [0183.210] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0183.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2dfe57, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2dfe57, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.210] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2dfe57, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2dfe57, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.210] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbc451ff, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xbc451ff, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBStore", cAlternateFileName="")) returned 1 [0183.211] GetProcessHeap () returned 0xfd0000 [0183.211] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0183.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbc451ff, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xbc451ff, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0183.211] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbc451ff, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xbc451ff, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.212] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3060ac, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x35e5f81d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0183.212] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3060ac, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogFiles", cAlternateFileName="")) returned 1 [0183.212] GetProcessHeap () returned 0xfd0000 [0183.212] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fc28b0 [0183.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\*", lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3060ac, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0183.213] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3060ac, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.213] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2dfe57, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x35e5f81d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0183.213] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3060ac, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3060ac, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0183.213] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3060ac, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3060ac, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0183.213] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf83d375, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0183.213] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349cf70 | out: lpFindFileData=0x349cf70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf3060ac, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf83d375, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 0 [0183.213] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0183.213] GetProcessHeap () returned 0xfd0000 [0183.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fc28b0 | out: hHeap=0xfd0000) returned 1 [0183.214] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf32c378, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf32c378, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x35e1333c, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="spartan.edb", cAlternateFileName="")) returned 1 [0183.214] SetEvent (hEvent=0x2e8) returned 1 [0183.214] ResetEvent (hEvent=0x2ec) returned 1 [0183.214] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f27c472, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x8f27c472, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x35e1333c, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="spartan.jfm", cAlternateFileName="")) returned 1 [0183.214] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f27c472, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x8f27c472, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x35e1333c, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="spartan.jfm", cAlternateFileName="")) returned 0 [0183.214] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0183.214] GetProcessHeap () returned 0xfd0000 [0183.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0183.214] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2dfe57, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbc451ff, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xbc451ff, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBStore", cAlternateFileName="")) returned 0 [0183.214] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0183.214] GetProcessHeap () returned 0xfd0000 [0183.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0183.215] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2dfe57, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2dfe57, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="120712-0049", cAlternateFileName="120712~1")) returned 0 [0183.215] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.215] GetProcessHeap () returned 0xfd0000 [0183.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0183.280] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nouser1", cAlternateFileName="")) returned 0 [0183.280] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0183.280] GetProcessHeap () returned 0xfd0000 [0183.280] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.280] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed", cAlternateFileName="")) returned 1 [0183.280] GetProcessHeap () returned 0xfd0000 [0183.280] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0183.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Indexed\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0183.281] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.281] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0183.281] GetProcessHeap () returned 0xfd0000 [0183.281] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f92898 [0183.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Indexed\\Data\\*", lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.281] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.281] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nouser1", cAlternateFileName="")) returned 1 [0183.281] GetProcessHeap () returned 0xfd0000 [0183.281] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fa28a0 [0183.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Indexed\\Data\\nouser1\\*", lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.282] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="120712-0049", cAlternateFileName="120712~1")) returned 1 [0183.282] GetProcessHeap () returned 0xfd0000 [0183.282] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3fb28a8 [0183.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Indexed\\Data\\nouser1\\120712-0049\\*", lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0183.282] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349d1f8 | out: lpFindFileData=0x349d1f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.282] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0183.282] GetProcessHeap () returned 0xfd0000 [0183.282] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fb28a8 | out: hHeap=0xfd0000) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d480 | out: lpFindFileData=0x349d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="120712-0049", cAlternateFileName="120712~1")) returned 0 [0183.282] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0183.282] GetProcessHeap () returned 0xfd0000 [0183.282] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3fa28a0 | out: hHeap=0xfd0000) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349d708 | out: lpFindFileData=0x349d708*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nouser1", cAlternateFileName="")) returned 0 [0183.283] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.283] GetProcessHeap () returned 0xfd0000 [0183.283] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f92898 | out: hHeap=0xfd0000) returned 1 [0183.284] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0183.284] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0183.284] GetProcessHeap () returned 0xfd0000 [0183.284] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.357] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed", cAlternateFileName="")) returned 0 [0183.358] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.358] GetProcessHeap () returned 0xfd0000 [0183.358] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.358] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x90681a18, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9076671b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DNTException", cAlternateFileName="DNTEXC~1")) returned 1 [0183.358] GetProcessHeap () returned 0xfd0000 [0183.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DNTException\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x90681a18, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9076671b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.358] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x90681a18, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9076671b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.358] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9076671b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.358] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9076671b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.358] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.358] GetProcessHeap () returned 0xfd0000 [0183.358] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.358] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5454404, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf546a406, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf546a406, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DomainSuggestions", cAlternateFileName="DOMAIN~1")) returned 1 [0183.358] GetProcessHeap () returned 0xfd0000 [0183.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DomainSuggestions\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5454404, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf546a406, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf546a406, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0183.359] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5454404, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf546a406, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf546a406, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.359] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf546a406, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf546a406, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5454404, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.1", cAlternateFileName="")) returned 1 [0183.359] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf546a406, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf546a406, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5454404, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.1", cAlternateFileName="")) returned 0 [0183.359] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0183.359] GetProcessHeap () returned 0xfd0000 [0183.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.359] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf77e757, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cbc4b9e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1cbc4b9e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadHistory", cAlternateFileName="DOWNLO~1")) returned 1 [0183.359] GetProcessHeap () returned 0xfd0000 [0183.360] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf77e757, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cbc4b9e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1cbc4b9e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0183.360] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf77e757, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cbc4b9e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1cbc4b9e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.360] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1cbc4b9e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x1cbc4b9e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1cbc4b9e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.360] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1cbc4b9e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x1cbc4b9e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1cbc4b9e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.360] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0183.364] GetProcessHeap () returned 0xfd0000 [0183.364] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.364] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a1f3e0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieSiteList", cAlternateFileName="EMIESI~1")) returned 1 [0183.364] GetProcessHeap () returned 0xfd0000 [0183.364] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\EmieSiteList\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a1f3e0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.365] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a1f3e0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.365] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a6b891, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.365] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a6b891, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.365] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0183.365] GetProcessHeap () returned 0xfd0000 [0183.365] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.365] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92ab7d60, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieUserList", cAlternateFileName="EMIEUS~1")) returned 1 [0183.365] GetProcessHeap () returned 0xfd0000 [0183.365] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\EmieUserList\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92ab7d60, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.365] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92ab7d60, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.365] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0183.365] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0183.366] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.366] GetProcessHeap () returned 0xfd0000 [0183.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.366] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf6272c0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf6272c0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0183.366] GetProcessHeap () returned 0xfd0000 [0183.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Favorites\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf6272c0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf6272c0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.366] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf6272c0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf6272c0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.366] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf6272c0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf6272c0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.366] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.366] GetProcessHeap () returned 0xfd0000 [0183.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.367] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImageStore", cAlternateFileName="IMAGES~1")) returned 1 [0183.367] GetProcessHeap () returned 0xfd0000 [0183.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\ImageStore\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.367] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.367] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd940bbfa, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd940bbfa, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qkxig4i", cAlternateFileName="")) returned 1 [0183.367] GetProcessHeap () returned 0xfd0000 [0183.367] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0183.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\ImageStore\\qkxig4i\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd940bbfa, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd940bbfa, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.367] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd940bbfa, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd940bbfa, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.367] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd940bbfa, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd940bbfa, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x35e85a3d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x8a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagestore.dat", cAlternateFileName="IMAGES~1.DAT")) returned 1 [0183.367] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd940bbfa, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd940bbfa, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x35e85a3d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x8a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagestore.dat", cAlternateFileName="IMAGES~1.DAT")) returned 0 [0183.367] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.367] GetProcessHeap () returned 0xfd0000 [0183.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.368] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd940bbfa, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd940bbfa, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qkxig4i", cAlternateFileName="")) returned 0 [0183.368] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0183.368] GetProcessHeap () returned 0xfd0000 [0183.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.368] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RACShare", cAlternateFileName="")) returned 1 [0183.368] GetProcessHeap () returned 0xfd0000 [0183.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\RACShare\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.368] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.368] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.368] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.368] GetProcessHeap () returned 0xfd0000 [0183.368] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.368] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf673771, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf673771, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0183.368] GetProcessHeap () returned 0xfd0000 [0183.368] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f72888 [0183.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf673771, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf673771, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.369] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf673771, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf673771, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.369] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cd570ac, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1cd570ac, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1 [0183.369] GetProcessHeap () returned 0xfd0000 [0183.369] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f82890 [0183.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\*", lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cd570ac, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1d647d3d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.371] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cd570ac, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1d647d3d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.371] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ccbe753, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x1ccbe753, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{365BAED2-D07C-490C-BE13-661B3FAC299C}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0183.372] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d647d3d, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x1d647d3d, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x342a860d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5AE568A8-494C-4FD9-B299-A5F2965C4960}.dat", cAlternateFileName="{5AE56~1.DAT")) returned 1 [0183.372] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349d990 | out: lpFindFileData=0x349d990*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d647d3d, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x1d647d3d, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x342a860d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5AE568A8-494C-4FD9-B299-A5F2965C4960}.dat", cAlternateFileName="{5AE56~1.DAT")) returned 0 [0183.372] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0183.372] GetProcessHeap () returned 0xfd0000 [0183.372] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f82890 | out: hHeap=0xfd0000) returned 1 [0183.372] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1cd570ac, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1cd570ac, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 0 [0183.373] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.373] GetProcessHeap () returned 0xfd0000 [0183.373] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f72888 | out: hHeap=0xfd0000) returned 1 [0183.373] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf673771, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf673771, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf673771, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0 [0183.373] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0183.373] GetProcessHeap () returned 0xfd0000 [0183.373] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.374] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 0 [0183.374] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.374] GetProcessHeap () returned 0xfd0000 [0183.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.375] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf2b9c81, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0183.375] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.375] GetProcessHeap () returned 0xfd0000 [0183.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.375] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0183.375] GetProcessHeap () returned 0xfd0000 [0183.375] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.375] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.375] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.375] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.375] GetProcessHeap () returned 0xfd0000 [0183.375] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.375] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0183.376] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0183.376] GetProcessHeap () returned 0xfd0000 [0183.376] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.376] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0183.376] GetProcessHeap () returned 0xfd0000 [0183.376] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.377] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.377] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0183.378] GetProcessHeap () returned 0xfd0000 [0183.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.378] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.378] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59ff7ff, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a045f9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd5a045f9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0183.378] GetProcessHeap () returned 0xfd0000 [0183.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a740c8 [0183.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59ff7ff, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a045f9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd5a045f9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.379] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59ff7ff, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a045f9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd5a045f9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.379] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5a045f9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1471e9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd1471e9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed DB", cAlternateFileName="INDEXE~1")) returned 1 [0183.379] GetProcessHeap () returned 0xfd0000 [0183.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f62880 [0183.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5a045f9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1471e9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd1471e9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.382] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5a045f9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1471e9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd1471e9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.382] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a37ac0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a37ac0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3de36b60, ftLastWriteTime.dwHighDateTime=0x1d32738, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0183.382] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a0bb4a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a0bb4a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x9f3b7cb3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0183.383] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a1f3d6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a1f3d6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd5a21ae0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0183.383] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2691b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a2691b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd5a2a3a4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0183.383] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a0bb4a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a1922b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3de36b60, ftLastWriteTime.dwHighDateTime=0x1d32738, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0183.383] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd5a53bdd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a53bdd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x9f3b7cb3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x280000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IndexedDB.edb", cAlternateFileName="INDEXE~1.EDB")) returned 1 [0183.383] SetEvent (hEvent=0x2e8) returned 1 [0183.383] ResetEvent (hEvent=0x2ec) returned 1 [0183.383] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1471e9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd1471e9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd1471e9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IndexedDB.jfm", cAlternateFileName="INDEXE~1.JFM")) returned 1 [0183.383] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1471e9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd1471e9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd1471e9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IndexedDB.jfm", cAlternateFileName="INDEXE~1.JFM")) returned 0 [0183.383] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.384] GetProcessHeap () returned 0xfd0000 [0183.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f62880 | out: hHeap=0xfd0000) returned 1 [0183.384] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5a045f9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd1471e9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd1471e9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed DB", cAlternateFileName="INDEXE~1")) returned 0 [0183.384] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.385] GetProcessHeap () returned 0xfd0000 [0183.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a740c8 | out: hHeap=0xfd0000) returned 1 [0183.385] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59ff7ff, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd5a045f9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd5a045f9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 0 [0183.385] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.385] GetProcessHeap () returned 0xfd0000 [0183.385] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.387] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd59ff7ff, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0183.387] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.387] GetProcessHeap () returned 0xfd0000 [0183.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.387] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0183.387] GetProcessHeap () returned 0xfd0000 [0183.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.389] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.389] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.389] GetProcessHeap () returned 0xfd0000 [0183.389] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.389] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0183.389] GetProcessHeap () returned 0xfd0000 [0183.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0183.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PinnedTiles", cAlternateFileName="PINNED~1")) returned 1 [0183.391] GetProcessHeap () returned 0xfd0000 [0183.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\PinnedTiles\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.394] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.394] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.394] GetProcessHeap () returned 0xfd0000 [0183.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.394] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x132e491b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PinnedTiles", cAlternateFileName="PINNED~1")) returned 0 [0183.394] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0183.394] GetProcessHeap () returned 0xfd0000 [0183.394] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0183.395] GetProcessHeap () returned 0xfd0000 [0183.395] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.395] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.395] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.395] GetProcessHeap () returned 0xfd0000 [0183.395] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0183.395] GetProcessHeap () returned 0xfd0000 [0183.395] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0183.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6a44e278, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6a44e278, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x371986aa, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x371986aa, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0183.411] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd82ba8b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd82ba8b0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd82ba8b0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0183.411] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0183.412] GetProcessHeap () returned 0xfd0000 [0183.412] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0183.412] GetProcessHeap () returned 0xfd0000 [0183.412] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0183.412] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.412] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0183.412] GetProcessHeap () returned 0xfd0000 [0183.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0183.413] GetProcessHeap () returned 0xfd0000 [0183.413] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.413] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.413] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0183.413] GetProcessHeap () returned 0xfd0000 [0183.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0183.413] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0183.413] GetProcessHeap () returned 0xfd0000 [0183.413] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0183.414] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.MIC")) returned 1 [0183.415] GetProcessHeap () returned 0xfd0000 [0183.415] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0183.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.538] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.538] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0183.538] GetProcessHeap () returned 0xfd0000 [0183.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.602] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.602] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0183.602] GetProcessHeap () returned 0xfd0000 [0183.602] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.609] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.609] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.609] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.609] GetProcessHeap () returned 0xfd0000 [0183.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.609] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0183.609] GetProcessHeap () returned 0xfd0000 [0183.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.613] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.613] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.613] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.613] GetProcessHeap () returned 0xfd0000 [0183.613] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.613] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f951f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0183.613] GetProcessHeap () returned 0xfd0000 [0183.613] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f951f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.613] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f951f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.613] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f951f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.614] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.614] GetProcessHeap () returned 0xfd0000 [0183.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.614] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0183.614] GetProcessHeap () returned 0xfd0000 [0183.614] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.614] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.614] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.614] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.614] GetProcessHeap () returned 0xfd0000 [0183.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.614] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f9a49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319c919e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0183.614] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.614] GetProcessHeap () returned 0xfd0000 [0183.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.614] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0183.614] GetProcessHeap () returned 0xfd0000 [0183.614] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.617] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.617] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.617] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.617] GetProcessHeap () returned 0xfd0000 [0183.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.617] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0183.617] GetProcessHeap () returned 0xfd0000 [0183.617] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.617] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.617] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.617] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.617] GetProcessHeap () returned 0xfd0000 [0183.617] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.617] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0183.618] GetProcessHeap () returned 0xfd0000 [0183.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.618] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.618] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.618] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.618] GetProcessHeap () returned 0xfd0000 [0183.618] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.618] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0183.618] GetProcessHeap () returned 0xfd0000 [0183.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.620] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.620] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.620] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.620] GetProcessHeap () returned 0xfd0000 [0183.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.620] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0183.621] GetProcessHeap () returned 0xfd0000 [0183.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.627] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.627] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31930880, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0183.627] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffa61aaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffa61aaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0183.627] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0183.627] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0183.627] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80ad41ac, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x80ad41ac, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x80ad41ac, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0183.627] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.628] GetProcessHeap () returned 0xfd0000 [0183.628] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.628] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0183.628] GetProcessHeap () returned 0xfd0000 [0183.628] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.634] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.634] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.634] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.634] GetProcessHeap () returned 0xfd0000 [0183.634] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.634] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0183.634] GetProcessHeap () returned 0xfd0000 [0183.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0183.634] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.635] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.635] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0183.635] GetProcessHeap () returned 0xfd0000 [0183.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.635] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0183.635] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.635] GetProcessHeap () returned 0xfd0000 [0183.635] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0183.636] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.MIC")) returned 1 [0183.636] GetProcessHeap () returned 0xfd0000 [0183.636] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0183.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.647] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.647] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0183.647] GetProcessHeap () returned 0xfd0000 [0183.647] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.761] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.761] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b7e51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0183.761] GetProcessHeap () returned 0xfd0000 [0183.761] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b7e51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0183.762] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b7e51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.762] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b7e51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.762] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0183.763] GetProcessHeap () returned 0xfd0000 [0183.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.763] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0183.763] GetProcessHeap () returned 0xfd0000 [0183.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.764] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.764] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.764] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0183.764] GetProcessHeap () returned 0xfd0000 [0183.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.764] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0183.764] GetProcessHeap () returned 0xfd0000 [0183.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0183.764] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.764] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b8e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.764] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0183.764] GetProcessHeap () returned 0xfd0000 [0183.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.764] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0183.764] GetProcessHeap () returned 0xfd0000 [0183.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0183.765] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.765] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.765] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0183.765] GetProcessHeap () returned 0xfd0000 [0183.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.765] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7b9d52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9dbf7f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0183.765] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0183.765] GetProcessHeap () returned 0xfd0000 [0183.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.765] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0183.765] GetProcessHeap () returned 0xfd0000 [0183.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0183.765] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.765] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.765] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0183.765] GetProcessHeap () returned 0xfd0000 [0183.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.765] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0183.766] GetProcessHeap () returned 0xfd0000 [0183.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.766] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.766] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.766] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0183.766] GetProcessHeap () returned 0xfd0000 [0183.766] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.766] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0183.766] GetProcessHeap () returned 0xfd0000 [0183.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.767] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.767] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.767] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.767] GetProcessHeap () returned 0xfd0000 [0183.767] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.767] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0183.767] GetProcessHeap () returned 0xfd0000 [0183.767] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0183.768] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.768] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.768] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0183.768] GetProcessHeap () returned 0xfd0000 [0183.768] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.768] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0183.768] GetProcessHeap () returned 0xfd0000 [0183.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2d9698d0, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0183.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0183.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0183.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0183.770] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7db976b3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7db976b3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7db976b3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0183.770] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.771] GetProcessHeap () returned 0xfd0000 [0183.771] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.771] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0183.771] GetProcessHeap () returned 0xfd0000 [0183.771] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.771] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.771] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.771] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0183.771] GetProcessHeap () returned 0xfd0000 [0183.771] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.771] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0183.772] GetProcessHeap () returned 0xfd0000 [0183.772] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.772] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.772] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0183.772] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0183.772] GetProcessHeap () returned 0xfd0000 [0183.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.772] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0183.772] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0183.772] GetProcessHeap () returned 0xfd0000 [0183.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0183.773] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.MIC")) returned 1 [0183.773] GetProcessHeap () returned 0xfd0000 [0183.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0183.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0183.776] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.776] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0183.776] GetProcessHeap () returned 0xfd0000 [0183.776] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.881] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.881] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0183.881] GetProcessHeap () returned 0xfd0000 [0183.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0183.882] GetProcessHeap () returned 0xfd0000 [0183.882] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.882] GetProcessHeap () returned 0xfd0000 [0183.882] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.882] GetProcessHeap () returned 0xfd0000 [0183.882] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.882] GetProcessHeap () returned 0xfd0000 [0183.882] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.883] GetProcessHeap () returned 0xfd0000 [0183.883] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.883] GetProcessHeap () returned 0xfd0000 [0183.883] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.883] GetProcessHeap () returned 0xfd0000 [0183.883] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.883] GetProcessHeap () returned 0xfd0000 [0183.883] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.883] GetProcessHeap () returned 0xfd0000 [0183.883] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0183.884] GetProcessHeap () returned 0xfd0000 [0183.884] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.884] GetProcessHeap () returned 0xfd0000 [0183.884] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.884] GetProcessHeap () returned 0xfd0000 [0183.884] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.884] GetProcessHeap () returned 0xfd0000 [0183.884] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.885] GetProcessHeap () returned 0xfd0000 [0183.885] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.885] GetProcessHeap () returned 0xfd0000 [0183.885] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.885] GetProcessHeap () returned 0xfd0000 [0183.885] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.885] GetProcessHeap () returned 0xfd0000 [0183.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0183.886] GetProcessHeap () returned 0xfd0000 [0183.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.886] GetProcessHeap () returned 0xfd0000 [0183.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.886] GetProcessHeap () returned 0xfd0000 [0183.886] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.886] GetProcessHeap () returned 0xfd0000 [0183.886] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0183.886] GetProcessHeap () returned 0xfd0000 [0183.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.887] GetProcessHeap () returned 0xfd0000 [0183.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0183.888] GetProcessHeap () returned 0xfd0000 [0183.888] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0183.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.890] GetProcessHeap () returned 0xfd0000 [0183.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.893] GetProcessHeap () returned 0xfd0000 [0183.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.893] GetProcessHeap () returned 0xfd0000 [0183.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.894] GetProcessHeap () returned 0xfd0000 [0183.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.894] GetProcessHeap () returned 0xfd0000 [0183.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.894] GetProcessHeap () returned 0xfd0000 [0183.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.895] GetProcessHeap () returned 0xfd0000 [0183.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.896] GetProcessHeap () returned 0xfd0000 [0183.896] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.896] GetProcessHeap () returned 0xfd0000 [0183.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.897] GetProcessHeap () returned 0xfd0000 [0183.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.897] GetProcessHeap () returned 0xfd0000 [0183.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.897] GetProcessHeap () returned 0xfd0000 [0183.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.898] GetProcessHeap () returned 0xfd0000 [0183.898] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.898] GetProcessHeap () returned 0xfd0000 [0183.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.898] GetProcessHeap () returned 0xfd0000 [0183.898] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0183.903] GetProcessHeap () returned 0xfd0000 [0183.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.903] GetProcessHeap () returned 0xfd0000 [0183.903] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.903] GetProcessHeap () returned 0xfd0000 [0183.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.903] GetProcessHeap () returned 0xfd0000 [0183.903] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0183.905] GetProcessHeap () returned 0xfd0000 [0183.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0183.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33b4c3b0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0183.911] GetProcessHeap () returned 0xfd0000 [0183.911] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.915] GetProcessHeap () returned 0xfd0000 [0183.915] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb12b31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.920] GetProcessHeap () returned 0xfd0000 [0183.920] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.920] GetProcessHeap () returned 0xfd0000 [0183.920] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb135d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0183.921] GetProcessHeap () returned 0xfd0000 [0183.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.921] GetProcessHeap () returned 0xfd0000 [0183.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb13e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0183.921] GetProcessHeap () returned 0xfd0000 [0183.921] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.921] GetProcessHeap () returned 0xfd0000 [0183.921] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0183.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2953e76, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2953e76, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.922] GetProcessHeap () returned 0xfd0000 [0183.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0183.922] GetProcessHeap () returned 0xfd0000 [0183.922] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.922] GetProcessHeap () returned 0xfd0000 [0183.922] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0183.923] GetProcessHeap () returned 0xfd0000 [0183.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.923] GetProcessHeap () returned 0xfd0000 [0183.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.923] GetProcessHeap () returned 0xfd0000 [0183.923] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.923] GetProcessHeap () returned 0xfd0000 [0183.923] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0183.924] GetProcessHeap () returned 0xfd0000 [0183.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.924] GetProcessHeap () returned 0xfd0000 [0183.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.924] GetProcessHeap () returned 0xfd0000 [0183.924] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.924] GetProcessHeap () returned 0xfd0000 [0183.924] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0183.927] GetProcessHeap () returned 0xfd0000 [0183.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.927] GetProcessHeap () returned 0xfd0000 [0183.927] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0183.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0183.927] GetProcessHeap () returned 0xfd0000 [0183.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0183.927] GetProcessHeap () returned 0xfd0000 [0183.927] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0183.929] GetProcessHeap () returned 0xfd0000 [0183.929] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0183.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33dfacc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.007] GetProcessHeap () returned 0xfd0000 [0184.007] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.011] GetProcessHeap () returned 0xfd0000 [0184.011] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc594d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.012] GetProcessHeap () returned 0xfd0000 [0184.012] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.012] GetProcessHeap () returned 0xfd0000 [0184.012] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5a13e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.013] GetProcessHeap () returned 0xfd0000 [0184.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.013] GetProcessHeap () returned 0xfd0000 [0184.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5aca0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.013] GetProcessHeap () returned 0xfd0000 [0184.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.013] GetProcessHeap () returned 0xfd0000 [0184.013] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c1c77, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5b47b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10c1c77, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.013] GetProcessHeap () returned 0xfd0000 [0184.013] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.014] GetProcessHeap () returned 0xfd0000 [0184.014] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.014] GetProcessHeap () returned 0xfd0000 [0184.014] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.014] GetProcessHeap () returned 0xfd0000 [0184.014] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.014] GetProcessHeap () returned 0xfd0000 [0184.014] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.015] GetProcessHeap () returned 0xfd0000 [0184.015] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.015] GetProcessHeap () returned 0xfd0000 [0184.015] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.015] GetProcessHeap () returned 0xfd0000 [0184.015] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.016] GetProcessHeap () returned 0xfd0000 [0184.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.016] GetProcessHeap () returned 0xfd0000 [0184.016] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.016] GetProcessHeap () returned 0xfd0000 [0184.016] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.019] GetProcessHeap () returned 0xfd0000 [0184.019] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.019] GetProcessHeap () returned 0xfd0000 [0184.019] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0184.019] GetProcessHeap () returned 0xfd0000 [0184.019] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.019] GetProcessHeap () returned 0xfd0000 [0184.019] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.020] GetProcessHeap () returned 0xfd0000 [0184.020] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.022] GetProcessHeap () returned 0xfd0000 [0184.022] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.024] GetProcessHeap () returned 0xfd0000 [0184.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0184.024] GetProcessHeap () returned 0xfd0000 [0184.024] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.024] GetProcessHeap () returned 0xfd0000 [0184.024] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.025] GetProcessHeap () returned 0xfd0000 [0184.025] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.025] GetProcessHeap () returned 0xfd0000 [0184.025] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.026] GetProcessHeap () returned 0xfd0000 [0184.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.026] GetProcessHeap () returned 0xfd0000 [0184.026] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.026] GetProcessHeap () returned 0xfd0000 [0184.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.026] GetProcessHeap () returned 0xfd0000 [0184.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.026] GetProcessHeap () returned 0xfd0000 [0184.026] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.027] GetProcessHeap () returned 0xfd0000 [0184.027] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34036ffb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.029] GetProcessHeap () returned 0xfd0000 [0184.029] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0184.031] GetProcessHeap () returned 0xfd0000 [0184.031] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde92403, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0184.033] GetProcessHeap () returned 0xfd0000 [0184.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.033] GetProcessHeap () returned 0xfd0000 [0184.033] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde92ed7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0184.033] GetProcessHeap () returned 0xfd0000 [0184.033] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.033] GetProcessHeap () returned 0xfd0000 [0184.033] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde937b4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.034] GetProcessHeap () returned 0xfd0000 [0184.034] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.034] GetProcessHeap () returned 0xfd0000 [0184.034] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2692a270, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde93ee6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2692a270, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.035] GetProcessHeap () returned 0xfd0000 [0184.035] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.035] GetProcessHeap () returned 0xfd0000 [0184.035] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.035] GetProcessHeap () returned 0xfd0000 [0184.035] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2686b7b5, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde948f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2686b7b5, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.036] GetProcessHeap () returned 0xfd0000 [0184.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.036] GetProcessHeap () returned 0xfd0000 [0184.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x267acaa2, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95221, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x267acaa2, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.036] GetProcessHeap () returned 0xfd0000 [0184.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.036] GetProcessHeap () returned 0xfd0000 [0184.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2673a47b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95a6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2673a47b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.036] GetProcessHeap () returned 0xfd0000 [0184.036] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.036] GetProcessHeap () returned 0xfd0000 [0184.036] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95fc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.037] GetProcessHeap () returned 0xfd0000 [0184.037] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.037] GetProcessHeap () returned 0xfd0000 [0184.037] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x267acaa2, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.039] GetProcessHeap () returned 0xfd0000 [0184.040] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.040] GetProcessHeap () returned 0xfd0000 [0184.040] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcdfaccf0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.040] GetProcessHeap () returned 0xfd0000 [0184.040] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.040] GetProcessHeap () returned 0xfd0000 [0184.040] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.041] GetProcessHeap () returned 0xfd0000 [0184.041] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34273354, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.043] GetProcessHeap () returned 0xfd0000 [0184.043] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf235e043, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34200da2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34200da2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.149] GetProcessHeap () returned 0xfd0000 [0184.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce0186f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.151] GetProcessHeap () returned 0xfd0000 [0184.151] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.151] GetProcessHeap () returned 0xfd0000 [0184.151] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce018c88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.151] GetProcessHeap () returned 0xfd0000 [0184.151] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.151] GetProcessHeap () returned 0xfd0000 [0184.151] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0184.152] GetProcessHeap () returned 0xfd0000 [0184.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.152] GetProcessHeap () returned 0xfd0000 [0184.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf238428c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019885, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf238428c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.152] GetProcessHeap () returned 0xfd0000 [0184.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.152] GetProcessHeap () returned 0xfd0000 [0184.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.152] GetProcessHeap () returned 0xfd0000 [0184.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2337e6d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019fce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2337e6d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.153] GetProcessHeap () returned 0xfd0000 [0184.153] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.153] GetProcessHeap () returned 0xfd0000 [0184.153] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf229f4ae, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01a68a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf229f4ae, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.153] GetProcessHeap () returned 0xfd0000 [0184.153] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.153] GetProcessHeap () returned 0xfd0000 [0184.153] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01abc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.154] GetProcessHeap () returned 0xfd0000 [0184.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.154] GetProcessHeap () returned 0xfd0000 [0184.154] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01b236, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.154] GetProcessHeap () returned 0xfd0000 [0184.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.154] GetProcessHeap () returned 0xfd0000 [0184.154] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf229f4ae, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.159] GetProcessHeap () returned 0xfd0000 [0184.159] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.159] GetProcessHeap () returned 0xfd0000 [0184.159] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce14611e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.160] GetProcessHeap () returned 0xfd0000 [0184.160] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.160] GetProcessHeap () returned 0xfd0000 [0184.160] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.161] GetProcessHeap () returned 0xfd0000 [0184.161] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x344af7fa, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.163] GetProcessHeap () returned 0xfd0000 [0184.163] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd54657, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x343ca99c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x343ca99c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.166] GetProcessHeap () returned 0xfd0000 [0184.166] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1af95e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.167] GetProcessHeap () returned 0xfd0000 [0184.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.167] GetProcessHeap () returned 0xfd0000 [0184.167] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b0086, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.168] GetProcessHeap () returned 0xfd0000 [0184.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.168] GetProcessHeap () returned 0xfd0000 [0184.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b08bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.169] GetProcessHeap () returned 0xfd0000 [0184.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.169] GetProcessHeap () returned 0xfd0000 [0184.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7a89a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b0fd4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7a89a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.169] GetProcessHeap () returned 0xfd0000 [0184.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.169] GetProcessHeap () returned 0xfd0000 [0184.169] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.169] GetProcessHeap () returned 0xfd0000 [0184.169] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b173a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.170] GetProcessHeap () returned 0xfd0000 [0184.170] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.170] GetProcessHeap () returned 0xfd0000 [0184.170] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b1db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.170] GetProcessHeap () returned 0xfd0000 [0184.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.171] GetProcessHeap () returned 0xfd0000 [0184.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b2577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.171] GetProcessHeap () returned 0xfd0000 [0184.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.171] GetProcessHeap () returned 0xfd0000 [0184.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b2c77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.171] GetProcessHeap () returned 0xfd0000 [0184.171] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.171] GetProcessHeap () returned 0xfd0000 [0184.171] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.178] GetProcessHeap () returned 0xfd0000 [0184.178] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.178] GetProcessHeap () returned 0xfd0000 [0184.179] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce23db47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.179] GetProcessHeap () returned 0xfd0000 [0184.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.179] GetProcessHeap () returned 0xfd0000 [0184.179] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.180] GetProcessHeap () returned 0xfd0000 [0184.180] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.279] GetProcessHeap () returned 0xfd0000 [0184.279] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0184.429] GetProcessHeap () returned 0xfd0000 [0184.429] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.508] GetProcessHeap () returned 0xfd0000 [0184.508] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.508] GetProcessHeap () returned 0xfd0000 [0184.508] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.508] GetProcessHeap () returned 0xfd0000 [0184.508] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.509] GetProcessHeap () returned 0xfd0000 [0184.509] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.509] GetProcessHeap () returned 0xfd0000 [0184.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.509] GetProcessHeap () returned 0xfd0000 [0184.509] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.509] GetProcessHeap () returned 0xfd0000 [0184.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.509] GetProcessHeap () returned 0xfd0000 [0184.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.509] GetProcessHeap () returned 0xfd0000 [0184.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.511] GetProcessHeap () returned 0xfd0000 [0184.511] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0184.511] GetProcessHeap () returned 0xfd0000 [0184.511] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.514] GetProcessHeap () returned 0xfd0000 [0184.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.515] GetProcessHeap () returned 0xfd0000 [0184.515] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.515] GetProcessHeap () returned 0xfd0000 [0184.515] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.515] GetProcessHeap () returned 0xfd0000 [0184.515] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.515] GetProcessHeap () returned 0xfd0000 [0184.515] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.516] GetProcessHeap () returned 0xfd0000 [0184.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.516] GetProcessHeap () returned 0xfd0000 [0184.516] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.516] GetProcessHeap () returned 0xfd0000 [0184.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.516] GetProcessHeap () returned 0xfd0000 [0184.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.516] GetProcessHeap () returned 0xfd0000 [0184.516] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.517] GetProcessHeap () returned 0xfd0000 [0184.517] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3509b345, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.538] GetProcessHeap () returned 0xfd0000 [0184.538] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x35028d59, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35028d59, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.541] GetProcessHeap () returned 0xfd0000 [0184.541] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e1f0a6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce397062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e1f0a6, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.542] GetProcessHeap () returned 0xfd0000 [0184.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.542] GetProcessHeap () returned 0xfd0000 [0184.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e1f0a6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce397521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e1f0a6, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e1f0a6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce3978b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e1f0a6, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce397cf1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28df8e9e, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.543] GetProcessHeap () returned 0xfd0000 [0184.543] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28d3a3d7, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce398197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28d3a3d7, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.544] GetProcessHeap () returned 0xfd0000 [0184.544] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.544] GetProcessHeap () returned 0xfd0000 [0184.544] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c555af, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce3985e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c555af, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.545] GetProcessHeap () returned 0xfd0000 [0184.545] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.545] GetProcessHeap () returned 0xfd0000 [0184.545] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28bbcae8, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce398aca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bbcae8, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.545] GetProcessHeap () returned 0xfd0000 [0184.545] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.545] GetProcessHeap () returned 0xfd0000 [0184.545] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce399062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.545] GetProcessHeap () returned 0xfd0000 [0184.546] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.546] GetProcessHeap () returned 0xfd0000 [0184.546] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c555af, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.548] GetProcessHeap () returned 0xfd0000 [0184.548] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.548] GetProcessHeap () returned 0xfd0000 [0184.548] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce44eb59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.552] GetProcessHeap () returned 0xfd0000 [0184.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.552] GetProcessHeap () returned 0xfd0000 [0184.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.553] GetProcessHeap () returned 0xfd0000 [0184.553] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d974b3f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.599] GetProcessHeap () returned 0xfd0000 [0184.599] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x352fda34, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x352fda34, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.602] GetProcessHeap () returned 0xfd0000 [0184.602] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce451c7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.603] GetProcessHeap () returned 0xfd0000 [0184.603] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.604] GetProcessHeap () returned 0xfd0000 [0184.604] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce452621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0184.604] GetProcessHeap () returned 0xfd0000 [0184.604] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.605] GetProcessHeap () returned 0xfd0000 [0184.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce452fe1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.605] GetProcessHeap () returned 0xfd0000 [0184.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.605] GetProcessHeap () returned 0xfd0000 [0184.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce453822, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28f343d5, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.605] GetProcessHeap () returned 0xfd0000 [0184.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.605] GetProcessHeap () returned 0xfd0000 [0184.605] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.605] GetProcessHeap () returned 0xfd0000 [0184.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ec1d32, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce454200, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28ec1d32, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.606] GetProcessHeap () returned 0xfd0000 [0184.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.606] GetProcessHeap () returned 0xfd0000 [0184.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce454a7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.606] GetProcessHeap () returned 0xfd0000 [0184.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.607] GetProcessHeap () returned 0xfd0000 [0184.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce4552a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e030d8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0184.607] GetProcessHeap () returned 0xfd0000 [0184.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.607] GetProcessHeap () returned 0xfd0000 [0184.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce4559e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e030d8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.608] GetProcessHeap () returned 0xfd0000 [0184.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.608] GetProcessHeap () returned 0xfd0000 [0184.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.610] GetProcessHeap () returned 0xfd0000 [0184.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.610] GetProcessHeap () returned 0xfd0000 [0184.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d747894, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d747894, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.611] GetProcessHeap () returned 0xfd0000 [0184.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.611] GetProcessHeap () returned 0xfd0000 [0184.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51c9dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.611] GetProcessHeap () returned 0xfd0000 [0184.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.611] GetProcessHeap () returned 0xfd0000 [0184.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.612] GetProcessHeap () returned 0xfd0000 [0184.612] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0184.615] GetProcessHeap () returned 0xfd0000 [0184.615] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x270f45ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x355f8919, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x355f8919, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.618] GetProcessHeap () returned 0xfd0000 [0184.618] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51f8b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.619] GetProcessHeap () returned 0xfd0000 [0184.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.619] GetProcessHeap () returned 0xfd0000 [0184.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51ff5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.619] GetProcessHeap () returned 0xfd0000 [0184.619] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.619] GetProcessHeap () returned 0xfd0000 [0184.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce5207a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.620] GetProcessHeap () returned 0xfd0000 [0184.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.620] GetProcessHeap () returned 0xfd0000 [0184.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2711a822, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce52108f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2711a822, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.620] GetProcessHeap () returned 0xfd0000 [0184.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.620] GetProcessHeap () returned 0xfd0000 [0184.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.620] GetProcessHeap () returned 0xfd0000 [0184.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x270a815c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce521aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x270a815c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.621] GetProcessHeap () returned 0xfd0000 [0184.621] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.621] GetProcessHeap () returned 0xfd0000 [0184.621] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f2a964, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce5222ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f2a964, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.622] GetProcessHeap () returned 0xfd0000 [0184.622] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.622] GetProcessHeap () returned 0xfd0000 [0184.622] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce522bb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.622] GetProcessHeap () returned 0xfd0000 [0184.622] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.623] GetProcessHeap () returned 0xfd0000 [0184.623] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce523499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.623] GetProcessHeap () returned 0xfd0000 [0184.623] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.623] GetProcessHeap () returned 0xfd0000 [0184.623] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f2a964, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.626] GetProcessHeap () returned 0xfd0000 [0184.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.626] GetProcessHeap () returned 0xfd0000 [0184.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e72acf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0184.626] GetProcessHeap () returned 0xfd0000 [0184.626] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.626] GetProcessHeap () returned 0xfd0000 [0184.626] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce657df6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.627] GetProcessHeap () returned 0xfd0000 [0184.627] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.627] GetProcessHeap () returned 0xfd0000 [0184.627] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.629] GetProcessHeap () returned 0xfd0000 [0184.629] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.634] GetProcessHeap () returned 0xfd0000 [0184.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.647] GetProcessHeap () returned 0xfd0000 [0184.647] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.649] GetProcessHeap () returned 0xfd0000 [0184.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.649] GetProcessHeap () returned 0xfd0000 [0184.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.649] GetProcessHeap () returned 0xfd0000 [0184.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.649] GetProcessHeap () returned 0xfd0000 [0184.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.650] GetProcessHeap () returned 0xfd0000 [0184.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.650] GetProcessHeap () returned 0xfd0000 [0184.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.650] GetProcessHeap () returned 0xfd0000 [0184.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.650] GetProcessHeap () returned 0xfd0000 [0184.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.650] GetProcessHeap () returned 0xfd0000 [0184.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.651] GetProcessHeap () returned 0xfd0000 [0184.651] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.651] GetProcessHeap () returned 0xfd0000 [0184.651] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.720] GetProcessHeap () returned 0xfd0000 [0184.720] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.720] GetProcessHeap () returned 0xfd0000 [0184.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.721] GetProcessHeap () returned 0xfd0000 [0184.721] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.721] GetProcessHeap () returned 0xfd0000 [0184.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.721] GetProcessHeap () returned 0xfd0000 [0184.721] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.721] GetProcessHeap () returned 0xfd0000 [0184.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.769] GetProcessHeap () returned 0xfd0000 [0184.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.769] GetProcessHeap () returned 0xfd0000 [0184.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0184.769] GetProcessHeap () returned 0xfd0000 [0184.769] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.769] GetProcessHeap () returned 0xfd0000 [0184.769] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.772] GetProcessHeap () returned 0xfd0000 [0184.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.772] GetProcessHeap () returned 0xfd0000 [0184.772] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.773] GetProcessHeap () returned 0xfd0000 [0184.773] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4774ad5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0184.775] GetProcessHeap () returned 0xfd0000 [0184.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3588116b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3588116b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.777] GetProcessHeap () returned 0xfd0000 [0184.777] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70cfd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.779] GetProcessHeap () returned 0xfd0000 [0184.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.779] GetProcessHeap () returned 0xfd0000 [0184.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70d7d8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.779] GetProcessHeap () returned 0xfd0000 [0184.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.779] GetProcessHeap () returned 0xfd0000 [0184.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70df91, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.779] GetProcessHeap () returned 0xfd0000 [0184.779] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.779] GetProcessHeap () returned 0xfd0000 [0184.779] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70e6f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2385473f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.781] GetProcessHeap () returned 0xfd0000 [0184.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.781] GetProcessHeap () returned 0xfd0000 [0184.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.781] GetProcessHeap () returned 0xfd0000 [0184.781] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23795cbb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70eff9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x23795cbb, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0184.782] GetProcessHeap () returned 0xfd0000 [0184.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.782] GetProcessHeap () returned 0xfd0000 [0184.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70f877, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0184.782] GetProcessHeap () returned 0xfd0000 [0184.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.782] GetProcessHeap () returned 0xfd0000 [0184.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce71002c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236d6f79, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0184.782] GetProcessHeap () returned 0xfd0000 [0184.782] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.782] GetProcessHeap () returned 0xfd0000 [0184.782] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce710758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236d6f79, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0184.783] GetProcessHeap () returned 0xfd0000 [0184.783] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.783] GetProcessHeap () returned 0xfd0000 [0184.783] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0184.859] GetProcessHeap () returned 0xfd0000 [0184.859] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.859] GetProcessHeap () returned 0xfd0000 [0184.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4584a9e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd4584a9e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4584a9e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.864] GetProcessHeap () returned 0xfd0000 [0184.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.864] GetProcessHeap () returned 0xfd0000 [0184.864] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce82befc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.864] GetProcessHeap () returned 0xfd0000 [0184.864] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.865] GetProcessHeap () returned 0xfd0000 [0184.865] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.866] GetProcessHeap () returned 0xfd0000 [0184.866] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f7086bb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0184.868] GetProcessHeap () returned 0xfd0000 [0184.868] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f7086bb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.872] GetProcessHeap () returned 0xfd0000 [0184.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.872] GetProcessHeap () returned 0xfd0000 [0184.872] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.872] GetProcessHeap () returned 0xfd0000 [0184.872] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.873] GetProcessHeap () returned 0xfd0000 [0184.873] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.873] GetProcessHeap () returned 0xfd0000 [0184.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.874] GetProcessHeap () returned 0xfd0000 [0184.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.874] GetProcessHeap () returned 0xfd0000 [0184.874] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f72e917, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.874] GetProcessHeap () returned 0xfd0000 [0184.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.874] GetProcessHeap () returned 0xfd0000 [0184.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.874] GetProcessHeap () returned 0xfd0000 [0184.874] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.874] GetProcessHeap () returned 0xfd0000 [0184.874] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.875] GetProcessHeap () returned 0xfd0000 [0184.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xce8a0b61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.876] GetProcessHeap () returned 0xfd0000 [0184.876] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.876] GetProcessHeap () returned 0xfd0000 [0184.876] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.876] GetProcessHeap () returned 0xfd0000 [0184.876] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.877] GetProcessHeap () returned 0xfd0000 [0184.877] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.877] GetProcessHeap () returned 0xfd0000 [0184.877] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.877] GetProcessHeap () returned 0xfd0000 [0184.877] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0184.877] GetProcessHeap () returned 0xfd0000 [0184.877] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.877] GetProcessHeap () returned 0xfd0000 [0184.877] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0184.878] GetProcessHeap () returned 0xfd0000 [0184.878] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.878] GetProcessHeap () returned 0xfd0000 [0184.878] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.878] GetProcessHeap () returned 0xfd0000 [0184.878] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0184.878] GetProcessHeap () returned 0xfd0000 [0184.878] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0184.879] GetProcessHeap () returned 0xfd0000 [0184.879] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0184.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b121dc6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b2eb9cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0184.881] GetProcessHeap () returned 0xfd0000 [0184.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0184.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b6ec46e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x35a9714d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35a9714d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0184.884] GetProcessHeap () returned 0xfd0000 [0184.885] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8ef769, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0184.996] GetProcessHeap () returned 0xfd0000 [0184.996] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0184.996] GetProcessHeap () returned 0xfd0000 [0184.997] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0184.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f01a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.017] GetProcessHeap () returned 0xfd0000 [0185.017] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.017] GetProcessHeap () returned 0xfd0000 [0185.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f09c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.017] GetProcessHeap () returned 0xfd0000 [0185.017] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.017] GetProcessHeap () returned 0xfd0000 [0185.017] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b738935, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1021, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b738935, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.017] GetProcessHeap () returned 0xfd0000 [0185.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.018] GetProcessHeap () returned 0xfd0000 [0185.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.018] GetProcessHeap () returned 0xfd0000 [0185.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b673a2c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1916, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b673a2c, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.018] GetProcessHeap () returned 0xfd0000 [0185.018] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.018] GetProcessHeap () returned 0xfd0000 [0185.018] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b5ac30d, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f2195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b5ac30d, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.135] GetProcessHeap () returned 0xfd0000 [0185.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.135] GetProcessHeap () returned 0xfd0000 [0185.135] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f2b5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.136] GetProcessHeap () returned 0xfd0000 [0185.136] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.136] GetProcessHeap () returned 0xfd0000 [0185.136] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f3688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.137] GetProcessHeap () returned 0xfd0000 [0185.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.137] GetProcessHeap () returned 0xfd0000 [0185.137] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b5ac30d, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0185.139] GetProcessHeap () returned 0xfd0000 [0185.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.139] GetProcessHeap () returned 0xfd0000 [0185.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce9b4220, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.139] GetProcessHeap () returned 0xfd0000 [0185.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.140] GetProcessHeap () returned 0xfd0000 [0185.140] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0185.141] GetProcessHeap () returned 0xfd0000 [0185.141] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0185.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88e698d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.193] GetProcessHeap () returned 0xfd0000 [0185.193] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf326ae34, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35cd3598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35cd3598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.350] GetProcessHeap () returned 0xfd0000 [0185.350] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea3e49d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.432] GetProcessHeap () returned 0xfd0000 [0185.432] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.432] GetProcessHeap () returned 0xfd0000 [0185.432] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea3ef48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.434] GetProcessHeap () returned 0xfd0000 [0185.434] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.434] GetProcessHeap () returned 0xfd0000 [0185.435] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea3f6c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.435] GetProcessHeap () returned 0xfd0000 [0185.435] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.435] GetProcessHeap () returned 0xfd0000 [0185.435] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf329109f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea87527, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf329109f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.442] GetProcessHeap () returned 0xfd0000 [0185.442] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.442] GetProcessHeap () returned 0xfd0000 [0185.442] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.442] GetProcessHeap () returned 0xfd0000 [0185.442] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3244cb5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea88474, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3244cb5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.443] GetProcessHeap () returned 0xfd0000 [0185.443] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.443] GetProcessHeap () returned 0xfd0000 [0185.443] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf31ac27f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea88d7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf31ac27f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.444] GetProcessHeap () returned 0xfd0000 [0185.444] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.444] GetProcessHeap () returned 0xfd0000 [0185.444] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd493a5d4, ftLastAccessTime.dwHighDateTime=0x1d32748, ftLastWriteTime.dwLowDateTime=0xd493a5d4, ftLastWriteTime.dwHighDateTime=0x1d32748, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.444] GetProcessHeap () returned 0xfd0000 [0185.444] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\DiagOutputDir\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4919577, ftCreationTime.dwHighDateTime=0x1d32748, ftLastAccessTime.dwLowDateTime=0xa2255f52, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa2255f52, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.444] GetProcessHeap () returned 0xfd0000 [0185.444] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.445] GetProcessHeap () returned 0xfd0000 [0185.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.445] GetProcessHeap () returned 0xfd0000 [0185.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb05476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.451] GetProcessHeap () returned 0xfd0000 [0185.451] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.451] GetProcessHeap () returned 0xfd0000 [0185.451] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf31ac27f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.494] GetProcessHeap () returned 0xfd0000 [0185.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.494] GetProcessHeap () returned 0xfd0000 [0185.494] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a3d6df, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88a3d6df, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.494] GetProcessHeap () returned 0xfd0000 [0185.494] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.494] GetProcessHeap () returned 0xfd0000 [0185.494] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb6027e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0185.495] GetProcessHeap () returned 0xfd0000 [0185.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.495] GetProcessHeap () returned 0xfd0000 [0185.495] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0185.496] GetProcessHeap () returned 0xfd0000 [0185.496] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0185.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.506] GetProcessHeap () returned 0xfd0000 [0185.506] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.518] GetProcessHeap () returned 0xfd0000 [0185.518] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0185.522] GetProcessHeap () returned 0xfd0000 [0185.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.522] GetProcessHeap () returned 0xfd0000 [0185.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0185.522] GetProcessHeap () returned 0xfd0000 [0185.522] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.522] GetProcessHeap () returned 0xfd0000 [0185.522] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0185.523] GetProcessHeap () returned 0xfd0000 [0185.523] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.523] GetProcessHeap () returned 0xfd0000 [0185.523] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.525] GetProcessHeap () returned 0xfd0000 [0185.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.525] GetProcessHeap () returned 0xfd0000 [0185.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.525] GetProcessHeap () returned 0xfd0000 [0185.525] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.525] GetProcessHeap () returned 0xfd0000 [0185.525] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.526] GetProcessHeap () returned 0xfd0000 [0185.526] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.526] GetProcessHeap () returned 0xfd0000 [0185.526] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.526] GetProcessHeap () returned 0xfd0000 [0185.526] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcecefd70, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd30f451d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0185.527] GetProcessHeap () returned 0xfd0000 [0185.527] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.527] GetProcessHeap () returned 0xfd0000 [0185.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0185.527] GetProcessHeap () returned 0xfd0000 [0185.527] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.527] GetProcessHeap () returned 0xfd0000 [0185.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.527] GetProcessHeap () returned 0xfd0000 [0185.527] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.527] GetProcessHeap () returned 0xfd0000 [0185.527] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.528] GetProcessHeap () returned 0xfd0000 [0185.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.528] GetProcessHeap () returned 0xfd0000 [0185.528] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0185.528] GetProcessHeap () returned 0xfd0000 [0185.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.528] GetProcessHeap () returned 0xfd0000 [0185.528] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0185.529] GetProcessHeap () returned 0xfd0000 [0185.529] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0185.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35ff46f7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.536] GetProcessHeap () returned 0xfd0000 [0185.536] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe34f28da, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35f5bdb6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35f5bdb6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.605] GetProcessHeap () returned 0xfd0000 [0185.605] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcecf51f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.606] GetProcessHeap () returned 0xfd0000 [0185.606] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.606] GetProcessHeap () returned 0xfd0000 [0185.606] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcecf55fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.607] GetProcessHeap () returned 0xfd0000 [0185.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.607] GetProcessHeap () returned 0xfd0000 [0185.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcecf59dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.607] GetProcessHeap () returned 0xfd0000 [0185.607] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.607] GetProcessHeap () returned 0xfd0000 [0185.607] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe353eed8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7a289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe353eed8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.608] GetProcessHeap () returned 0xfd0000 [0185.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.608] GetProcessHeap () returned 0xfd0000 [0185.608] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.608] GetProcessHeap () returned 0xfd0000 [0185.608] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34801ff, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7ab8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe34801ff, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.609] GetProcessHeap () returned 0xfd0000 [0185.609] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.609] GetProcessHeap () returned 0xfd0000 [0185.609] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3459fc9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7b247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3459fc9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.610] GetProcessHeap () returned 0xfd0000 [0185.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.610] GetProcessHeap () returned 0xfd0000 [0185.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7b97a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.610] GetProcessHeap () returned 0xfd0000 [0185.610] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.610] GetProcessHeap () returned 0xfd0000 [0185.610] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7c17c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.611] GetProcessHeap () returned 0xfd0000 [0185.611] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.611] GetProcessHeap () returned 0xfd0000 [0185.611] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3459fc9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.614] GetProcessHeap () returned 0xfd0000 [0185.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.614] GetProcessHeap () returned 0xfd0000 [0185.614] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcee15758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.614] GetProcessHeap () returned 0xfd0000 [0185.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.614] GetProcessHeap () returned 0xfd0000 [0185.614] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0185.616] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Wallet_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WAL")) returned 1 [0185.616] GetProcessHeap () returned 0xfd0000 [0185.616] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0185.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.619] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.619] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0185.619] GetProcessHeap () returned 0xfd0000 [0185.619] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.622] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.622] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0185.622] GetProcessHeap () returned 0xfd0000 [0185.622] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.623] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.623] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.623] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0185.623] GetProcessHeap () returned 0xfd0000 [0185.691] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.692] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0185.692] GetProcessHeap () returned 0xfd0000 [0185.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.699] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.707] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.707] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0185.709] GetProcessHeap () returned 0xfd0000 [0185.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.709] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0185.709] GetProcessHeap () returned 0xfd0000 [0185.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0185.710] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.710] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.710] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0185.710] GetProcessHeap () returned 0xfd0000 [0185.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.710] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0185.710] GetProcessHeap () returned 0xfd0000 [0185.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.710] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.710] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.710] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0185.710] GetProcessHeap () returned 0xfd0000 [0185.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0185.711] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0185.711] GetProcessHeap () returned 0xfd0000 [0185.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.711] GetProcessHeap () returned 0xfd0000 [0185.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0185.711] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.711] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0185.711] GetProcessHeap () returned 0xfd0000 [0185.711] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.711] GetProcessHeap () returned 0xfd0000 [0185.711] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.712] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.712] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.712] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0185.712] GetProcessHeap () returned 0xfd0000 [0185.712] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.712] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.712] GetProcessHeap () returned 0xfd0000 [0185.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0185.713] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.713] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.713] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0185.713] GetProcessHeap () returned 0xfd0000 [0185.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.713] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.713] GetProcessHeap () returned 0xfd0000 [0185.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.713] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.713] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.713] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0185.713] GetProcessHeap () returned 0xfd0000 [0185.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.713] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.714] GetProcessHeap () returned 0xfd0000 [0185.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.714] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.714] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0185.714] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0185.714] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0185.714] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0185.714] GetProcessHeap () returned 0xfd0000 [0185.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.714] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.714] GetProcessHeap () returned 0xfd0000 [0185.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.715] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.715] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.715] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0185.715] GetProcessHeap () returned 0xfd0000 [0185.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.715] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.715] GetProcessHeap () returned 0xfd0000 [0185.715] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.715] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.716] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.716] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0185.716] GetProcessHeap () returned 0xfd0000 [0185.716] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.716] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.716] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0185.716] GetProcessHeap () returned 0xfd0000 [0185.716] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0185.717] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CHX")) returned 1 [0185.717] GetProcessHeap () returned 0xfd0000 [0185.717] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0185.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0185.724] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.724] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0185.724] GetProcessHeap () returned 0xfd0000 [0185.724] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.727] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.727] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0185.727] GetProcessHeap () returned 0xfd0000 [0185.727] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0185.728] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.728] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.728] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0185.733] GetProcessHeap () returned 0xfd0000 [0185.733] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.733] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x772696ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0185.733] GetProcessHeap () returned 0xfd0000 [0185.733] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x772696ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.734] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x772696ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.734] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x772696ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.734] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0185.734] GetProcessHeap () returned 0xfd0000 [0185.734] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.734] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0185.734] GetProcessHeap () returned 0xfd0000 [0185.734] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0185.734] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.735] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.735] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0185.735] GetProcessHeap () returned 0xfd0000 [0185.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.735] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0185.735] GetProcessHeap () returned 0xfd0000 [0185.735] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0185.735] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.735] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.735] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0185.735] GetProcessHeap () returned 0xfd0000 [0185.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.735] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0185.735] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0185.735] GetProcessHeap () returned 0xfd0000 [0185.735] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.735] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.735] GetProcessHeap () returned 0xfd0000 [0185.735] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.736] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.736] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.736] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0185.736] GetProcessHeap () returned 0xfd0000 [0185.736] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.736] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.736] GetProcessHeap () returned 0xfd0000 [0185.736] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0185.737] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.737] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.737] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0185.737] GetProcessHeap () returned 0xfd0000 [0185.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.737] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.737] GetProcessHeap () returned 0xfd0000 [0185.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0185.737] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.737] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.738] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0185.738] GetProcessHeap () returned 0xfd0000 [0185.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.738] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.738] GetProcessHeap () returned 0xfd0000 [0185.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0185.738] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.738] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.738] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0185.738] GetProcessHeap () returned 0xfd0000 [0185.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.740] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771f6fb5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.741] GetProcessHeap () returned 0xfd0000 [0185.741] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771f6fb5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0185.741] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771f6fb5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.741] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771f6fb5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771f6fb5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771f6fb5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0185.741] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0185.741] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0185.741] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0185.741] GetProcessHeap () returned 0xfd0000 [0185.741] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.741] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.742] GetProcessHeap () returned 0xfd0000 [0185.742] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0185.742] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.742] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.742] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0185.742] GetProcessHeap () returned 0xfd0000 [0185.742] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.742] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.742] GetProcessHeap () returned 0xfd0000 [0185.742] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0185.743] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.743] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.743] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0185.743] GetProcessHeap () returned 0xfd0000 [0185.743] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0185.743] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.743] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0185.743] GetProcessHeap () returned 0xfd0000 [0185.743] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0185.744] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1 [0185.745] GetProcessHeap () returned 0xfd0000 [0185.745] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0185.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0185.747] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.747] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6c02bacc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3620a676, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3620a676, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0185.747] GetProcessHeap () returned 0xfd0000 [0185.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0185.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6c02bacc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3620a676, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3620a676, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0185.750] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6c02bacc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3620a676, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3620a676, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.750] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ad23, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0185.750] GetProcessHeap () returned 0xfd0000 [0185.750] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ad23, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0185.757] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ad23, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.757] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ad23, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.757] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0185.757] GetProcessHeap () returned 0xfd0000 [0185.757] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.757] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ba18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0185.757] GetProcessHeap () returned 0xfd0000 [0185.757] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0185.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ba18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0185.758] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ba18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.758] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ba18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0185.759] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0185.759] GetProcessHeap () returned 0xfd0000 [0185.759] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0185.759] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13c26a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0186.308] GetProcessHeap () returned 0xfd0000 [0186.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13c26a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.308] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13c26a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.308] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13c26a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.308] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.308] GetProcessHeap () returned 0xfd0000 [0186.308] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.308] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0186.308] GetProcessHeap () returned 0xfd0000 [0186.308] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0186.309] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.309] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.309] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0186.309] GetProcessHeap () returned 0xfd0000 [0186.309] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.309] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c051d3e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ca54, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c051d3e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0186.309] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0186.309] GetProcessHeap () returned 0xfd0000 [0186.309] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.309] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13d33b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0186.309] GetProcessHeap () returned 0xfd0000 [0186.309] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13d33b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0186.310] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13d33b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.310] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13d33b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.310] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0186.310] GetProcessHeap () returned 0xfd0000 [0186.310] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.310] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13dbc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0186.310] GetProcessHeap () returned 0xfd0000 [0186.310] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13dbc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0186.311] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13dbc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.311] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13dbc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.311] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0186.311] GetProcessHeap () returned 0xfd0000 [0186.311] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.311] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13e364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0186.311] GetProcessHeap () returned 0xfd0000 [0186.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13e364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.311] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13e364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.311] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13e364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.311] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0186.311] GetProcessHeap () returned 0xfd0000 [0186.311] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.311] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ea5f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0186.311] GetProcessHeap () returned 0xfd0000 [0186.311] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ea5f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.318] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ea5f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.318] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ea5f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.318] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0186.318] GetProcessHeap () returned 0xfd0000 [0186.318] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.318] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0186.318] GetProcessHeap () returned 0xfd0000 [0186.318] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.320] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.320] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6bfdf615, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0186.320] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8e0dbaa, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0186.320] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd83ebb87, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd83ebb87, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd83ebb87, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0186.320] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd83ebb87, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd83ebb87, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd83ebb87, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0186.320] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd83ebb87, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd83ebb87, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd83ebb87, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0186.320] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.321] GetProcessHeap () returned 0xfd0000 [0186.321] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.321] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7962cbd4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7962cbd4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0186.321] GetProcessHeap () returned 0xfd0000 [0186.321] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7962cbd4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7962cbd4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0186.322] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7962cbd4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7962cbd4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.322] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7962cbd4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7962cbd4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.322] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0186.322] GetProcessHeap () returned 0xfd0000 [0186.322] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.322] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0186.322] GetProcessHeap () returned 0xfd0000 [0186.322] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0186.322] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.322] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.322] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0186.323] GetProcessHeap () returned 0xfd0000 [0186.323] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.323] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0186.323] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.324] GetProcessHeap () returned 0xfd0000 [0186.324] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0186.325] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1 [0186.325] GetProcessHeap () returned 0xfd0000 [0186.325] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0186.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7cc0 [0186.326] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.326] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36446b0c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36446b0c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0186.326] GetProcessHeap () returned 0xfd0000 [0186.326] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36446b0c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36446b0c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.329] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36446b0c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36446b0c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.329] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22f4e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0186.329] GetProcessHeap () returned 0xfd0000 [0186.329] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22f4e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.330] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22f4e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.330] FindNextFileW (in: hFindFile=0x10b7ac0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22f4e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.330] FindClose (in: hFindFile=0x10b7ac0 | out: hFindFile=0x10b7ac0) returned 1 [0186.330] GetProcessHeap () returned 0xfd0000 [0186.330] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.330] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22ff25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0186.330] GetProcessHeap () returned 0xfd0000 [0186.330] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22ff25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0186.331] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22ff25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.331] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf22ff25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.331] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0186.331] GetProcessHeap () returned 0xfd0000 [0186.331] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.331] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230693, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0186.331] GetProcessHeap () returned 0xfd0000 [0186.331] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230693, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.331] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230693, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.331] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230693, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.331] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.331] GetProcessHeap () returned 0xfd0000 [0186.331] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.331] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0186.331] GetProcessHeap () returned 0xfd0000 [0186.331] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0186.332] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.332] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.332] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0186.332] GetProcessHeap () returned 0xfd0000 [0186.332] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.332] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf230fa0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74c17df3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0186.332] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.332] GetProcessHeap () returned 0xfd0000 [0186.332] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.332] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf231a5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0186.332] GetProcessHeap () returned 0xfd0000 [0186.332] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf231a5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0186.332] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf231a5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.333] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf231a5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.333] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0186.333] GetProcessHeap () returned 0xfd0000 [0186.333] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.333] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf23226b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0186.333] GetProcessHeap () returned 0xfd0000 [0186.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf23226b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.333] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf23226b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.333] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf23226b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.333] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.333] GetProcessHeap () returned 0xfd0000 [0186.333] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.333] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2329b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0186.333] GetProcessHeap () returned 0xfd0000 [0186.333] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2329b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.334] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2329b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.334] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2329b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.334] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.334] GetProcessHeap () returned 0xfd0000 [0186.334] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.334] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2331d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0186.334] GetProcessHeap () returned 0xfd0000 [0186.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2331d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0186.335] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2331d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.335] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2331d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.335] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0186.335] GetProcessHeap () returned 0xfd0000 [0186.335] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.335] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0186.335] GetProcessHeap () returned 0xfd0000 [0186.335] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0186.337] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.337] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x74bcb92d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0186.337] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0186.337] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcfcdeeec, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0186.337] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcfcdeeec, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0186.338] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcfcdeeec, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0186.338] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0186.338] GetProcessHeap () returned 0xfd0000 [0186.338] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.338] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcffd9e09, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0186.339] GetProcessHeap () returned 0xfd0000 [0186.339] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcffd9e09, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.339] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcffd9e09, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.339] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcffd9e09, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.339] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.339] GetProcessHeap () returned 0xfd0000 [0186.339] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.339] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0186.339] GetProcessHeap () returned 0xfd0000 [0186.339] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0186.339] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.340] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.340] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0186.340] GetProcessHeap () returned 0xfd0000 [0186.340] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.340] FindNextFileW (in: hFindFile=0x10b7cc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0186.340] FindClose (in: hFindFile=0x10b7cc0 | out: hFindFile=0x10b7cc0) returned 1 [0186.340] GetProcessHeap () returned 0xfd0000 [0186.340] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0186.341] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~2.CON")) returned 1 [0186.341] GetProcessHeap () returned 0xfd0000 [0186.341] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0186.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0186.343] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.343] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x366f55bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0186.343] GetProcessHeap () returned 0xfd0000 [0186.343] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x366f55bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0186.348] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x366f55bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.348] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xac3e804b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xac3e804b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApi", cAlternateFileName="BACKGR~1")) returned 1 [0186.348] GetProcessHeap () returned 0xfd0000 [0186.348] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0186.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xac3e804b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xac3e804b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.352] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xac3e804b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xac3e804b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa8e3034, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xaa8e3034, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xaa8e3034, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0a9b218f-07c0-466c-a90d-846952623a1d.up_meta_body", cAlternateFileName="0A9B21~2.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba7509b5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba7509b5, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba28c391, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="13a1a3db-30b4-4d7f-b850-31701e6aab62.cc15303f-fdbf-4f84-ab8e-2b29ebdfc262.down_meta", cAlternateFileName="13A1A3~1.DOW")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba70449e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba70449e, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb2cc98b2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="13a1a3db-30b4-4d7f-b850-31701e6aab62.up_meta", cAlternateFileName="13A1A3~1.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba72a7b9, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba72a7b9, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba72a7b9, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="13a1a3db-30b4-4d7f-b850-31701e6aab62.up_meta_body", cAlternateFileName="13A1A3~2.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5908322, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5908322, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb4858d6f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b60c273-f96f-4713-929a-6444e00282fa.7647c411-ba98-4335-90cc-b9513179ac81.down_meta", cAlternateFileName="1B60C2~1.DOW")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5908322, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5908322, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb0d80d4f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b60c273-f96f-4713-929a-6444e00282fa.up_meta", cAlternateFileName="1B60C2~1.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5908322, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5908322, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb5908322, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b60c273-f96f-4713-929a-6444e00282fa.up_meta_body", cAlternateFileName="1B60C2~2.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8251d60c, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x8251d60c, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8251d60c, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2e1af1ae-b809-47bf-b9e5-572e6d5ddbfe.up_meta_body", cAlternateFileName="2E1AF1~2.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb33b800, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb33b800, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb197ff2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="364feb5b-d4ef-4192-b8de-cb11ed31a7ef.03344d37-6323-473f-b307-879be5d91c6e.down_meta", cAlternateFileName="364FEB~1.DOW")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb33b800, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb33b800, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb3488a7b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="364feb5b-d4ef-4192-b8de-cb11ed31a7ef.up_meta", cAlternateFileName="364FEB~1.UP_")) returned 1 [0186.627] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb33b800, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb33b800, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb33b800, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="364feb5b-d4ef-4192-b8de-cb11ed31a7ef.up_meta_body", cAlternateFileName="364FEB~2.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80075325, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x80075325, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x80075325, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="43674263-b767-4618-ab3f-0fd0619824dc.up_meta_body", cAlternateFileName="436742~2.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0863b20, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0863b20, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd0863b20, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="512a7fe4-25ff-44ca-afb0-208983aaff3a.up_meta_body", cAlternateFileName="512A7F~2.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fc22ead, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x7fc22ead, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x7fc22ead, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="51c9ae83-742b-4318-a848-5026dfe89646.up_meta_body", cAlternateFileName="51C9AE~2.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4d8fa2e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb4d8fa2e, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb47e66ef, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54827e92-1c6c-4ea8-bb11-3b3464cf22fc.f34c1ab6-a087-4cf4-b1cf-aeb88de449b7.down_meta", cAlternateFileName="54827E~1.DOW")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4d8fa2e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb4d8fa2e, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb0d0e6bb, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="54827e92-1c6c-4ea8-bb11-3b3464cf22fc.up_meta", cAlternateFileName="54827E~1.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4d8fa2e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb4d8fa2e, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb4d8fa2e, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54827e92-1c6c-4ea8-bb11-3b3464cf22fc.up_meta_body", cAlternateFileName="54827E~2.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba5148a9, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba5148a9, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba134f59, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="668e384d-ae80-493f-a269-da43a2cf83ed.f1206db6-0d02-4b94-94ca-d7bc4c57a4f2.down_meta", cAlternateFileName="668E38~1.DOW")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba4ee662, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba4ee662, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb2b98765, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="668e384d-ae80-493f-a269-da43a2cf83ed.up_meta", cAlternateFileName="668E38~1.UP_")) returned 1 [0186.628] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba5148a9, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba5148a9, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba5148a9, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="668e384d-ae80-493f-a269-da43a2cf83ed.up_meta_body", cAlternateFileName="668E38~2.UP_")) returned 1 [0186.632] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82379c27, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x82379c27, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x82379c27, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="67ab33ac-a778-4769-a5cb-4f2db5833ff0.up_meta_body", cAlternateFileName="67AB33~2.UP_")) returned 1 [0186.632] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb86d2288, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb86d2288, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb82f2a65, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="8e881659-f010-401e-947f-d21800cd0388.4006bee6-d249-464c-ab34-c05dbe287355.down_meta", cAlternateFileName="8E8816~1.DOW")) returned 1 [0186.632] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb86d2288, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb86d2288, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb0e8bc9d, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="8e881659-f010-401e-947f-d21800cd0388.up_meta", cAlternateFileName="8E8816~1.UP_")) returned 1 [0186.632] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb86d2288, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb86d2288, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb86d2288, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8e881659-f010-401e-947f-d21800cd0388.up_meta_body", cAlternateFileName="8E8816~2.UP_")) returned 1 [0186.632] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb50525b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb50525b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb197ff2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="9a29fd3b-1f8e-479c-a6b3-db454582425c.9dd5d850-8fb7-46d0-8e6d-2cb40d5ec796.down_meta", cAlternateFileName="9A29FD~1.DOW")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb446758, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb446758, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb3036b07, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="9a29fd3b-1f8e-479c-a6b3-db454582425c.up_meta", cAlternateFileName="9A29FD~1.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb446758, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb446758, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb446758, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9a29fd3b-1f8e-479c-a6b3-db454582425c.up_meta_body", cAlternateFileName="9A29FD~2.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbaee9959, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbaee9959, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbae50fe7, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0d57c50-0d39-47d0-b291-f2b7c6c11682.49743f55-67dd-42a7-814a-bd0e811d42d3.down_meta", cAlternateFileName="A0D57C~1.DOW")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbaec3660, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbaec3660, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb2eb952c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0d57c50-0d39-47d0-b291-f2b7c6c11682.up_meta", cAlternateFileName="A0D57C~1.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbaec3660, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbaec3660, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbaec3660, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0d57c50-0d39-47d0-b291-f2b7c6c11682.up_meta_body", cAlternateFileName="A0D57C~2.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba8f4137, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba8f4137, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba397246, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.716c76a1-41e0-435c-8a2d-22b342f4f5b3.down_meta", cAlternateFileName="A116C3~1.DOW")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba8cdf0b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba8cdf0b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb2d883a2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.up_meta", cAlternateFileName="A116C3~1.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba8cdf0b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba8cdf0b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba8cdf0b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.up_meta_body", cAlternateFileName="A116C3~2.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb975fefc, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb975fefc, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8f76166, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ab19f3b1-4de3-4827-bdbd-92a93a0211e5.869b39b2-3c55-4cca-ace7-c38451c6270e.down_meta", cAlternateFileName="AB19F3~1.DOW")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb967b1bb, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb967b1bb, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb249808c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="ab19f3b1-4de3-4827-bdbd-92a93a0211e5.up_meta", cAlternateFileName="AB19F3~1.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9713a9e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb9713a9e, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb9713a9e, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ab19f3b1-4de3-4827-bdbd-92a93a0211e5.up_meta_body", cAlternateFileName="AB19F3~2.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc86e5ce3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc86e5ce3, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc86e5ce3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af9f53b3-af5d-4995-8f7b-57cf715f6fbf.up_meta_body", cAlternateFileName="AF9F53~2.UP_")) returned 1 [0186.633] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdefc6910, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdefc6910, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xdefc6910, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b0d46b1c-4459-418c-af9b-0fe46893b1fd.up_meta_body", cAlternateFileName="B0D46B~2.UP_")) returned 1 [0186.634] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0e8bc9d, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb0e8bc9d, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb0e8bc9d, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b514de22-1472-4135-a516-53e87ede0d92.up_meta_body", cAlternateFileName="B514DE~2.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fe5f209, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x7fe5f209, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x7fe5f209, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b6b79e6f-5119-441e-8829-ee81a3be6046.up_meta_body", cAlternateFileName="B6B79E~2.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb857afe7, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb857afe7, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb82f2a65, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8697f91-5a83-4103-a22f-2f22aa918aeb.1ff197c8-5f5d-457a-9784-891d77fb2c85.down_meta", cAlternateFileName="B8697F~1.DOW")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8508837, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb8508837, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb11aca8d, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8697f91-5a83-4103-a22f-2f22aa918aeb.up_meta", cAlternateFileName="B8697F~1.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb857afe7, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb857afe7, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb857afe7, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8697f91-5a83-4103-a22f-2f22aa918aeb.up_meta_body", cAlternateFileName="B8697F~2.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0e3f831, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb0e3f831, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb0e3f831, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c44b8be1-f5e2-464b-8d6f-c439051f7821.up_meta_body", cAlternateFileName="C44B8B~2.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba1a75e0, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba1a75e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="c86e3408-9792-4ca6-90ee-da0828306422.17073f91-c189-4ad7-aa8a-ff1e30efda71.down_meta", cAlternateFileName="C86E34~1.DOW")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba0e8aea, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba0e8aea, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb26adf13, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="c86e3408-9792-4ca6-90ee-da0828306422.up_meta", cAlternateFileName="C86E34~1.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba15b18c, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba15b18c, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba15b18c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c86e3408-9792-4ca6-90ee-da0828306422.up_meta_body", cAlternateFileName="C86E34~2.UP_")) returned 1 [0186.637] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb197ff2, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb197ff2, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca21c08c-5147-46c8-a773-80b1d97dcaf9.079f15ac-a3f8-4b88-a4c7-f1a6ae04756a.down_meta", cAlternateFileName="CA21C0~1.DOW")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb171def, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb171def, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb3141a5c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca21c08c-5147-46c8-a773-80b1d97dcaf9.up_meta", cAlternateFileName="CA21C0~1.UP_")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb197ff2, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbb197ff2, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb197ff2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca21c08c-5147-46c8-a773-80b1d97dcaf9.up_meta_body", cAlternateFileName="CA21C0~2.UP_")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2bb3b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbbc2bb3b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbbb95f2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3c37a73-91a0-406c-89cb-164b23a60cc7.2eab7492-5633-455d-b98b-79091eb352d4.down_meta", cAlternateFileName="D3C37A~1.DOW")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2bb3b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbbc2bb3b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb375d417, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3c37a73-91a0-406c-89cb-164b23a60cc7.up_meta", cAlternateFileName="D3C37A~1.UP_")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2bb3b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbbc2bb3b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3c37a73-91a0-406c-89cb-164b23a60cc7.up_meta_body", cAlternateFileName="D3C37A~2.UP_")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5a5f63b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5a5f63b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb4d69802, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d63c62cc-0cff-4737-aa3d-c81b04024c0e.ea3bcaa3-50dd-4c97-8fb4-bbe3218f2ed7.down_meta", cAlternateFileName="D63C62~1.DOW")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5a5f63b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5a5f63b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb0cc226a, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="d63c62cc-0cff-4737-aa3d-c81b04024c0e.up_meta", cAlternateFileName="D63C62~1.UP_")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5a5f63b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5a5f63b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb5a5f63b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d63c62cc-0cff-4737-aa3d-c81b04024c0e.up_meta_body", cAlternateFileName="D63C62~2.UP_")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba2fe990, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba2fe990, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba003e43, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dccc04a3-64f0-4449-b08e-7f2c9a851fe3.dac3b31e-79f8-4a39-8dbf-fd1a8d3ab006.down_meta", cAlternateFileName="DCCC04~1.DOW")) returned 1 [0186.638] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba2d8742, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba2d8742, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb28e9fda, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="dccc04a3-64f0-4449-b08e-7f2c9a851fe3.up_meta", cAlternateFileName="DCCC04~1.UP_")) returned 1 [0186.639] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba2fe990, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba2fe990, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba2fe990, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dccc04a3-64f0-4449-b08e-7f2c9a851fe3.up_meta_body", cAlternateFileName="DCCC04~2.UP_")) returned 1 [0186.639] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82f2a65, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb82f2a65, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x5c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec24f201-27b8-4d24-9eda-c898a96c3bc3.32e727dd-8875-430c-becf-d08f84eae430.down_meta", cAlternateFileName="EC24F2~1.DOW")) returned 1 [0186.640] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8280333, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb8280333, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb15fe9fd, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta", cAlternateFileName="EC24F2~1.UP_")) returned 1 [0186.640] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82a6544, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb82a6544, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb82a6544, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta_body", cAlternateFileName="EC24F2~2.UP_")) returned 1 [0186.640] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82a6544, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb82a6544, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb82a6544, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta_body", cAlternateFileName="EC24F2~2.UP_")) returned 0 [0186.640] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.641] GetProcessHeap () returned 0xfd0000 [0186.641] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0186.641] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x4f465b01, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x4f465b01, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0186.642] GetProcessHeap () returned 0xfd0000 [0186.642] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x4f465b01, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x4f465b01, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0186.644] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x4f465b01, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x4f465b01, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.644] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc412ec55, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc412ec55, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc412ec55, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0186.644] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc412ec55, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc412ec55, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc412ec55, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0186.644] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0186.645] GetProcessHeap () returned 0xfd0000 [0186.645] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.645] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0186.645] GetProcessHeap () returned 0xfd0000 [0186.645] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0186.647] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc4344d07, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4344d07, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4344d07, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dbd491, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J9563R2N.cookie", cAlternateFileName="J9563R~1.COO")) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dbd491, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N4L5NPVO.cookie", cAlternateFileName="N4L5NP~1.COO")) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dbd491, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N4L5NPVO.cookie", cAlternateFileName="N4L5NP~1.COO")) returned 0 [0186.647] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0186.648] GetProcessHeap () returned 0xfd0000 [0186.648] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3df0c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0186.648] GetProcessHeap () returned 0xfd0000 [0186.648] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3df0c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.648] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3df0c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApi", cAlternateFileName="BACKGR~1")) returned 1 [0186.648] GetProcessHeap () returned 0xfd0000 [0186.649] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0186.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.649] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0186.649] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.649] GetProcessHeap () returned 0xfd0000 [0186.649] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApiGroup", cAlternateFileName="BACKGR~2")) returned 1 [0186.650] GetProcessHeap () returned 0xfd0000 [0186.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0186.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.650] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.650] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.650] GetProcessHeap () returned 0xfd0000 [0186.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApiGroup", cAlternateFileName="BACKGR~2")) returned 0 [0186.650] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.650] GetProcessHeap () returned 0xfd0000 [0186.650] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46d85ab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3e0632, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0186.650] GetProcessHeap () returned 0xfd0000 [0186.650] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46d85ab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3e0632, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0186.651] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46d85ab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3e0632, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.651] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc46fe810, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0186.651] GetProcessHeap () returned 0xfd0000 [0186.651] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0186.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc46fe810, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0186.651] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc46fe810, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.652] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0186.652] GetProcessHeap () returned 0xfd0000 [0186.652] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0186.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.654] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.654] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xa7db3f85, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0186.654] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc4724a60, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4724a60, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xa66b9b5b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0186.654] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc46fe810, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0186.654] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xf2fd7496, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2fd7496, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xb1945a08, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_8C550960E440B9C3B93A6A0AA915C9BE", cAlternateFileName="8828F3~1")) returned 1 [0186.655] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x85bcd5fe, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa3f9fa7b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="B912B2C6928A18B8CD7D50CF08BEA95B_219244AD8C315EF954C3867E71FFDF80", cAlternateFileName="B912B2~2")) returned 1 [0186.655] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xdf259e70, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdf259e70, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb468f37d, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="B912B2C6928A18B8CD7D50CF08BEA95B_230101012E1733B3199F7763353FFFED", cAlternateFileName="B912B2~1")) returned 1 [0186.655] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xca4b33c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca4b33c6, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xca4b33c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0186.655] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc4724a60, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4724a60, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xa670601e, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 1 [0186.655] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc4724a60, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4724a60, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xa670601e, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 0 [0186.655] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.656] GetProcessHeap () returned 0xfd0000 [0186.656] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0186.656] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0186.656] GetProcessHeap () returned 0xfd0000 [0186.656] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0186.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0186.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcbb8aa46, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0186.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc4724a60, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4724a60, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xa7dda1b8, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0186.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc46fe810, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x695219b2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0186.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xf2fd7496, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2fd7496, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xcbb8aa46, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_8C550960E440B9C3B93A6A0AA915C9BE", cAlternateFileName="8828F3~1")) returned 1 [0186.658] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x85bcd5fe, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa3fc5cae, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="B912B2C6928A18B8CD7D50CF08BEA95B_219244AD8C315EF954C3867E71FFDF80", cAlternateFileName="B912B2~2")) returned 1 [0186.659] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xdf233b44, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdf233b44, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xcbd2e254, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="B912B2C6928A18B8CD7D50CF08BEA95B_230101012E1733B3199F7763353FFFED", cAlternateFileName="B912B2~1")) returned 1 [0186.659] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xca4b33c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca4b33c6, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe848526b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0186.659] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc4724a60, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4724a60, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x695219b2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 1 [0186.659] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc4724a60, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4724a60, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x695219b2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 0 [0186.659] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0186.660] GetProcessHeap () returned 0xfd0000 [0186.660] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0186.660] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46fe810, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85bcd5fe, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85bcd5fe, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0186.660] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0186.661] GetProcessHeap () returned 0xfd0000 [0186.662] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0186.662] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc4bebab4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4bebab4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0186.662] GetProcessHeap () returned 0xfd0000 [0186.662] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0186.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc4bebab4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4bebab4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.662] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc4bebab4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4bebab4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.663] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc4bebab4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4bebab4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.663] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0186.663] GetProcessHeap () returned 0xfd0000 [0186.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0186.663] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc4bebab4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4bebab4, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0186.663] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0186.663] GetProcessHeap () returned 0xfd0000 [0186.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0186.665] GetProcessHeap () returned 0xfd0000 [0186.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0186.665] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.665] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.665] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0186.665] GetProcessHeap () returned 0xfd0000 [0186.665] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.665] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0186.666] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0186.666] GetProcessHeap () returned 0xfd0000 [0186.666] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.666] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0186.666] GetProcessHeap () returned 0xfd0000 [0186.666] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.667] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.667] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.667] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.667] GetProcessHeap () returned 0xfd0000 [0186.667] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.667] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0186.667] GetProcessHeap () returned 0xfd0000 [0186.667] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0186.857] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0186.857] GetProcessHeap () returned 0xfd0000 [0186.857] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0186.857] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf06a22a2, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0186.857] GetProcessHeap () returned 0xfd0000 [0186.857] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0186.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf06a22a2, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0186.859] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf06a22a2, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.859] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e04053, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0186.859] GetProcessHeap () returned 0xfd0000 [0186.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0186.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e04053, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e04053, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x820a4f5e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x820a4f5e, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8283e777, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x0, dwReserved1=0x0, cFileName="0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77", cAlternateFileName="015096~1")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd206161f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd206161f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd452fbd5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x16b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037", cAlternateFileName="06A8BF~1")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf29bb3b9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf29bb3b9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf406197f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x176831, dwReserved0=0x0, dwReserved1=0x0, cFileName="093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0", cAlternateFileName="093749~1")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc6f4968, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdc6f4968, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xddcf750d, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0x75b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203", cAlternateFileName="099799~1")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf26e66e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf26e66e6, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3796ea4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x6244d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173", cAlternateFileName="0E35FC~1")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeae672d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdeae672d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdf19b25c, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x319, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d", cAlternateFileName="0E7F22~1")) returned 1 [0186.865] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8afdfc3, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb8afdfc3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f", cAlternateFileName="0F7BDE~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cfd23c, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb7cfd23c, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x48aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674", cAlternateFileName="108EF4~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba15b18c, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xba15b18c, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba28c391, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x2f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae", cAlternateFileName="170D12~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89388662, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x89388662, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x897daaa5, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x780ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2", cAlternateFileName="189C80~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b85024, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b85024, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf4b6891c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x1495c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19e5a6240f137c4a1cf071859a4aeb3d9d0ebf907c21142ef769cfbd4d62b583", cAlternateFileName="19E5A6~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4479490, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb4479490, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb46b55a2, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="25365a8f39fbf4fd6d9a7acd7aa1443f509bde6738fa8267a4498bb27ca0106c", cAlternateFileName="25365A~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd02b0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x81dd02b0, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8283e777, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="25f9fbe9c828adb5370a558c9a3d624977aa91202481906f7785b7900def1b04", cAlternateFileName="25F9FB~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2863e61, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2863e61, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf36d82c1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x5e2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="2a0d12eaf601bee34ec27e259e078b544dc92f1da956845baf350faf15f2f147", cAlternateFileName="2A0D12~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86176f70, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86176f70, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="2a104f1151db024c6dfc5c9f9e68353b4e4a19ba1cec6a324debd22d6beb3b5b", cAlternateFileName="2A104F~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8a3f4c9, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb8a3f4c9, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8afdfc3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2a6007d66fbdc1f32b8041b89a7ad569ba5e85516e19287f45548ca357db277a", cAlternateFileName="2A6007~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83cf4eac, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x83cf4eac, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x88ee9d6d, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0xab877, dwReserved0=0x0, dwReserved1=0x0, cFileName="2c47102710a573389f9fec5352370c93db7b08a68475e056cbe941a5b8169dbd", cAlternateFileName="2C4710~1")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95bc6e4, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb95bc6e4, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb990378f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4f516, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ccc8d509e681fb142397dbfba6d9b71601cfdac670b1e0ca7bb6d2f25378a9d", cAlternateFileName="2CCC8D~1")) returned 1 [0186.867] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc72cbfb, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdc72cbfb, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xdd8d5fdd, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0x775c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e", cAlternateFileName="2DFA25~1")) returned 1 [0186.867] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ea0a65, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb7ea0a65, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1", cAlternateFileName="2EA548~1")) returned 1 [0186.867] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8270d4a1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x8270d4a1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc", cAlternateFileName="2F38C2~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd39f6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7ddd39f6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7e7833f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14", cAlternateFileName="30D2DA~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb225c038, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb225c038, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb27b8e78, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x1184e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f", cAlternateFileName="321E92~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c7b594, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb8c7b594, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8f03b6b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x602, dwReserved0=0x0, dwReserved1=0x0, cFileName="3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216", cAlternateFileName="3333CB~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae50fe7, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbae50fe7, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8", cAlternateFileName="334210~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde79f3ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xde79f3ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdf19b25c, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd", cAlternateFileName="33B80B~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a073931, ftCreationTime.dwHighDateTime=0x1d327d1, ftLastAccessTime.dwLowDateTime=0x3a073931, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x3a6dbeef, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745", cAlternateFileName="35F89B~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f22de2, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x84f22de2, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x0, dwReserved1=0x0, cFileName="3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45", cAlternateFileName="3FD722~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8934582, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb8934582, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8a3f4c9, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd", cAlternateFileName="4077B6~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea4ddd4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdea4ddd4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdf4e2622, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x4764, dwReserved0=0x0, dwReserved1=0x0, cFileName="40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856", cAlternateFileName="40E35B~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e0cded, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc8e0cded, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcac4cbca, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x889, dwReserved0=0x0, dwReserved1=0x0, cFileName="43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798", cAlternateFileName="43399E~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad460d0, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbad460d0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbaec3660, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f", cAlternateFileName="4841A6~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc62d932, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdc62d932, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xdec7ab57, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0x7638c, dwReserved0=0x0, dwReserved1=0x0, cFileName="48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7", cAlternateFileName="48E36E~1")) returned 1 [0186.868] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a74d39, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb7a74d39, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311", cAlternateFileName="4A35A1~1")) returned 1 [0186.869] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea4ddd4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdea4ddd4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdf19b25c, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43", cAlternateFileName="4B527F~1")) returned 1 [0186.869] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861c3423, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x861c3423, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x86ada3d2, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f092e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac", cAlternateFileName="4D3461~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2877956, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb2877956, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb39994e8, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x8dfaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b", cAlternateFileName="53065C~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82307515, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x82307515, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x83ebeafc, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0xd53, dwReserved0=0x0, dwReserved1=0x0, cFileName="53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30", cAlternateFileName="53E3FB~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeae672d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdeae672d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdf934a98, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x4150, dwReserved0=0x0, dwReserved1=0x0, cFileName="54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9", cAlternateFileName="54381F~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e0cded, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc8e0cded, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcad31a03, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x54aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4", cAlternateFileName="55B837~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2863e61, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2863e61, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf3c81c49, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x1139dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3", cAlternateFileName="5D09CE~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ef9014, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb9ef9014, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba219d9d, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596", cAlternateFileName="5D9F73~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5aabaa0, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb5aabaa0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa", cAlternateFileName="5DF1A4~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86092148, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86092148, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x861e9679, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x602, dwReserved0=0x0, dwReserved1=0x0, cFileName="60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7", cAlternateFileName="60C584~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1860cf4, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb1860cf4, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb1d4b543, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x9c42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe", cAlternateFileName="632570~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e8ee5a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x81e8ee5a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8283e777, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x7df, dwReserved0=0x0, dwReserved1=0x0, cFileName="656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605", cAlternateFileName="656363~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb989107c, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb989107c, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141", cAlternateFileName="665484~1")) returned 1 [0186.870] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbafaa21, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xbbafaa21, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x0, dwReserved1=0x0, cFileName="6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2", cAlternateFileName="6977AA~1")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbdfaa78, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdbdfaa78, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xddcf750d, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0xd4019, dwReserved0=0x0, dwReserved1=0x0, cFileName="6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970", cAlternateFileName="6C5760~1")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc63d732, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdc63d732, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xdea8ea0b, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0x74d7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd", cAlternateFileName="72845C~1")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b2b269, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x83b2b269, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8965d322, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0xc18f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0", cAlternateFileName="78B619~1")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a07864, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2a07864, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf471636d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x14b62d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f", cAlternateFileName="8149D7~1")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb068b5, ftCreationTime.dwHighDateTime=0x1d32737, ftLastAccessTime.dwLowDateTime=0xdcb068b5, ftLastAccessTime.dwHighDateTime=0x1d32737, ftLastWriteTime.dwLowDateTime=0xdeda3751, ftLastWriteTime.dwHighDateTime=0x1d32737, nFileSizeHigh=0x0, nFileSizeLow=0x6f0ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006", cAlternateFileName="846D70~1")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828fd33d, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x828fd33d, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x841937aa, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc", cAlternateFileName="869377~1")) returned 1 [0186.872] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86235b30, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86235b30, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x0, dwReserved1=0x0, cFileName="8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc", cAlternateFileName="8D3DD8~1")) returned 1 [0186.872] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a00cbfa, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x8a00cbfa, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8a2e18da, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x7de8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c", cAlternateFileName="8ED540~1")) returned 1 [0186.875] GetProcessHeap () returned 0xfd0000 [0186.875] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0186.875] GetProcessHeap () returned 0xfd0000 [0186.875] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0186.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf78aa81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1e2a2f0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0186.876] GetProcessHeap () returned 0xfd0000 [0186.876] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0186.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xdd597b03, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0186.878] GetProcessHeap () returned 0xfd0000 [0186.878] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xe8aa796b, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0186.902] GetProcessHeap () returned 0xfd0000 [0186.902] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.902] GetProcessHeap () returned 0xfd0000 [0186.902] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x51556bba, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.905] GetProcessHeap () returned 0xfd0000 [0186.905] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.905] GetProcessHeap () returned 0xfd0000 [0186.905] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe7d37eb5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.908] GetProcessHeap () returned 0xfd0000 [0186.908] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.908] GetProcessHeap () returned 0xfd0000 [0186.908] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdcb9ba8c, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.913] GetProcessHeap () returned 0xfd0000 [0186.913] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.913] GetProcessHeap () returned 0xfd0000 [0186.913] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaa6b70e0, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7ac0 [0186.917] GetProcessHeap () returned 0xfd0000 [0186.917] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.917] GetProcessHeap () returned 0xfd0000 [0186.917] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x25417c04, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0186.932] GetProcessHeap () returned 0xfd0000 [0186.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0186.932] GetProcessHeap () returned 0xfd0000 [0186.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0186.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaabc7b4a, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0187.124] GetProcessHeap () returned 0xfd0000 [0187.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.124] GetProcessHeap () returned 0xfd0000 [0187.124] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa6b72c16, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.127] GetProcessHeap () returned 0xfd0000 [0187.127] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.127] GetProcessHeap () returned 0xfd0000 [0187.127] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x821ae63c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.130] GetProcessHeap () returned 0xfd0000 [0187.130] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.130] GetProcessHeap () returned 0xfd0000 [0187.130] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8a8a5304, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.133] GetProcessHeap () returned 0xfd0000 [0187.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.133] GetProcessHeap () returned 0xfd0000 [0187.133] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x35a99a0d, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.136] GetProcessHeap () returned 0xfd0000 [0187.136] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.136] GetProcessHeap () returned 0xfd0000 [0187.136] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb0a11d08, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.139] GetProcessHeap () returned 0xfd0000 [0187.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.139] GetProcessHeap () returned 0xfd0000 [0187.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaa1a6676, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.143] GetProcessHeap () returned 0xfd0000 [0187.143] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.143] GetProcessHeap () returned 0xfd0000 [0187.143] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4605c7d4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.144] GetProcessHeap () returned 0xfd0000 [0187.145] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.145] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x49247e6e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="310091", cAlternateFileName="")) returned 1 [0187.145] GetProcessHeap () returned 0xfd0000 [0187.145] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x49247e6e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.145] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x49247e6e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.145] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49247e6e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0187.145] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4852ad82, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4852ad82, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0187.146] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4852ad82, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4852ad82, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 0 [0187.146] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0187.146] GetProcessHeap () returned 0xfd0000 [0187.146] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.146] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x19944238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="310093", cAlternateFileName="")) returned 1 [0187.146] GetProcessHeap () returned 0xfd0000 [0187.146] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x19944238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0187.148] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x19944238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.148] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee4d5d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3f0afb6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3f0afb6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x18ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="1504725120", cAlternateFileName="150472~1")) returned 1 [0187.148] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323cdb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe75647c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb97e2cd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0187.148] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323cdb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc06fd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb97e2cd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0187.148] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323cdb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc06fd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb97e2cd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 0 [0187.148] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0187.149] GetProcessHeap () returned 0xfd0000 [0187.149] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.149] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45ab2e45, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="onesettings_waas_featuremanagement", cAlternateFileName="ONESET~1")) returned 1 [0187.149] GetProcessHeap () returned 0xfd0000 [0187.149] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45ab2e45, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.149] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45ab2e45, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.149] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ab2e45, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c3165d0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0187.149] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4589cd4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4589cd4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c3165d0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0187.150] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4589cd4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4589cd4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9c3165d0, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 0 [0187.150] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0187.150] GetProcessHeap () returned 0xfd0000 [0187.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.150] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45ab2e45, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="onesettings_waas_featuremanagement", cAlternateFileName="ONESET~1")) returned 0 [0187.150] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0187.150] GetProcessHeap () returned 0xfd0000 [0187.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.150] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xdd597b03, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Creatives", cAlternateFileName="CREATI~1")) returned 0 [0187.150] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.150] GetProcessHeap () returned 0xfd0000 [0187.150] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.152] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf06a22a2, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf073ad70, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Features", cAlternateFileName="")) returned 1 [0187.152] GetProcessHeap () returned 0xfd0000 [0187.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf06a22a2, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf073ad70, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0187.153] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf06a22a2, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf073ad70, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.154] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf073ad70, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf07870ca, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="du.bin", cAlternateFileName="")) returned 1 [0187.154] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf073ad70, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf07870ca, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="du.bin", cAlternateFileName="")) returned 0 [0187.154] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0187.154] GetProcessHeap () returned 0xfd0000 [0187.154] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.154] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6112409, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StagedAssets", cAlternateFileName="STAGED~1")) returned 1 [0187.154] GetProcessHeap () returned 0xfd0000 [0187.154] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6112409, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0187.156] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6112409, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.156] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e3f831, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb381bf2f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb3cba331, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xa6aeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", cAlternateFileName="DBD5A1~1")) returned 1 [0187.157] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e3f831, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb381bf2f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb3cba331, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xa6aeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", cAlternateFileName="DBD5A1~1")) returned 0 [0187.157] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0187.157] GetProcessHeap () returned 0xfd0000 [0187.157] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.157] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6ca4042, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6ca4042, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TargetedContentCache", cAlternateFileName="TARGET~1")) returned 1 [0187.158] GetProcessHeap () returned 0xfd0000 [0187.158] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6ca4042, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6ca4042, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.158] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6ca4042, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6ca4042, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.158] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9ff77ac, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3", cAlternateFileName="")) returned 1 [0187.158] GetProcessHeap () returned 0xfd0000 [0187.158] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9ff77ac, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0187.159] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9ff77ac, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.159] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea1774fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="280813", cAlternateFileName="")) returned 1 [0187.159] GetProcessHeap () returned 0xfd0000 [0187.159] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\280813\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea1774fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7980 [0187.162] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea1774fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.162] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea046217, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea12b043, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x0, dwReserved1=0x0, cFileName="76c2f954cb8d4b4399c1ffc4efc3a907_1", cAlternateFileName="76C2F9~1")) returned 1 [0187.162] FindNextFileW (in: hFindFile=0x10b7980, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea046217, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea12b043, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x0, dwReserved1=0x0, cFileName="76c2f954cb8d4b4399c1ffc4efc3a907_1", cAlternateFileName="76C2F9~1")) returned 0 [0187.162] FindClose (in: hFindFile=0x10b7980 | out: hFindFile=0x10b7980) returned 1 [0187.163] GetProcessHeap () returned 0xfd0000 [0187.163] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.344] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea1774fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="280813", cAlternateFileName="")) returned 0 [0187.344] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0187.344] GetProcessHeap () returned 0xfd0000 [0187.344] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.344] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9ff77ac, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3", cAlternateFileName="")) returned 0 [0187.345] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0187.345] GetProcessHeap () returned 0xfd0000 [0187.345] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.347] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xc76b785f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tips", cAlternateFileName="")) returned 1 [0187.347] GetProcessHeap () returned 0xfd0000 [0187.347] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xc76b785f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.351] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xc76b785f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa875be89, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa875be89, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88d9622, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa88d9622, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc72d7f79, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc72d7f79, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73243e8, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc73243e8, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa894bd2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa894bd2e, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bae2c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa8bae2c7, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc766b3fd, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc766b3fd, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1 [0187.352] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc76b785f, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7370840, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7370840, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73bcca8, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc73bcca8, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f91119, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc6f91119, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7075c97, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7075c97, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75ac911, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc75ac911, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc761ef9f, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc761ef9f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa851fb40, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa851fb40, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86c3528, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa86c3528, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7409103, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7409103, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7455551, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7455551, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1 [0187.353] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7455551, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7455551, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0 [0187.353] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.354] GetProcessHeap () returned 0xfd0000 [0187.354] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.354] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xc76b785f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tips", cAlternateFileName="")) returned 0 [0187.354] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0187.354] GetProcessHeap () returned 0xfd0000 [0187.354] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.355] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.355] GetProcessHeap () returned 0xfd0000 [0187.355] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.355] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.356] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.356] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0187.356] GetProcessHeap () returned 0xfd0000 [0187.356] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.356] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.356] GetProcessHeap () returned 0xfd0000 [0187.356] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.357] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.357] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x765df54b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0187.357] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfbb19f3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xbfbb19f3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0187.357] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84031c7e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x84031c7e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x84031c7e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0187.358] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84031c7e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x84031c7e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x84031c7e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0187.358] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84031c7e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x84031c7e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x84031c7e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0187.358] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0187.358] GetProcessHeap () returned 0xfd0000 [0187.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.359] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddb58b47, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0187.359] GetProcessHeap () returned 0xfd0000 [0187.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddb58b47, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0187.359] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddb58b47, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.359] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddb58b47, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.359] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0187.359] GetProcessHeap () returned 0xfd0000 [0187.359] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.359] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0187.359] GetProcessHeap () returned 0xfd0000 [0187.359] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.360] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.360] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.360] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.360] GetProcessHeap () returned 0xfd0000 [0187.360] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.360] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0187.360] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0187.360] GetProcessHeap () returned 0xfd0000 [0187.360] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0187.361] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1 [0187.361] GetProcessHeap () returned 0xfd0000 [0187.361] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0187.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.362] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.362] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b47a04, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0187.362] GetProcessHeap () returned 0xfd0000 [0187.362] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b47a04, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.363] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b47a04, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.363] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01f6699, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCache", cAlternateFileName="")) returned 1 [0187.363] GetProcessHeap () returned 0xfd0000 [0187.363] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01f6699, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.364] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01f6699, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.364] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc23ad9f8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc23ad9f8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.364] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE77EECT", cAlternateFileName="")) returned 1 [0187.364] GetProcessHeap () returned 0xfd0000 [0187.364] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c86a16, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.365] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c86a16, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.365] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0187.366] GetProcessHeap () returned 0xfd0000 [0187.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0187.368] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.368] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0187.369] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.369] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x64ab274a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4760, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html", cAlternateFileName="C__WIN~1.HTM")) returned 1 [0187.369] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x39619610, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", cAlternateFileName="C__WIN~1.PNG")) returned 1 [0187.369] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x39619610, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", cAlternateFileName="C__WIN~1.PNG")) returned 0 [0187.369] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0187.370] GetProcessHeap () returned 0xfd0000 [0187.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.370] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9125365, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0187.370] GetProcessHeap () returned 0xfd0000 [0187.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9125365, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0187.374] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9125365, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.375] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x165c, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0187.375] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.375] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8ec2d67, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8ec2d67, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3cc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt", cAlternateFileName="C_D0E0~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8f0f23b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8f0f23b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x8744, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt", cAlternateFileName="C_647E~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8f3546b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8f3546b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7ab99073, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb85, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt", cAlternateFileName="C_EAA3~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8ff405a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8ff405a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa0ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt", cAlternateFileName="C_F04C~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9066771, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9066771, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x78cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt", cAlternateFileName="C_988E~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf908c9c9, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf908c9c9, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1c44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt", cAlternateFileName="C_82F5~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90d8e50, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90d8e50, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt", cAlternateFileName="C_2306~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90d8e50, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90d8e50, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x6a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt", cAlternateFileName="C_399E~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90d8e50, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90d8e50, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25359, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt", cAlternateFileName="C_503C~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf90ff0ac, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf90ff0ac, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd06a2f50, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ef39, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt", cAlternateFileName="C_4A93~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9125365, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x6426, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt", cAlternateFileName="C_1F20~1.TXT")) returned 1 [0187.376] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8cacc5f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8cacc5f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", cAlternateFileName="C__WIN~1.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8cacc5f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8cacc5f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc0f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt", cAlternateFileName="C__WIN~2.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8d91a84, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8d91a84, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5104, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt", cAlternateFileName="C__WIN~3.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e2a3f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e2a3f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7ab72e08, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x87c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt", cAlternateFileName="C__WIN~4.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e50659, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e50659, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt", cAlternateFileName="C_345C~1.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e50659, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e50659, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd067ccf2, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x48d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt", cAlternateFileName="C_BD17~1.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e768a9, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e768a9, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd0656a94, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x127f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt", cAlternateFileName="C_37E1~1.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e9cb14, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e9cb14, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd0656a94, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x576e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt", cAlternateFileName="C_0E6D~1.TXT")) returned 1 [0187.377] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf8e9cb14, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf8e9cb14, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd0656a94, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x576e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_9[1].txt", cAlternateFileName="C_0E6D~1.TXT")) returned 0 [0187.377] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0187.378] GetProcessHeap () returned 0xfd0000 [0187.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.378] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc23d3cb7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.378] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc23d3cb7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0187.378] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.378] GetProcessHeap () returned 0xfd0000 [0187.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.378] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE77EECT", cAlternateFileName="")) returned 0 [0187.379] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0187.379] GetProcessHeap () returned 0xfd0000 [0187.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.380] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x76cc803b, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x76cc803b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0187.380] GetProcessHeap () returned 0xfd0000 [0187.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x76cc803b, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x76cc803b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x76cc803b, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x76cc803b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc34d08bd, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc34d08bd, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc34d08bd, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76cc803b, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0x76cc803b, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x76cc803b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0xbfe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0187.382] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76cc803b, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0x76cc803b, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0x76cc803b, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0xbfe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0187.382] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.383] GetProcessHeap () returned 0xfd0000 [0187.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.383] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x466eaf94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x466eaf94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0187.383] GetProcessHeap () returned 0xfd0000 [0187.383] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x466eaf94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x466eaf94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.383] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x466eaf94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x466eaf94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.384] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc2b47205, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2b47205, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2b47205, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.384] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc2b47205, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2b47205, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2b47205, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0187.384] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0187.384] GetProcessHeap () returned 0xfd0000 [0187.384] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.384] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0187.384] GetProcessHeap () returned 0xfd0000 [0187.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.405] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.405] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.405] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.416] GetProcessHeap () returned 0xfd0000 [0187.416] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.416] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd036400a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0187.434] GetProcessHeap () returned 0xfd0000 [0187.434] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd036400a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.434] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd036400a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.435] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc4855d2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4855d2d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0187.435] GetProcessHeap () returned 0xfd0000 [0187.435] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc4855d2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4855d2d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0187.436] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc4855d2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4855d2d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.436] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0187.436] GetProcessHeap () returned 0xfd0000 [0187.436] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.439] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.439] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0187.439] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc487bf98, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04", cAlternateFileName="6BADA8~1")) returned 1 [0187.439] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0187.439] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 1 [0187.440] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 0 [0187.440] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0187.440] GetProcessHeap () returned 0xfd0000 [0187.440] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.440] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0187.441] GetProcessHeap () returned 0xfd0000 [0187.441] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.442] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.442] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0187.442] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc487bf98, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04", cAlternateFileName="6BADA8~1")) returned 1 [0187.442] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0187.442] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 1 [0187.442] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc48a21eb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="FB0D848F74F70BB2EAA93746D24D9749", cAlternateFileName="FB0D84~1")) returned 0 [0187.443] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0187.443] GetProcessHeap () returned 0xfd0000 [0187.443] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.443] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc487bf98, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc48a21eb, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc48a21eb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0187.443] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0187.443] GetProcessHeap () returned 0xfd0000 [0187.443] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.444] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0187.444] GetProcessHeap () returned 0xfd0000 [0187.444] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0187.444] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.444] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0187.444] GetProcessHeap () returned 0xfd0000 [0187.444] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0187.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.444] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.444] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6XK9396H", cAlternateFileName="")) returned 1 [0187.444] GetProcessHeap () returned 0xfd0000 [0187.444] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0187.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\6XK9396H\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.445] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.445] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.445] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0187.445] GetProcessHeap () returned 0xfd0000 [0187.445] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0187.445] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="91PWXIKE", cAlternateFileName="")) returned 1 [0187.445] GetProcessHeap () returned 0xfd0000 [0187.445] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0187.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\91PWXIKE\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0187.445] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.445] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x68c64a0c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.bing[1].xml", cAlternateFileName="WWWBIN~1.XML")) returned 1 [0187.445] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x68c64a0c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.bing[1].xml", cAlternateFileName="WWWBIN~1.XML")) returned 0 [0187.445] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0187.445] GetProcessHeap () returned 0xfd0000 [0187.446] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0187.446] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc87147, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc87147, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDSHWV0N", cAlternateFileName="")) returned 1 [0187.446] GetProcessHeap () returned 0xfd0000 [0187.446] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0187.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\BDSHWV0N\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc87147, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc87147, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0187.446] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc87147, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc87147, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.446] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc87147, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc87147, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x51d07118, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.windows[1].xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0187.446] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc87147, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc87147, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x51d07118, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.windows[1].xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0187.446] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0187.446] GetProcessHeap () returned 0xfd0000 [0187.446] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0187.446] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0187.446] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VD3M5B2U", cAlternateFileName="")) returned 1 [0187.446] GetProcessHeap () returned 0xfd0000 [0187.446] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0187.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\VD3M5B2U\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0187.447] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.447] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.447] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0187.447] GetProcessHeap () returned 0xfd0000 [0187.447] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0187.447] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VD3M5B2U", cAlternateFileName="")) returned 0 [0187.447] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.447] GetProcessHeap () returned 0xfd0000 [0187.447] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0187.447] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc370cc00, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc370cc00, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc370cc00, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 0 [0187.447] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0187.447] GetProcessHeap () returned 0xfd0000 [0187.447] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.449] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x823493b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x823493b7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0187.449] GetProcessHeap () returned 0xfd0000 [0187.449] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x823493b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x823493b7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.449] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x823493b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x823493b7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.449] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x823493b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x823493b7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.450] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.450] GetProcessHeap () returned 0xfd0000 [0187.450] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.450] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x823493b7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x823493b7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0187.450] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0187.450] GetProcessHeap () returned 0xfd0000 [0187.450] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.450] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0187.450] GetProcessHeap () returned 0xfd0000 [0187.450] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.450] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.450] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.450] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0187.450] GetProcessHeap () returned 0xfd0000 [0187.450] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.450] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0187.450] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.451] GetProcessHeap () returned 0xfd0000 [0187.451] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.451] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b93ea6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.452] GetProcessHeap () returned 0xfd0000 [0187.452] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b93ea6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0187.452] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b93ea6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.452] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd0d241fe, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xd0d241fe, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed DB", cAlternateFileName="INDEXE~1")) returned 1 [0187.452] GetProcessHeap () returned 0xfd0000 [0187.452] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd0d241fe, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xd0d241fe, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd0d241fe, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xd0d241fe, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x53318d6d, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x7a8fdb35, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x6b7909cc, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x983e23ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x481dc8bc, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00008.log", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x323353b6, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0xea54d171, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00009.log", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0xd0e2f271, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb0000A.log", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x3235b602, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x3235b602, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x7affe9be, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x24d4cff, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0187.455] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x5333eef9, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x680000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IndexedDB.edb", cAlternateFileName="INDEXE~1.EDB")) returned 1 [0187.456] SetEvent (hEvent=0x2e8) returned 1 [0187.456] ResetEvent (hEvent=0x2ec) returned 1 [0187.456] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4736f551, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4736f551, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6b7909cc, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IndexedDB.jfm", cAlternateFileName="INDEXE~1.JFM")) returned 1 [0187.456] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4736f551, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4736f551, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6b7909cc, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IndexedDB.jfm", cAlternateFileName="INDEXE~1.JFM")) returned 0 [0187.456] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0187.457] GetProcessHeap () returned 0xfd0000 [0187.457] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.457] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd0d241fe, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xd0d241fe, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed DB", cAlternateFileName="INDEXE~1")) returned 0 [0187.457] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0187.457] GetProcessHeap () returned 0xfd0000 [0187.457] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.457] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.457] GetProcessHeap () returned 0xfd0000 [0187.457] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.487] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.487] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.487] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.487] GetProcessHeap () returned 0xfd0000 [0187.487] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.488] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.488] GetProcessHeap () returned 0xfd0000 [0187.488] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0187.488] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.488] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbccaaf2e, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x97842c35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x97842c35, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppIconCache", cAlternateFileName="APPICO~1")) returned 1 [0187.488] GetProcessHeap () returned 0xfd0000 [0187.488] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbccaaf2e, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x97842c35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x97842c35, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.492] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbccaaf2e, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x97842c35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x97842c35, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.492] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38231567, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="100", cAlternateFileName="")) returned 1 [0187.492] GetProcessHeap () returned 0xfd0000 [0187.492] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38231567, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.524] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38231567, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.541] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{0079A0FC-58F2-467F-9294-6309B1E659EF}", cAlternateFileName="{0079A~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5a769e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5a769e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{034FA7ED-D1B4-4D9A-971D-782B8715E040}", cAlternateFileName="{034FA~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988a6f4d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x988a6f4d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{05A060EB-5890-4344-9370-DC1E06EC42BA}", cAlternateFileName="{05A06~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98703565, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98703565, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{06A6D43F-8744-4A41-B9CE-FFA8570069CC}", cAlternateFileName="{06A6D~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98703565, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98703565, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07E7709A-2252-4F64-93C1-4DBAB210817B}", cAlternateFileName="{07E77~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3806791c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3806791c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{095069DB-9C71-4A14-B8D7-97E8B3310415}", cAlternateFileName="{09506~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50cb229, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb50cb229, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{0B9E8261-988B-4055-82FD-728741FA7859}", cAlternateFileName="{0B9E8~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{105794B2-E9C9-44C8-ACF6-B7C0B365698C}", cAlternateFileName="{10579~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b6d8969, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b6d8969, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1266D82E-09AF-4573-B530-14687B493988}", cAlternateFileName="{1266D~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98834842, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98834842, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}", cAlternateFileName="{1312A~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b74b076, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b74b076, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13195EA8-15F2-47D9-A532-E81062D4B757}", cAlternateFileName="{13195~1")) returned 1 [0187.542] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}", cAlternateFileName="{16DAF~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98775c73, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98775c73, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}", cAlternateFileName="{197DF~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}", cAlternateFileName="{1E2A2~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993d3fe9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x993d3fe9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{238B3853-BA53-44A6-88BA-A0867B43ED76}", cAlternateFileName="{238B3~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{25F897FC-E052-47D8-81FA-058F7D44DB07}", cAlternateFileName="{25F89~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5100e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb5100e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{27F05FEC-A9C6-4C1E-B218-39AC437A0419}", cAlternateFileName="{27F05~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{2ADB8C14-DCB4-40AE-8D64-88007C912021}", cAlternateFileName="{2ADB8~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4fb205, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xee4fb205, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{2BC99385-EF59-444C-A32A-68291A8E5017}", cAlternateFileName="{2BC99~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3817298a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3817298a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}", cAlternateFileName="{2C933~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1f5fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d1f5fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{2E978839-21C5-49A6-AD08-F9DAFC903070}", cAlternateFileName="{2E978~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b7bc11, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98b7bc11, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33305276-2049-4128-AEEC-B9A21214B851}", cAlternateFileName="{33305~1")) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380416c0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380416c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3C789AEE-6106-4384-B319-0C96E1E71678}", cAlternateFileName="{3C789~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98bee32e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98bee32e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}", cAlternateFileName="{3CE01~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3DB05D28-F3C3-449E-B7A6-31F664B2660E}", cAlternateFileName="{3DB05~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d6baad, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d6baad, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}", cAlternateFileName="{4A8A0~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3817298a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3817298a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}", cAlternateFileName="{4BCD2~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4CCC5AFB-555C-44D5-892C-F0F2617C631D}", cAlternateFileName="{4CCC5~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4DC87667-8E09-4718-960C-CACE353718FC}", cAlternateFileName="{4DC87~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}", cAlternateFileName="{4E705~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{51B0B7BF-2B1A-4FE9-8814-408CD303875D}", cAlternateFileName="{51B0B~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5202C284-5887-45AA-A00F-FDE7E88E85ED}", cAlternateFileName="{5202C~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{530FD476-4A81-49DE-B228-C202EACB8F92}", cAlternateFileName="{530FD~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{53F21F3D-8237-4CEC-A18E-8D26D784916C}", cAlternateFileName="{53F21~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98c14584, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98c14584, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5534E575-0865-48C0-B802-046F4903AAF0}", cAlternateFileName="{5534E~1")) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1f5fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d1f5fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5567FA0F-AE06-4D14-B697-1F596323F48A}", cAlternateFileName="{5567F~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9920a3b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9920a3b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}", cAlternateFileName="{5637C~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{56628538-F2B6-49FB-9D10-354E728724C4}", cAlternateFileName="{56628~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{58BFC882-C01D-4396-BF26-A55720BADA37}", cAlternateFileName="{58BFC~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a88a0b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x99a88a0b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}", cAlternateFileName="{5AB00~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0585cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0585cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5DB529E8-8819-4E86-B114-23BA7B771028}", cAlternateFileName="{5DB52~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9920a3b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9920a3b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4216695a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{60B864E9-702F-47ED-951E-4744ED9F9767}", cAlternateFileName="{60B86~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995ea0f7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x995ea0f7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6BB31C2E-FA0C-4956-A18E-B11812B9C486}", cAlternateFileName="{6BB31~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a294928, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a294928, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}", cAlternateFileName="{6BF1E~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9e1c82, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a9e1c82, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}", cAlternateFileName="{6EB6C~1")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9925685a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9925685a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="{74E006B5-03B7-499C-A87A-98C01F00642C}", cAlternateFileName="{74E00~1")) returned 1 [0187.926] GetProcessHeap () returned 0xfd0000 [0187.926] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.926] GetProcessHeap () returned 0xfd0000 [0187.926] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.926] GetProcessHeap () returned 0xfd0000 [0187.926] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2412562, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3bf615b5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3bf615b5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0187.928] GetProcessHeap () returned 0xfd0000 [0187.928] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x439aeafc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.932] GetProcessHeap () returned 0xfd0000 [0187.932] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.932] GetProcessHeap () returned 0xfd0000 [0187.932] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249cf976, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24d16d3f, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.934] GetProcessHeap () returned 0xfd0000 [0187.934] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.934] GetProcessHeap () returned 0xfd0000 [0187.934] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x31247c5d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.937] GetProcessHeap () returned 0xfd0000 [0187.937] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.937] GetProcessHeap () returned 0xfd0000 [0187.937] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d1109, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24f7384, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0187.939] GetProcessHeap () returned 0xfd0000 [0187.939] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.939] GetProcessHeap () returned 0xfd0000 [0187.939] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525872ee, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.942] GetProcessHeap () returned 0xfd0000 [0187.942] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.942] GetProcessHeap () returned 0xfd0000 [0187.942] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.945] GetProcessHeap () returned 0xfd0000 [0187.945] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.945] GetProcessHeap () returned 0xfd0000 [0187.945] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.945] GetProcessHeap () returned 0xfd0000 [0187.945] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42f8885, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x520331de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x520331de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.946] GetProcessHeap () returned 0xfd0000 [0187.946] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.946] GetProcessHeap () returned 0xfd0000 [0187.946] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\Flighting\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1edc172b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.947] GetProcessHeap () returned 0xfd0000 [0187.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.947] GetProcessHeap () returned 0xfd0000 [0187.947] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.948] GetProcessHeap () returned 0xfd0000 [0187.948] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd082fb18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0187.949] GetProcessHeap () returned 0xfd0000 [0187.949] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.949] GetProcessHeap () returned 0xfd0000 [0187.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.949] GetProcessHeap () returned 0xfd0000 [0187.949] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.949] GetProcessHeap () returned 0xfd0000 [0187.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda246550, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda246550, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda246550, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0187.949] GetProcessHeap () returned 0xfd0000 [0187.949] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.949] GetProcessHeap () returned 0xfd0000 [0187.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.950] GetProcessHeap () returned 0xfd0000 [0187.950] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0187.950] GetProcessHeap () returned 0xfd0000 [0187.950] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0187.950] GetProcessHeap () returned 0xfd0000 [0187.950] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0187.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0187.972] GetProcessHeap () returned 0xfd0000 [0187.972] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.975] GetProcessHeap () returned 0xfd0000 [0187.975] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.976] GetProcessHeap () returned 0xfd0000 [0187.976] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.976] GetProcessHeap () returned 0xfd0000 [0187.976] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0187.977] GetProcessHeap () returned 0xfd0000 [0187.977] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.977] GetProcessHeap () returned 0xfd0000 [0187.977] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.977] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.977] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.977] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.977] GetProcessHeap () returned 0xfd0000 [0187.977] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.977] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0187.978] GetProcessHeap () returned 0xfd0000 [0187.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0187.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0187.978] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.978] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.978] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0187.978] GetProcessHeap () returned 0xfd0000 [0187.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0187.978] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0187.978] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.978] GetProcessHeap () returned 0xfd0000 [0187.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.978] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.978] GetProcessHeap () returned 0xfd0000 [0187.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0187.978] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.979] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.979] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0187.979] GetProcessHeap () returned 0xfd0000 [0187.979] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.979] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.979] GetProcessHeap () returned 0xfd0000 [0187.979] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0187.979] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.980] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.980] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0187.980] GetProcessHeap () returned 0xfd0000 [0187.980] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.980] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.980] GetProcessHeap () returned 0xfd0000 [0187.980] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.982] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.982] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.982] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.982] GetProcessHeap () returned 0xfd0000 [0187.982] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.982] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.982] GetProcessHeap () returned 0xfd0000 [0187.982] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0187.982] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.982] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.982] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0187.982] GetProcessHeap () returned 0xfd0000 [0187.982] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.982] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.982] GetProcessHeap () returned 0xfd0000 [0187.982] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0187.983] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.983] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0187.983] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0187.983] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0187.984] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0187.984] GetProcessHeap () returned 0xfd0000 [0187.984] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.984] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0187.984] GetProcessHeap () returned 0xfd0000 [0187.984] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0187.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0187.984] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.984] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.984] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0187.984] GetProcessHeap () returned 0xfd0000 [0187.984] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0187.984] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.059] GetProcessHeap () returned 0xfd0000 [0188.059] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.082] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.082] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.083] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.083] GetProcessHeap () returned 0xfd0000 [0188.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.083] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.083] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.083] GetProcessHeap () returned 0xfd0000 [0188.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.084] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.MOD")) returned 1 [0188.084] GetProcessHeap () returned 0xfd0000 [0188.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.086] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.086] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.086] GetProcessHeap () returned 0xfd0000 [0188.086] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.089] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.089] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.089] GetProcessHeap () returned 0xfd0000 [0188.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.091] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.091] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.091] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.091] GetProcessHeap () returned 0xfd0000 [0188.091] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.091] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.091] GetProcessHeap () returned 0xfd0000 [0188.091] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.092] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.092] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.092] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.092] GetProcessHeap () returned 0xfd0000 [0188.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.092] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.092] GetProcessHeap () returned 0xfd0000 [0188.092] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.092] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.092] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.092] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.092] GetProcessHeap () returned 0xfd0000 [0188.092] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.092] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.093] GetProcessHeap () returned 0xfd0000 [0188.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.093] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.093] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.093] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.093] GetProcessHeap () returned 0xfd0000 [0188.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.093] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.093] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.093] GetProcessHeap () returned 0xfd0000 [0188.093] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.093] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.093] GetProcessHeap () returned 0xfd0000 [0188.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.094] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.094] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.094] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.094] GetProcessHeap () returned 0xfd0000 [0188.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.094] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.094] GetProcessHeap () returned 0xfd0000 [0188.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.096] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.096] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.096] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.096] GetProcessHeap () returned 0xfd0000 [0188.096] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.096] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.096] GetProcessHeap () returned 0xfd0000 [0188.096] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.097] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.097] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.097] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.097] GetProcessHeap () returned 0xfd0000 [0188.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.097] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.097] GetProcessHeap () returned 0xfd0000 [0188.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.097] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.097] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.097] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.097] GetProcessHeap () returned 0xfd0000 [0188.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.097] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.097] GetProcessHeap () returned 0xfd0000 [0188.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.098] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.098] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.098] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.098] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0188.098] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.098] GetProcessHeap () returned 0xfd0000 [0188.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.098] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.098] GetProcessHeap () returned 0xfd0000 [0188.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0188.098] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.098] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.099] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0188.099] GetProcessHeap () returned 0xfd0000 [0188.099] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.099] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.099] GetProcessHeap () returned 0xfd0000 [0188.099] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.099] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.099] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.099] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.099] GetProcessHeap () returned 0xfd0000 [0188.099] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.099] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.099] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.099] GetProcessHeap () returned 0xfd0000 [0188.099] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.100] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy", cAlternateFileName="MICROS~2.OOB")) returned 1 [0188.101] GetProcessHeap () returned 0xfd0000 [0188.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.111] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.111] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.111] GetProcessHeap () returned 0xfd0000 [0188.111] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0188.114] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.114] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.114] GetProcessHeap () returned 0xfd0000 [0188.114] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.115] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.115] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.115] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.115] GetProcessHeap () returned 0xfd0000 [0188.115] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.115] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.115] GetProcessHeap () returned 0xfd0000 [0188.115] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0188.116] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.116] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.116] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0188.116] GetProcessHeap () returned 0xfd0000 [0188.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.116] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.116] GetProcessHeap () returned 0xfd0000 [0188.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.116] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.116] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.116] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.116] GetProcessHeap () returned 0xfd0000 [0188.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.116] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.117] GetProcessHeap () returned 0xfd0000 [0188.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.117] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.117] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.117] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.117] GetProcessHeap () returned 0xfd0000 [0188.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.117] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.117] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0188.117] GetProcessHeap () returned 0xfd0000 [0188.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.117] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.117] GetProcessHeap () returned 0xfd0000 [0188.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.118] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.118] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.118] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.118] GetProcessHeap () returned 0xfd0000 [0188.118] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.118] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.118] GetProcessHeap () returned 0xfd0000 [0188.118] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.119] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.119] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.119] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.119] GetProcessHeap () returned 0xfd0000 [0188.119] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.119] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.119] GetProcessHeap () returned 0xfd0000 [0188.119] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.119] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.119] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.119] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.119] GetProcessHeap () returned 0xfd0000 [0188.119] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.119] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.119] GetProcessHeap () returned 0xfd0000 [0188.119] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.120] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.120] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.120] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.120] GetProcessHeap () returned 0xfd0000 [0188.120] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.120] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.120] GetProcessHeap () returned 0xfd0000 [0188.120] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.120] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.120] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.120] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.121] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0188.121] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.121] GetProcessHeap () returned 0xfd0000 [0188.121] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.121] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.121] GetProcessHeap () returned 0xfd0000 [0188.121] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.121] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.121] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.121] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.121] GetProcessHeap () returned 0xfd0000 [0188.121] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.121] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.121] GetProcessHeap () returned 0xfd0000 [0188.121] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.122] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.122] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.122] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.122] GetProcessHeap () returned 0xfd0000 [0188.122] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.122] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.122] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.122] GetProcessHeap () returned 0xfd0000 [0188.122] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.123] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy", cAlternateFileName="MICROS~1.OOB")) returned 1 [0188.123] GetProcessHeap () returned 0xfd0000 [0188.123] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.125] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.125] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.125] GetProcessHeap () returned 0xfd0000 [0188.125] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.129] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.129] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.130] GetProcessHeap () returned 0xfd0000 [0188.130] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.131] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.131] GetProcessHeap () returned 0xfd0000 [0188.131] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.131] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.131] GetProcessHeap () returned 0xfd0000 [0188.131] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.131] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.131] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.198] GetProcessHeap () returned 0xfd0000 [0188.198] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.199] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.199] GetProcessHeap () returned 0xfd0000 [0188.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.199] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.199] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.199] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.199] GetProcessHeap () returned 0xfd0000 [0188.199] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.199] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.199] GetProcessHeap () returned 0xfd0000 [0188.199] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.199] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.199] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.200] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.200] GetProcessHeap () returned 0xfd0000 [0188.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.200] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.200] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.200] GetProcessHeap () returned 0xfd0000 [0188.200] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.200] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.200] GetProcessHeap () returned 0xfd0000 [0188.200] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.201] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.201] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.201] GetProcessHeap () returned 0xfd0000 [0188.201] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.201] GetProcessHeap () returned 0xfd0000 [0188.201] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.201] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.201] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.202] GetProcessHeap () returned 0xfd0000 [0188.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.202] GetProcessHeap () returned 0xfd0000 [0188.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.202] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.202] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.202] GetProcessHeap () returned 0xfd0000 [0188.202] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.202] GetProcessHeap () returned 0xfd0000 [0188.202] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.203] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.203] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.203] GetProcessHeap () returned 0xfd0000 [0188.203] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.203] GetProcessHeap () returned 0xfd0000 [0188.203] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.203] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0188.204] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.204] GetProcessHeap () returned 0xfd0000 [0188.204] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.204] GetProcessHeap () returned 0xfd0000 [0188.204] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.204] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.204] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.204] GetProcessHeap () returned 0xfd0000 [0188.204] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.204] GetProcessHeap () returned 0xfd0000 [0188.204] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.205] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.205] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.205] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.205] GetProcessHeap () returned 0xfd0000 [0188.205] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.205] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.205] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.205] GetProcessHeap () returned 0xfd0000 [0188.205] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.206] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1 [0188.206] GetProcessHeap () returned 0xfd0000 [0188.206] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.208] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.209] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3722267d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3722267d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.209] GetProcessHeap () returned 0xfd0000 [0188.209] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3722267d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3722267d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.212] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3722267d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3722267d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.212] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.212] GetProcessHeap () returned 0xfd0000 [0188.212] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0188.213] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.213] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.213] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0188.214] GetProcessHeap () returned 0xfd0000 [0188.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.214] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.214] GetProcessHeap () returned 0xfd0000 [0188.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.214] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.214] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.214] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.214] GetProcessHeap () returned 0xfd0000 [0188.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.214] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.214] GetProcessHeap () returned 0xfd0000 [0188.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.214] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.215] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.215] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.215] GetProcessHeap () returned 0xfd0000 [0188.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.215] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.215] GetProcessHeap () returned 0xfd0000 [0188.215] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.215] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.215] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.215] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.215] GetProcessHeap () returned 0xfd0000 [0188.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.215] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.215] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.215] GetProcessHeap () returned 0xfd0000 [0188.215] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.215] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.215] GetProcessHeap () returned 0xfd0000 [0188.215] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.216] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.216] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.216] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.216] GetProcessHeap () returned 0xfd0000 [0188.216] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.216] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.216] GetProcessHeap () returned 0xfd0000 [0188.216] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.217] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.217] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.217] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.217] GetProcessHeap () returned 0xfd0000 [0188.217] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.217] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.217] GetProcessHeap () returned 0xfd0000 [0188.217] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.218] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.218] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.218] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.218] GetProcessHeap () returned 0xfd0000 [0188.218] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.218] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.218] GetProcessHeap () returned 0xfd0000 [0188.218] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.219] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.219] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.219] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.219] GetProcessHeap () returned 0xfd0000 [0188.219] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.219] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.219] GetProcessHeap () returned 0xfd0000 [0188.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.221] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.221] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8255f469, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.221] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd95a74d6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.221] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd9108aa5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd9108aa5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd9108aa5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0188.221] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd9108aa5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd9108aa5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd9108aa5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0188.221] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd9108aa5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd9108aa5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd9108aa5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0188.221] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.222] GetProcessHeap () returned 0xfd0000 [0188.222] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.222] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x734de9c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.222] GetProcessHeap () returned 0xfd0000 [0188.222] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x734de9c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.223] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x734de9c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.223] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x734de9c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.223] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.223] GetProcessHeap () returned 0xfd0000 [0188.223] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.223] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.223] GetProcessHeap () returned 0xfd0000 [0188.223] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.223] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.223] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.223] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.223] GetProcessHeap () returned 0xfd0000 [0188.223] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.223] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.224] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.224] GetProcessHeap () returned 0xfd0000 [0188.224] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.225] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1 [0188.225] GetProcessHeap () returned 0xfd0000 [0188.225] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.227] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.227] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37484b36, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37484b36, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.227] GetProcessHeap () returned 0xfd0000 [0188.227] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37484b36, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37484b36, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.229] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37484b36, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37484b36, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.230] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.230] GetProcessHeap () returned 0xfd0000 [0188.230] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.231] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.231] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.231] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.231] GetProcessHeap () returned 0xfd0000 [0188.231] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.231] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.231] GetProcessHeap () returned 0xfd0000 [0188.231] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.231] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.231] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.231] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.232] GetProcessHeap () returned 0xfd0000 [0188.232] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.232] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.232] GetProcessHeap () returned 0xfd0000 [0188.232] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.232] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.232] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.232] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.232] GetProcessHeap () returned 0xfd0000 [0188.232] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.232] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.232] GetProcessHeap () returned 0xfd0000 [0188.232] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.233] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.233] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.233] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.233] GetProcessHeap () returned 0xfd0000 [0188.233] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.233] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.233] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.233] GetProcessHeap () returned 0xfd0000 [0188.233] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.233] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.233] GetProcessHeap () returned 0xfd0000 [0188.233] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.234] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.234] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.234] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.234] GetProcessHeap () returned 0xfd0000 [0188.234] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.234] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e919b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.234] GetProcessHeap () returned 0xfd0000 [0188.234] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e919b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.235] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e919b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.235] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e919b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.235] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.235] GetProcessHeap () returned 0xfd0000 [0188.235] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.235] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32a78e7c, ftLastAccessTime.dwHighDateTime=0x1d32756, ftLastWriteTime.dwLowDateTime=0x32a78e7c, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.235] GetProcessHeap () returned 0xfd0000 [0188.235] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32a78e7c, ftLastAccessTime.dwHighDateTime=0x1d32756, ftLastWriteTime.dwLowDateTime=0x32a78e7c, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.237] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32a78e7c, ftLastAccessTime.dwHighDateTime=0x1d32756, ftLastWriteTime.dwLowDateTime=0x32a78e7c, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.238] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a76bd16, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3a76bd16, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3b62c681, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaDb.v1.sqlite", cAlternateFileName="MEDIAD~1.SQL")) returned 1 [0188.238] SetEvent (hEvent=0x2e8) returned 1 [0188.238] ResetEvent (hEvent=0x2ec) returned 1 [0188.238] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b7f5dee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3b7f5dee, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x31a54b0b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaDb.v1.sqlite-shm", cAlternateFileName="MEDIAD~3.SQL")) returned 1 [0188.238] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b7f4a5b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3b7f4a5b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x153fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaDb.v1.sqlite-wal", cAlternateFileName="MEDIAD~2.SQL")) returned 1 [0188.238] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32922ee1, ftCreationTime.dwHighDateTime=0x1d32756, ftLastAccessTime.dwLowDateTime=0xd0ee01ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x32922ee1, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotosAppTile", cAlternateFileName="PHOTOS~1")) returned 1 [0188.238] GetProcessHeap () returned 0xfd0000 [0188.238] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTile\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32922ee1, ftCreationTime.dwHighDateTime=0x1d32756, ftLastAccessTime.dwLowDateTime=0xd0ee01ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x32922ee1, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.244] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32922ee1, ftCreationTime.dwHighDateTime=0x1d32756, ftLastAccessTime.dwLowDateTime=0xd0ee01ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x32922ee1, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.244] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32922ee1, ftCreationTime.dwHighDateTime=0x1d32756, ftLastAccessTime.dwLowDateTime=0xd0ee01ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x32922ee1, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.244] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.244] GetProcessHeap () returned 0xfd0000 [0188.244] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.244] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29209045, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x29209045, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotosAppTracing_BGTask.etl", cAlternateFileName="PHOTOS~1.ETL")) returned 1 [0188.244] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe551b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3fe551b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xbc77712b, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotosAppTracing_BGTask.last.etl", cAlternateFileName="PHOTOS~2.ETL")) returned 1 [0188.244] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe551b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3fe551b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xbc77712b, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotosAppTracing_BGTask.last.etl", cAlternateFileName="PHOTOS~2.ETL")) returned 0 [0188.245] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.246] GetProcessHeap () returned 0xfd0000 [0188.246] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.358] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fcdfb62, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.358] GetProcessHeap () returned 0xfd0000 [0188.358] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fcdfb62, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.366] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fcdfb62, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.366] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fcdfb62, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.366] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.366] GetProcessHeap () returned 0xfd0000 [0188.366] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.366] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.366] GetProcessHeap () returned 0xfd0000 [0188.366] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.368] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.368] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1fd05db4, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.368] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36332b5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x32de8aed, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.368] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2aa792ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2aa792ec, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2aa792ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0188.368] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2aa792ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2aa792ec, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2aa792ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0188.368] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2aa792ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x2aa792ec, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2aa792ec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0188.369] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.369] GetProcessHeap () returned 0xfd0000 [0188.369] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.369] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec8930d8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.369] GetProcessHeap () returned 0xfd0000 [0188.369] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec8930d8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.370] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec8930d8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.370] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec8930d8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.370] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.370] GetProcessHeap () returned 0xfd0000 [0188.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.370] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.370] GetProcessHeap () returned 0xfd0000 [0188.370] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.370] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.370] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.370] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.370] GetProcessHeap () returned 0xfd0000 [0188.370] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.370] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.371] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.371] GetProcessHeap () returned 0xfd0000 [0188.371] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.372] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", cAlternateFileName="MICROS~3.SEC")) returned 1 [0188.372] GetProcessHeap () returned 0xfd0000 [0188.372] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.374] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.374] GetProcessHeap () returned 0xfd0000 [0188.374] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.376] GetProcessHeap () returned 0xfd0000 [0188.377] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.378] GetProcessHeap () returned 0xfd0000 [0188.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.378] GetProcessHeap () returned 0xfd0000 [0188.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.378] GetProcessHeap () returned 0xfd0000 [0188.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.378] GetProcessHeap () returned 0xfd0000 [0188.378] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.378] GetProcessHeap () returned 0xfd0000 [0188.378] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.379] GetProcessHeap () returned 0xfd0000 [0188.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.379] GetProcessHeap () returned 0xfd0000 [0188.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.379] GetProcessHeap () returned 0xfd0000 [0188.379] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.379] GetProcessHeap () returned 0xfd0000 [0188.379] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.380] GetProcessHeap () returned 0xfd0000 [0188.380] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.380] GetProcessHeap () returned 0xfd0000 [0188.380] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.380] GetProcessHeap () returned 0xfd0000 [0188.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.381] GetProcessHeap () returned 0xfd0000 [0188.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.381] GetProcessHeap () returned 0xfd0000 [0188.381] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.381] GetProcessHeap () returned 0xfd0000 [0188.381] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.382] GetProcessHeap () returned 0xfd0000 [0188.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.382] GetProcessHeap () returned 0xfd0000 [0188.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.382] GetProcessHeap () returned 0xfd0000 [0188.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.382] GetProcessHeap () returned 0xfd0000 [0188.382] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0188.382] GetProcessHeap () returned 0xfd0000 [0188.382] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.383] GetProcessHeap () returned 0xfd0000 [0188.383] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1028226, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.383] GetProcessHeap () returned 0xfd0000 [0188.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.383] GetProcessHeap () returned 0xfd0000 [0188.383] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.384] GetProcessHeap () returned 0xfd0000 [0188.384] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.387] GetProcessHeap () returned 0xfd0000 [0188.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x377598d9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x377598d9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.389] GetProcessHeap () returned 0xfd0000 [0188.389] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f5ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.400] GetProcessHeap () returned 0xfd0000 [0188.400] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.400] GetProcessHeap () returned 0xfd0000 [0188.400] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f9e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.401] GetProcessHeap () returned 0xfd0000 [0188.401] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.401] GetProcessHeap () returned 0xfd0000 [0188.401] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107fe0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0188.402] GetProcessHeap () returned 0xfd0000 [0188.402] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.402] GetProcessHeap () returned 0xfd0000 [0188.402] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd108027c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833d38ba, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.402] GetProcessHeap () returned 0xfd0000 [0188.402] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.402] GetProcessHeap () returned 0xfd0000 [0188.402] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.402] GetProcessHeap () returned 0xfd0000 [0188.402] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10808b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833ad684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.403] GetProcessHeap () returned 0xfd0000 [0188.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.403] GetProcessHeap () returned 0xfd0000 [0188.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1080f06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833ad684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.403] GetProcessHeap () returned 0xfd0000 [0188.403] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.403] GetProcessHeap () returned 0xfd0000 [0188.403] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10812d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8333af6e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.404] GetProcessHeap () returned 0xfd0000 [0188.404] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.404] GetProcessHeap () returned 0xfd0000 [0188.404] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10816d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8336128a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0188.404] GetProcessHeap () returned 0xfd0000 [0188.404] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.404] GetProcessHeap () returned 0xfd0000 [0188.404] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.410] GetProcessHeap () returned 0xfd0000 [0188.410] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.410] GetProcessHeap () returned 0xfd0000 [0188.410] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70e206ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.411] GetProcessHeap () returned 0xfd0000 [0188.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.411] GetProcessHeap () returned 0xfd0000 [0188.411] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd111a2b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8336128a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.411] GetProcessHeap () returned 0xfd0000 [0188.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.411] GetProcessHeap () returned 0xfd0000 [0188.411] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.414] GetProcessHeap () returned 0xfd0000 [0188.414] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702a7000, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.416] GetProcessHeap () returned 0xfd0000 [0188.416] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x702a7000, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.540] GetProcessHeap () returned 0xfd0000 [0188.540] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.541] GetProcessHeap () returned 0xfd0000 [0188.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.541] GetProcessHeap () returned 0xfd0000 [0188.541] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.541] GetProcessHeap () returned 0xfd0000 [0188.541] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.541] GetProcessHeap () returned 0xfd0000 [0188.541] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.542] GetProcessHeap () returned 0xfd0000 [0188.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.542] GetProcessHeap () returned 0xfd0000 [0188.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.554] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.554] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.555] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.555] GetProcessHeap () returned 0xfd0000 [0188.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.555] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.555] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.555] GetProcessHeap () returned 0xfd0000 [0188.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.555] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.555] GetProcessHeap () returned 0xfd0000 [0188.555] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.555] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.555] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.555] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.555] GetProcessHeap () returned 0xfd0000 [0188.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.555] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.556] GetProcessHeap () returned 0xfd0000 [0188.556] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.556] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.556] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.556] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.556] GetProcessHeap () returned 0xfd0000 [0188.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.556] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.556] GetProcessHeap () returned 0xfd0000 [0188.556] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.557] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.557] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.557] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.557] GetProcessHeap () returned 0xfd0000 [0188.557] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.557] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.557] GetProcessHeap () returned 0xfd0000 [0188.557] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0188.557] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.557] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.557] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0188.557] GetProcessHeap () returned 0xfd0000 [0188.557] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.557] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70280da4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.558] GetProcessHeap () returned 0xfd0000 [0188.558] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70280da4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.558] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70280da4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.558] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70280da4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70280da4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70280da4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.558] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.559] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0188.559] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.559] GetProcessHeap () returned 0xfd0000 [0188.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.559] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.559] GetProcessHeap () returned 0xfd0000 [0188.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.559] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.559] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.559] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.559] GetProcessHeap () returned 0xfd0000 [0188.559] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.559] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.560] GetProcessHeap () returned 0xfd0000 [0188.560] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.560] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.560] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.560] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.560] GetProcessHeap () returned 0xfd0000 [0188.560] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.560] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.561] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.561] GetProcessHeap () returned 0xfd0000 [0188.561] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.562] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1 [0188.563] GetProcessHeap () returned 0xfd0000 [0188.563] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.563] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.563] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37a7aa93, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37a7aa93, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.563] GetProcessHeap () returned 0xfd0000 [0188.563] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37a7aa93, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37a7aa93, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.565] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37a7aa93, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37a7aa93, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.565] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.565] GetProcessHeap () returned 0xfd0000 [0188.565] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0188.566] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.566] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.566] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0188.566] GetProcessHeap () returned 0xfd0000 [0188.566] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.566] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.566] GetProcessHeap () returned 0xfd0000 [0188.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.567] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.567] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.567] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.567] GetProcessHeap () returned 0xfd0000 [0188.567] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.567] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.567] GetProcessHeap () returned 0xfd0000 [0188.567] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.567] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.567] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.567] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.567] GetProcessHeap () returned 0xfd0000 [0188.568] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.568] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c7936, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0188.568] GetProcessHeap () returned 0xfd0000 [0188.568] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c7936, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.568] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c7936, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.568] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0ef72fe, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0188.568] GetProcessHeap () returned 0xfd0000 [0188.568] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0188.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Microsoft\\Windows\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0ef72fe, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.569] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0ef72fe, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.569] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0ef72fe, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.569] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.569] GetProcessHeap () returned 0xfd0000 [0188.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0188.569] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0ef72fe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc0ef72fe, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc0ef72fe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0188.569] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.569] GetProcessHeap () returned 0xfd0000 [0188.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.569] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.570] GetProcessHeap () returned 0xfd0000 [0188.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.570] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.570] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.570] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.570] GetProcessHeap () returned 0xfd0000 [0188.570] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.570] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c905b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a703502, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.570] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.570] GetProcessHeap () returned 0xfd0000 [0188.570] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.571] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a6b7054, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.572] GetProcessHeap () returned 0xfd0000 [0188.572] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a6b7054, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0188.573] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a6b7054, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.573] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a6b7054, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.573] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0188.573] GetProcessHeap () returned 0xfd0000 [0188.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.573] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a690dfe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.573] GetProcessHeap () returned 0xfd0000 [0188.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a690dfe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.573] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a690dfe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.573] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a690dfe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.573] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.573] GetProcessHeap () returned 0xfd0000 [0188.573] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.573] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.573] GetProcessHeap () returned 0xfd0000 [0188.573] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.574] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.574] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.574] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.574] GetProcessHeap () returned 0xfd0000 [0188.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.574] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.574] GetProcessHeap () returned 0xfd0000 [0188.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.574] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.574] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.574] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.574] GetProcessHeap () returned 0xfd0000 [0188.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.575] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.575] GetProcessHeap () returned 0xfd0000 [0188.575] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6dd2b9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8a6dd2b9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x8a6dd2b9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6bb23ebf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6bb23ebf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2aae8a9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2aae8a9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2aae8a9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0188.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2aae8a9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2aae8a9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2aae8a9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0188.575] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2aae8a9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2aae8a9, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2aae8a9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0188.575] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.575] GetProcessHeap () returned 0xfd0000 [0188.575] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.578] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd5ae5d2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.578] GetProcessHeap () returned 0xfd0000 [0188.578] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd5ae5d2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.578] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd5ae5d2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.578] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd5ae5d2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.579] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.579] GetProcessHeap () returned 0xfd0000 [0188.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26ab0f83, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.579] GetProcessHeap () returned 0xfd0000 [0188.579] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26ab0f83, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.579] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26ab0f83, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcc6143b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa970154, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa970154, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileCache_100_0_Data.bin", cAlternateFileName="TILECA~2.BIN")) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcc6143b0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa970154, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa970154, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x25a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileCache_100_0_Header.bin", cAlternateFileName="TILECA~1.BIN")) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ab0f83, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26df83f3, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0xfcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnifiedTileCache.dat", cAlternateFileName="UNIFIE~1.DAT")) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ab0f83, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26df83f3, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0xfcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnifiedTileCache.dat", cAlternateFileName="UNIFIE~1.DAT")) returned 0 [0188.579] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.579] GetProcessHeap () returned 0xfd0000 [0188.579] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26ab0f83, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.579] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.580] GetProcessHeap () returned 0xfd0000 [0188.580] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.580] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.WindowPicker_cw5n1h2txyewy", cAlternateFileName="MI948A~1.WIN")) returned 1 [0188.580] GetProcessHeap () returned 0xfd0000 [0188.580] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.582] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.582] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.582] GetProcessHeap () returned 0xfd0000 [0188.582] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.584] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.584] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.584] GetProcessHeap () returned 0xfd0000 [0188.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.585] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.586] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.586] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.586] GetProcessHeap () returned 0xfd0000 [0188.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.586] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.586] GetProcessHeap () returned 0xfd0000 [0188.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.586] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.586] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.586] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.586] GetProcessHeap () returned 0xfd0000 [0188.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.586] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.586] GetProcessHeap () returned 0xfd0000 [0188.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.587] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.707] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.707] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.707] GetProcessHeap () returned 0xfd0000 [0188.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.707] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.707] GetProcessHeap () returned 0xfd0000 [0188.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.708] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.708] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.708] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.708] GetProcessHeap () returned 0xfd0000 [0188.708] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.708] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.708] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.709] GetProcessHeap () returned 0xfd0000 [0188.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.709] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.709] GetProcessHeap () returned 0xfd0000 [0188.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.709] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.709] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.709] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.709] GetProcessHeap () returned 0xfd0000 [0188.709] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.709] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.709] GetProcessHeap () returned 0xfd0000 [0188.709] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.709] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.710] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.710] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.710] GetProcessHeap () returned 0xfd0000 [0188.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.710] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.710] GetProcessHeap () returned 0xfd0000 [0188.710] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.710] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.710] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.710] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.710] GetProcessHeap () returned 0xfd0000 [0188.710] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.710] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.712] GetProcessHeap () returned 0xfd0000 [0188.712] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.713] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.713] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.713] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.713] GetProcessHeap () returned 0xfd0000 [0188.713] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.713] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.713] GetProcessHeap () returned 0xfd0000 [0188.713] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.713] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.713] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.713] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.713] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0188.713] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.713] GetProcessHeap () returned 0xfd0000 [0188.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.714] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.714] GetProcessHeap () returned 0xfd0000 [0188.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.714] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.714] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.714] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.714] GetProcessHeap () returned 0xfd0000 [0188.714] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.714] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.714] GetProcessHeap () returned 0xfd0000 [0188.714] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0188.715] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.715] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.715] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0188.715] GetProcessHeap () returned 0xfd0000 [0188.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.715] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.715] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.715] GetProcessHeap () returned 0xfd0000 [0188.715] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.716] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsAlarms_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WIN")) returned 1 [0188.716] GetProcessHeap () returned 0xfd0000 [0188.716] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.719] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.719] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea147891, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37de8088, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37de8088, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.719] GetProcessHeap () returned 0xfd0000 [0188.719] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea147891, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37de8088, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37de8088, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.721] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea147891, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37de8088, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37de8088, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.721] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.721] GetProcessHeap () returned 0xfd0000 [0188.721] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.723] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.723] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.723] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.723] GetProcessHeap () returned 0xfd0000 [0188.723] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.723] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.724] GetProcessHeap () returned 0xfd0000 [0188.724] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.724] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.724] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.725] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.725] GetProcessHeap () returned 0xfd0000 [0188.725] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.725] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.725] GetProcessHeap () returned 0xfd0000 [0188.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.725] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.725] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.725] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.725] GetProcessHeap () returned 0xfd0000 [0188.725] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.725] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.725] GetProcessHeap () returned 0xfd0000 [0188.725] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.726] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.726] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.726] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.726] GetProcessHeap () returned 0xfd0000 [0188.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.726] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152c735, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea16dae4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.726] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.726] GetProcessHeap () returned 0xfd0000 [0188.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.726] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.726] GetProcessHeap () returned 0xfd0000 [0188.726] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.726] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.726] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.726] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.726] GetProcessHeap () returned 0xfd0000 [0188.726] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.727] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.727] GetProcessHeap () returned 0xfd0000 [0188.727] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.728] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.728] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.728] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.728] GetProcessHeap () returned 0xfd0000 [0188.728] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.728] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9a3b7f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.728] GetProcessHeap () returned 0xfd0000 [0188.728] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9a3b7f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0188.729] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9a3b7f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.729] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe8bec4c, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd1c887, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd1c887, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alarms", cAlternateFileName="")) returned 1 [0188.729] GetProcessHeap () returned 0xfd0000 [0188.729] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Alarms\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe8bec4c, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd1c887, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd1c887, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.731] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe8bec4c, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd1c887, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd1c887, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.731] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8e4fc6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd166df, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd17a65, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alarms.json", cAlternateFileName="ALARMS~1.JSO")) returned 1 [0188.731] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8e4fc6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd166df, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd17a65, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alarms.json", cAlternateFileName="ALARMS~1.JSO")) returned 0 [0188.731] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.732] GetProcessHeap () returned 0xfd0000 [0188.732] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.732] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clocks", cAlternateFileName="")) returned 1 [0188.732] GetProcessHeap () returned 0xfd0000 [0188.732] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Clocks\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.733] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe9c9cef, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9c9cef, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clocks.json", cAlternateFileName="CLOCKS~1.JSO")) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe9c9cef, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9c9cef, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clocks.json", cAlternateFileName="CLOCKS~1.JSO")) returned 0 [0188.733] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.733] GetProcessHeap () returned 0xfd0000 [0188.733] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clocks", cAlternateFileName="")) returned 0 [0188.733] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0188.733] GetProcessHeap () returned 0xfd0000 [0188.733] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.733] GetProcessHeap () returned 0xfd0000 [0188.733] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.734] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.734] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.734] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.734] GetProcessHeap () returned 0xfd0000 [0188.734] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.734] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.734] GetProcessHeap () returned 0xfd0000 [0188.734] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea0fb524, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea062a65, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbad767dc, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xbad767dc, ftLastWriteTime.dwHighDateTime=0x1d32747, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ba1734c, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x7ba1734c, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x7ba1734c, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0188.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ba1734c, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x7ba1734c, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x7ba1734c, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0188.736] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ba1734c, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x7ba1734c, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x7ba1734c, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0188.737] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.737] GetProcessHeap () returned 0xfd0000 [0188.737] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.737] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8681db72, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.737] GetProcessHeap () returned 0xfd0000 [0188.737] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8681db72, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.738] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8681db72, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.738] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8681db72, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.738] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.738] GetProcessHeap () returned 0xfd0000 [0188.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.738] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.738] GetProcessHeap () returned 0xfd0000 [0188.738] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.738] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.738] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.738] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.738] GetProcessHeap () returned 0xfd0000 [0188.738] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.739] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.739] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.739] GetProcessHeap () returned 0xfd0000 [0188.739] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.740] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.WIN")) returned 1 [0188.740] GetProcessHeap () returned 0xfd0000 [0188.740] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.741] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.741] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c62fb4a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38070899, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38070899, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.742] GetProcessHeap () returned 0xfd0000 [0188.742] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c62fb4a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38070899, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38070899, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.744] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c62fb4a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38070899, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38070899, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.744] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.744] GetProcessHeap () returned 0xfd0000 [0188.744] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.746] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.746] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.746] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0188.746] GetProcessHeap () returned 0xfd0000 [0188.746] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.746] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.746] GetProcessHeap () returned 0xfd0000 [0188.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0188.747] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.747] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.747] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0188.747] GetProcessHeap () returned 0xfd0000 [0188.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.747] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.747] GetProcessHeap () returned 0xfd0000 [0188.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.748] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.748] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.748] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.748] GetProcessHeap () returned 0xfd0000 [0188.748] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.748] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.748] GetProcessHeap () returned 0xfd0000 [0188.748] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.748] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.748] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.748] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.749] GetProcessHeap () returned 0xfd0000 [0188.749] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.749] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c655d83, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.749] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.749] GetProcessHeap () returned 0xfd0000 [0188.749] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.749] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.789] GetProcessHeap () returned 0xfd0000 [0188.789] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.790] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.790] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.790] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.790] GetProcessHeap () returned 0xfd0000 [0188.790] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.790] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c54ad1b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.790] GetProcessHeap () returned 0xfd0000 [0188.790] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c54ad1b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0188.791] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c54ad1b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.791] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c54ad1b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.791] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0188.791] GetProcessHeap () returned 0xfd0000 [0188.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.791] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.791] GetProcessHeap () returned 0xfd0000 [0188.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.791] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.791] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.791] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.791] GetProcessHeap () returned 0xfd0000 [0188.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.791] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.791] GetProcessHeap () returned 0xfd0000 [0188.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.792] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.792] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.792] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.792] GetProcessHeap () returned 0xfd0000 [0188.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.793] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.793] GetProcessHeap () returned 0xfd0000 [0188.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1c5e36c8, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc1d6a7f5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x722e55f1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x722e55f1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x722e55f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0188.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x722e55f1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x722e55f1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x722e55f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0188.824] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x722e55f1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x722e55f1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x722e55f1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0188.825] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.825] GetProcessHeap () returned 0xfd0000 [0188.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.826] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1d6ba1f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.826] GetProcessHeap () returned 0xfd0000 [0188.826] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1d6ba1f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.826] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1d6ba1f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.826] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1d6ba1f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.826] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.826] GetProcessHeap () returned 0xfd0000 [0188.826] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.826] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.826] GetProcessHeap () returned 0xfd0000 [0188.826] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.827] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.827] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.827] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.827] GetProcessHeap () returned 0xfd0000 [0188.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.827] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.827] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.827] GetProcessHeap () returned 0xfd0000 [0188.827] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.828] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCamera_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.WIN")) returned 1 [0188.828] GetProcessHeap () returned 0xfd0000 [0188.828] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.831] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x382acb94, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x382acb94, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0188.831] GetProcessHeap () returned 0xfd0000 [0188.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x382acb94, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x382acb94, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.833] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x382acb94, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x382acb94, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.833] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.833] GetProcessHeap () returned 0xfd0000 [0188.833] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.834] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.835] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.835] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.835] GetProcessHeap () returned 0xfd0000 [0188.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.835] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.835] GetProcessHeap () returned 0xfd0000 [0188.835] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.835] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.835] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.835] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.835] GetProcessHeap () returned 0xfd0000 [0188.835] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.835] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.835] GetProcessHeap () returned 0xfd0000 [0188.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.836] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.836] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.836] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.836] GetProcessHeap () returned 0xfd0000 [0188.836] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.836] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.836] GetProcessHeap () returned 0xfd0000 [0188.836] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.836] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.836] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.836] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.837] GetProcessHeap () returned 0xfd0000 [0188.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.837] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179e373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19ce8eec, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.837] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.837] GetProcessHeap () returned 0xfd0000 [0188.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.837] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.837] GetProcessHeap () returned 0xfd0000 [0188.837] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.837] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.837] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.837] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.837] GetProcessHeap () returned 0xfd0000 [0188.837] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.837] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179f2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.837] GetProcessHeap () returned 0xfd0000 [0188.838] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179f2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.838] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179f2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.838] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179f2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.838] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.838] GetProcessHeap () returned 0xfd0000 [0188.838] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.838] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179faf3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.839] GetProcessHeap () returned 0xfd0000 [0188.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179faf3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179faf3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.842] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179faf3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.842] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.842] GetProcessHeap () returned 0xfd0000 [0188.842] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.842] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd17a025b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.842] GetProcessHeap () returned 0xfd0000 [0188.842] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd17a025b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.843] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd17a025b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.843] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd17a025b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.843] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.843] GetProcessHeap () returned 0xfd0000 [0188.843] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.843] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.843] GetProcessHeap () returned 0xfd0000 [0188.843] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x19c9ca37, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0188.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0188.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xfa728eb2, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xfa728eb2, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xfa728eb2, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0188.857] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xfa728eb2, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0xfa728eb2, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0xfa728eb2, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0188.859] GetProcessHeap () returned 0xfd0000 [0188.859] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.859] GetProcessHeap () returned 0xfd0000 [0188.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef547375, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef547375, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.859] GetProcessHeap () returned 0xfd0000 [0188.859] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.859] GetProcessHeap () returned 0xfd0000 [0188.859] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1806001, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.860] GetProcessHeap () returned 0xfd0000 [0188.860] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.860] GetProcessHeap () returned 0xfd0000 [0188.860] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0188.861] GetProcessHeap () returned 0xfd0000 [0188.861] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0188.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf1aae2a1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0188.865] GetProcessHeap () returned 0xfd0000 [0188.865] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe3e55cfc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x384e8f13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x384e8f13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0188.873] GetProcessHeap () returned 0xfd0000 [0188.873] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\BackgroundTransferApi\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1870a2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.881] GetProcessHeap () returned 0xfd0000 [0188.881] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.881] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd187150f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0188.881] GetProcessHeap () returned 0xfd0000 [0188.881] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd187150f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.887] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd187150f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.887] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd187150f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.887] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.887] GetProcessHeap () returned 0xfd0000 [0188.887] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.887] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1871c50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0188.887] GetProcessHeap () returned 0xfd0000 [0188.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1871c50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.888] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1871c50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.888] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1871c50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.888] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.889] GetProcessHeap () returned 0xfd0000 [0188.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.889] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18be980, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0188.889] GetProcessHeap () returned 0xfd0000 [0188.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18be980, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18be980, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApi", cAlternateFileName="BACKGR~1")) returned 1 [0188.890] GetProcessHeap () returned 0xfd0000 [0188.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0188.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0188.891] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0188.891] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0188.891] GetProcessHeap () returned 0xfd0000 [0188.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0188.891] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApiGroup", cAlternateFileName="BACKGR~2")) returned 1 [0188.891] GetProcessHeap () returned 0xfd0000 [0188.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0188.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApiGroup\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0188.892] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.892] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.892] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0188.892] GetProcessHeap () returned 0xfd0000 [0188.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0188.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BackgroundTransferApiGroup", cAlternateFileName="BACKGR~2")) returned 0 [0188.892] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.892] GetProcessHeap () returned 0xfd0000 [0188.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.892] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0188.892] GetProcessHeap () returned 0xfd0000 [0188.892] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0188.892] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.892] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.892] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0188.892] GetProcessHeap () returned 0xfd0000 [0188.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.892] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c12bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e7bf5e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0188.893] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0188.893] GetProcessHeap () returned 0xfd0000 [0188.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.893] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c1e3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.893] GetProcessHeap () returned 0xfd0000 [0188.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c1e3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0188.893] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c1e3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.893] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c1e3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.894] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0188.894] GetProcessHeap () returned 0xfd0000 [0188.894] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.894] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c2664, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.894] GetProcessHeap () returned 0xfd0000 [0188.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c2664, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0188.894] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c2664, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.894] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c2664, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.895] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0188.895] GetProcessHeap () returned 0xfd0000 [0188.895] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0188.895] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.895] GetProcessHeap () returned 0xfd0000 [0188.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0188.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0188.895] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.895] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Files", cAlternateFileName="")) returned 1 [0188.895] GetProcessHeap () returned 0xfd0000 [0188.895] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Files\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0188.896] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.896] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S0", cAlternateFileName="")) returned 1 [0188.896] GetProcessHeap () returned 0xfd0000 [0188.896] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0188.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Files\\S0\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.896] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.896] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.897] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.897] GetProcessHeap () returned 0xfd0000 [0188.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0188.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S0", cAlternateFileName="")) returned 0 [0188.897] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0188.897] GetProcessHeap () returned 0xfd0000 [0188.897] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.897] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7c5433fc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8a3775d, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxStore.hxd", cAlternateFileName="")) returned 1 [0188.897] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalFiles", cAlternateFileName="LOCALF~1")) returned 1 [0188.897] GetProcessHeap () returned 0xfd0000 [0188.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\LocalFiles\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0188.897] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.897] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="923", cAlternateFileName="")) returned 1 [0188.897] GetProcessHeap () returned 0xfd0000 [0188.897] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0188.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\LocalFiles\\923\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0188.898] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.898] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.898] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0188.898] GetProcessHeap () returned 0xfd0000 [0188.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0188.898] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="923", cAlternateFileName="")) returned 0 [0188.898] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0188.898] GetProcessHeap () returned 0xfd0000 [0188.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0188.898] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d91a174, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Photos", cAlternateFileName="")) returned 1 [0188.898] GetProcessHeap () returned 0xfd0000 [0188.898] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0188.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Photos\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d91a174, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0189.061] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d91a174, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.061] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d91a174, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.061] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0189.069] GetProcessHeap () returned 0xfd0000 [0189.069] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.076] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d91a174, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Photos", cAlternateFileName="")) returned 0 [0189.076] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.076] GetProcessHeap () returned 0xfd0000 [0189.076] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.093] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd192c093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.093] GetProcessHeap () returned 0xfd0000 [0189.093] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd192c093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.094] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd192c093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.094] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd192c093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.094] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.094] GetProcessHeap () returned 0xfd0000 [0189.094] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.094] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.094] GetProcessHeap () returned 0xfd0000 [0189.094] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0189.096] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.096] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe3de35df, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.096] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf549855f, ftLastAccessTime.dwHighDateTime=0x1d336cd, ftLastWriteTime.dwLowDateTime=0xf549855f, ftLastWriteTime.dwHighDateTime=0x1d336cd, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.096] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xeaed6ff3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeaed6ff3, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeaed6ff3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.096] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xeaed6ff3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeaed6ff3, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeaed6ff3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.096] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xeaed6ff3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xeaed6ff3, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xeaed6ff3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.096] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0189.097] GetProcessHeap () returned 0xfd0000 [0189.097] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.097] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc6e47f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xefc6e47f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xefc6e47f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.097] GetProcessHeap () returned 0xfd0000 [0189.097] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc6e47f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xefc6e47f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xefc6e47f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.097] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc6e47f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xefc6e47f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xefc6e47f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.098] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc6e47f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xefc6e47f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xefc6e47f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.098] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.098] GetProcessHeap () returned 0xfd0000 [0189.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.098] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.098] GetProcessHeap () returned 0xfd0000 [0189.098] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.098] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.098] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.098] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.098] GetProcessHeap () returned 0xfd0000 [0189.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.098] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.098] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.098] GetProcessHeap () returned 0xfd0000 [0189.098] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.098] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe", cAlternateFileName="MIDE9E~1.WIN")) returned 1 [0189.099] GetProcessHeap () returned 0xfd0000 [0189.099] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.101] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.101] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbede9823, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedef9f4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedef9f4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.101] GetProcessHeap () returned 0xfd0000 [0189.101] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbede9823, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedef9f4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedef9f4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0189.113] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbede9823, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedef9f4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedef9f4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.113] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a4fb8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.113] GetProcessHeap () returned 0xfd0000 [0189.113] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a4fb8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.114] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a4fb8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.114] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a4fb8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.114] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.114] GetProcessHeap () returned 0xfd0000 [0189.114] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.115] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a5030e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.115] GetProcessHeap () returned 0xfd0000 [0189.115] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a5030e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0189.115] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a5030e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.115] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a5030e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.116] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0189.116] GetProcessHeap () returned 0xfd0000 [0189.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.116] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedee638, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.116] GetProcessHeap () returned 0xfd0000 [0189.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedee638, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.116] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedee638, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.116] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedee638, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedee638, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.116] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.116] GetProcessHeap () returned 0xfd0000 [0189.116] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.116] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.116] GetProcessHeap () returned 0xfd0000 [0189.116] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.117] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.117] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.117] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.117] GetProcessHeap () returned 0xfd0000 [0189.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.117] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedebf51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedebf51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.117] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0189.117] GetProcessHeap () returned 0xfd0000 [0189.117] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.117] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed66dee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed66dee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed66dee, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.117] GetProcessHeap () returned 0xfd0000 [0189.117] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed66dee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed66dee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed66dee, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.117] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed66dee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed66dee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed66dee, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.117] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed66dee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed66dee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed66dee, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.118] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.118] GetProcessHeap () returned 0xfd0000 [0189.118] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.118] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5d1c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a51d81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5d1c9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.118] GetProcessHeap () returned 0xfd0000 [0189.118] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5d1c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a51d81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5d1c9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.121] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5d1c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a51d81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5d1c9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.121] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5d1c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a51d81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5d1c9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.121] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.121] GetProcessHeap () returned 0xfd0000 [0189.121] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.121] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed55c81, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52772, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed55c81, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.121] GetProcessHeap () returned 0xfd0000 [0189.121] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed55c81, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52772, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed55c81, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.122] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed55c81, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52772, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed55c81, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.122] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed55c81, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52772, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed55c81, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.122] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.122] GetProcessHeap () returned 0xfd0000 [0189.122] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.122] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed58391, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52e58, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed58391, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.122] GetProcessHeap () returned 0xfd0000 [0189.122] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed58391, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52e58, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed58391, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.123] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed58391, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52e58, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed58391, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.123] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed58391, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52e58, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed58391, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.123] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.123] GetProcessHeap () returned 0xfd0000 [0189.123] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.123] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5fe7b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed646ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed69507, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.123] GetProcessHeap () returned 0xfd0000 [0189.123] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5fe7b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed646ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed69507, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0189.123] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5fe7b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed646ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed69507, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.123] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed69507, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed69507, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed69507, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.123] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed646ee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed646ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.123] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed646ee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed646ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0189.124] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0189.124] GetProcessHeap () returned 0xfd0000 [0189.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.124] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed6335f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed6335f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed6335f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.124] GetProcessHeap () returned 0xfd0000 [0189.124] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed6335f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed6335f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed6335f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.124] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed6335f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed6335f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed6335f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.124] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed6335f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed6335f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed6335f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.124] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.124] GetProcessHeap () returned 0xfd0000 [0189.124] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.124] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.124] GetProcessHeap () returned 0xfd0000 [0189.124] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0189.125] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.125] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.125] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0189.125] GetProcessHeap () returned 0xfd0000 [0189.125] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.125] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.125] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.125] GetProcessHeap () returned 0xfd0000 [0189.125] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.126] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsMaps_8wekyb3d8bbwe", cAlternateFileName="MID92F~1.WIN")) returned 1 [0189.126] GetProcessHeap () returned 0xfd0000 [0189.126] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.128] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.128] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe27bb52, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38b51312, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38b51312, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.128] GetProcessHeap () returned 0xfd0000 [0189.128] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe27bb52, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38b51312, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38b51312, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.130] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe27bb52, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38b51312, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38b51312, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.130] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3531, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.130] GetProcessHeap () returned 0xfd0000 [0189.130] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3531, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.132] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3531, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.132] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3531, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.132] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.133] GetProcessHeap () returned 0xfd0000 [0189.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.133] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3f21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.133] GetProcessHeap () returned 0xfd0000 [0189.133] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3f21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0189.134] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3f21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.134] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3f21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.134] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0189.134] GetProcessHeap () returned 0xfd0000 [0189.134] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.134] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab4a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.134] GetProcessHeap () returned 0xfd0000 [0189.134] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab4a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.134] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab4a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.134] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab4a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.134] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.135] GetProcessHeap () returned 0xfd0000 [0189.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.135] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.135] GetProcessHeap () returned 0xfd0000 [0189.135] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.135] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.135] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.135] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.135] GetProcessHeap () returned 0xfd0000 [0189.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.135] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab537f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe2a1d9f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.135] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.135] GetProcessHeap () returned 0xfd0000 [0189.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.136] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe22f6ae, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe22f6ae, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.136] GetProcessHeap () returned 0xfd0000 [0189.136] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe22f6ae, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe22f6ae, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0189.136] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe22f6ae, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe22f6ae, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.136] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe22f6ae, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe22f6ae, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.136] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0189.136] GetProcessHeap () returned 0xfd0000 [0189.136] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.136] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5f4b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.136] GetProcessHeap () returned 0xfd0000 [0189.136] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5f4b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.137] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5f4b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.137] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5f4b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.137] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.137] GetProcessHeap () returned 0xfd0000 [0189.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.137] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab6289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.138] GetProcessHeap () returned 0xfd0000 [0189.138] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab6289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.138] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab6289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.138] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab6289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.138] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.138] GetProcessHeap () returned 0xfd0000 [0189.138] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.138] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab67a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.138] GetProcessHeap () returned 0xfd0000 [0189.138] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab67a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0189.139] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab67a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.139] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab67a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.139] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0189.139] GetProcessHeap () returned 0xfd0000 [0189.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.139] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.139] GetProcessHeap () returned 0xfd0000 [0189.139] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22f6ae, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe22f6ae, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xe22f6ae, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe196d39, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd2f14b6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6428f7dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x6428f7dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6428f7dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6445067e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x6445067e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6445067e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.141] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6445067e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x6445067e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x6445067e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.141] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.213] GetProcessHeap () returned 0xfd0000 [0189.214] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.214] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2f14b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbd2f14b6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd2f14b6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.214] GetProcessHeap () returned 0xfd0000 [0189.214] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2f14b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbd2f14b6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd2f14b6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.277] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2f14b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbd2f14b6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd2f14b6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.277] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2f14b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbd2f14b6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd2f14b6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.277] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.281] GetProcessHeap () returned 0xfd0000 [0189.281] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.281] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.281] GetProcessHeap () returned 0xfd0000 [0189.281] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.281] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.281] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.282] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.282] GetProcessHeap () returned 0xfd0000 [0189.282] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.282] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.282] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.282] GetProcessHeap () returned 0xfd0000 [0189.282] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.283] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsPhone_8wekyb3d8bbwe", cAlternateFileName="MI7D5A~1.WIN")) returned 1 [0189.283] GetProcessHeap () returned 0xfd0000 [0189.283] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.285] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.286] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9750aec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38ee4cbd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38ee4cbd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.286] GetProcessHeap () returned 0xfd0000 [0189.286] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9750aec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38ee4cbd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38ee4cbd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.315] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9750aec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38ee4cbd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38ee4cbd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.315] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba0882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.315] GetProcessHeap () returned 0xfd0000 [0189.315] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba0882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.459] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba0882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.459] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba0882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.459] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.459] GetProcessHeap () returned 0xfd0000 [0189.459] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.459] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba130d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.459] GetProcessHeap () returned 0xfd0000 [0189.459] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba130d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.459] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba130d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.459] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba130d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.459] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.459] GetProcessHeap () returned 0xfd0000 [0189.459] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.460] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba1b08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.460] GetProcessHeap () returned 0xfd0000 [0189.460] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba1b08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0189.460] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba1b08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.460] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba1b08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.460] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0189.460] GetProcessHeap () returned 0xfd0000 [0189.460] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.460] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.460] GetProcessHeap () returned 0xfd0000 [0189.460] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0189.460] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.460] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.460] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0189.460] GetProcessHeap () returned 0xfd0000 [0189.460] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.461] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba21f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9776d2f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.461] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.461] GetProcessHeap () returned 0xfd0000 [0189.461] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.461] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9704670, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9704670, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.461] GetProcessHeap () returned 0xfd0000 [0189.461] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9704670, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9704670, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.461] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9704670, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9704670, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.461] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9704670, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9704670, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.461] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.461] GetProcessHeap () returned 0xfd0000 [0189.461] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.461] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba32b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.461] GetProcessHeap () returned 0xfd0000 [0189.461] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba32b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.464] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba32b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.464] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba32b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.464] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.464] GetProcessHeap () returned 0xfd0000 [0189.464] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.464] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3847, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.464] GetProcessHeap () returned 0xfd0000 [0189.464] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3847, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.467] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3847, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.467] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3847, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.467] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.467] GetProcessHeap () returned 0xfd0000 [0189.467] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.467] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.467] GetProcessHeap () returned 0xfd0000 [0189.467] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.467] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.467] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.467] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.468] GetProcessHeap () returned 0xfd0000 [0189.468] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.468] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.468] GetProcessHeap () returned 0xfd0000 [0189.468] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.504] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.504] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9704670, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9704670, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x9704670, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.504] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.504] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8e4b9d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5d8e4b9d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5d8e4b9d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.504] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8e4b9d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5d8e4b9d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5d8e4b9d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.504] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8e4b9d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5d8e4b9d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5d8e4b9d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.504] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.505] GetProcessHeap () returned 0xfd0000 [0189.505] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.505] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb907b89d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.505] GetProcessHeap () returned 0xfd0000 [0189.505] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb907b89d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.508] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb907b89d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.508] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb907b89d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.508] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.508] GetProcessHeap () returned 0xfd0000 [0189.508] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.508] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.508] GetProcessHeap () returned 0xfd0000 [0189.508] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.508] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.508] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.509] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.509] GetProcessHeap () returned 0xfd0000 [0189.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.509] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.509] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.509] GetProcessHeap () returned 0xfd0000 [0189.509] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.510] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe", cAlternateFileName="MIA6CE~1.WIN")) returned 1 [0189.510] GetProcessHeap () returned 0xfd0000 [0189.510] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0189.514] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.514] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x67c7ba3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x391dfc11, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x391dfc11, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.514] GetProcessHeap () returned 0xfd0000 [0189.514] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x67c7ba3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x391dfc11, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x391dfc11, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.634] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x67c7ba3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x391dfc11, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x391dfc11, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.634] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.634] GetProcessHeap () returned 0xfd0000 [0189.634] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.639] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.639] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.639] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.639] GetProcessHeap () returned 0xfd0000 [0189.639] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.639] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b98c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.639] GetProcessHeap () returned 0xfd0000 [0189.639] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b98c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.639] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b98c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.639] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b98c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.639] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.639] GetProcessHeap () returned 0xfd0000 [0189.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1bda6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.640] GetProcessHeap () returned 0xfd0000 [0189.640] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1bda6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.640] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1bda6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1bda6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.640] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.640] GetProcessHeap () returned 0xfd0000 [0189.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.640] GetProcessHeap () returned 0xfd0000 [0189.640] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0189.640] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.640] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0189.640] GetProcessHeap () returned 0xfd0000 [0189.640] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c1bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67ede02, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.641] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.641] GetProcessHeap () returned 0xfd0000 [0189.641] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.641] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a1999, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67a1999, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.641] GetProcessHeap () returned 0xfd0000 [0189.641] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a1999, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67a1999, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.645] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a1999, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67a1999, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.645] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a1999, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67a1999, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.645] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.645] GetProcessHeap () returned 0xfd0000 [0189.645] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.645] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cab3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.645] GetProcessHeap () returned 0xfd0000 [0189.645] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cab3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.645] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cab3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.645] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cab3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.645] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.646] GetProcessHeap () returned 0xfd0000 [0189.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.646] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cea1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6670683, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.646] GetProcessHeap () returned 0xfd0000 [0189.646] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cea1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6670683, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.646] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cea1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6670683, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.646] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cea1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6670683, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.646] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.646] GetProcessHeap () returned 0xfd0000 [0189.646] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.646] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66968cc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1d2d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66968cc, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.646] GetProcessHeap () returned 0xfd0000 [0189.646] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66968cc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1d2d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66968cc, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0189.646] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66968cc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1d2d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66968cc, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.646] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66968cc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1d2d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66968cc, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.647] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0189.647] GetProcessHeap () returned 0xfd0000 [0189.647] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.647] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.647] GetProcessHeap () returned 0xfd0000 [0189.647] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a1999, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x67a1999, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x67a1999, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x968e9a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5b325360, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5b325360, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5b325360, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5b325360, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5b325360, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5b325360, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.662] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5b325360, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5b325360, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5b325360, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.662] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.663] GetProcessHeap () returned 0xfd0000 [0189.663] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.663] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9690fc23, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9690fc23, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.663] GetProcessHeap () returned 0xfd0000 [0189.663] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9690fc23, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9690fc23, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.663] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9690fc23, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9690fc23, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.664] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9690fc23, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9690fc23, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.664] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.664] GetProcessHeap () returned 0xfd0000 [0189.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.664] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.664] GetProcessHeap () returned 0xfd0000 [0189.664] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.664] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.664] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.664] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.664] GetProcessHeap () returned 0xfd0000 [0189.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.664] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.664] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0189.664] GetProcessHeap () returned 0xfd0000 [0189.664] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.665] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MI052B~1.WIN")) returned 1 [0189.665] GetProcessHeap () returned 0xfd0000 [0189.665] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.671] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.671] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3957349d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3957349d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.672] GetProcessHeap () returned 0xfd0000 [0189.672] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3957349d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3957349d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.673] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3957349d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3957349d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.673] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd9a6b0, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfdd9a6b0, ftLastWriteTime.dwHighDateTime=0x1d39f5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.674] GetProcessHeap () returned 0xfd0000 [0189.674] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd9a6b0, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfdd9a6b0, ftLastWriteTime.dwHighDateTime=0x1d39f5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd9a6b0, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfdd9a6b0, ftLastWriteTime.dwHighDateTime=0x1d39f5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x88ced4a1, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x88ced4a1, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0189.676] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x88ced4a1, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x88ced4a1, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0189.676] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.677] GetProcessHeap () returned 0xfd0000 [0189.677] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.677] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42147ef, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d440c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.677] GetProcessHeap () returned 0xfd0000 [0189.677] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42147ef, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d440c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.696] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42147ef, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d440c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.696] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x88ced4a1, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x88ced4a1, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0189.696] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x88ced4a1, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x88ced4a1, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0189.696] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.696] GetProcessHeap () returned 0xfd0000 [0189.696] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.696] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d44c20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.696] GetProcessHeap () returned 0xfd0000 [0189.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d44c20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.697] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d44c20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.697] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d44c20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.697] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.697] GetProcessHeap () returned 0xfd0000 [0189.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.697] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x8addc228, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd1da511e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8addc228, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0189.697] GetProcessHeap () returned 0xfd0000 [0189.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Microsoft\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x8addc228, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd1da511e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8addc228, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.698] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x8addc228, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xd1da511e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8addc228, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.698] GetProcessHeap () returned 0xfd0000 [0189.698] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0189.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x8addc228, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x8addc228, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x8addc228, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.699] GetProcessHeap () returned 0xfd0000 [0189.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0189.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x8addc228, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xdaf50849, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdaf50849, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0189.727] GetProcessHeap () returned 0xfd0000 [0189.727] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0189.727] GetProcessHeap () returned 0xfd0000 [0189.727] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0189.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x8addc228, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xdaf50849, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdaf50849, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.745] GetProcessHeap () returned 0xfd0000 [0189.745] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0189.745] GetProcessHeap () returned 0xfd0000 [0189.745] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0189.745] GetProcessHeap () returned 0xfd0000 [0189.745] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.746] GetProcessHeap () returned 0xfd0000 [0189.746] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f20fd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x41ee58e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.747] GetProcessHeap () returned 0xfd0000 [0189.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.747] GetProcessHeap () returned 0xfd0000 [0189.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.747] GetProcessHeap () returned 0xfd0000 [0189.747] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40e351b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f214ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40e351b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.747] GetProcessHeap () returned 0xfd0000 [0189.747] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.748] GetProcessHeap () returned 0xfd0000 [0189.748] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda90ec4a, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xda90ec4a, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0189.753] GetProcessHeap () returned 0xfd0000 [0189.753] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda90ec4a, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xda90ec4a, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1510392, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.758] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0cb888e, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xe0cb888e, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe0d2af1c, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2b694, dwReserved0=0x0, dwReserved1=0x0, cFileName="1bec6d4a-6687-4295-b59f-5b3c048ab97c", cAlternateFileName="1BEC6D~1")) returned 1 [0189.758] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1510392, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xe1510392, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1582a0b, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1af8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1dcea220-55cd-470a-a680-6d186485df4e", cAlternateFileName="1DCEA2~1")) returned 1 [0189.758] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd062fb2, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdd062fb2, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdd062fb2, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fc7d273-b221-48f6-9872-22321b90204a", cAlternateFileName="1FC7D2~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd016b57, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdd016b57, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdd0af547, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="564654d8-f181-4d50-84f0-95228e86ec66", cAlternateFileName="564654~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc478053, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc478053, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc58317b, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x799, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ac60a78-519d-4397-8cfd-8288aad6ad67", cAlternateFileName="6AC60A~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc478053, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc478053, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc4ea6a3, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="816b519f-6aae-4806-a871-9e26a12741ef", cAlternateFileName="816B51~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde328425, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xde328425, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xde328425, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x12a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="af440790-6f0a-42ac-b8a5-e53856d9d828", cAlternateFileName="AF4407~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd062fb2, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdd062fb2, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdd206830, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1dd87, dwReserved0=0x0, dwReserved1=0x0, cFileName="bba8ff68-64fb-4605-ae42-fe59570f7bb7", cAlternateFileName="BBA8FF~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc4059cc, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc4059cc, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc478053, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cf305046-df1e-43ca-88e4-ce3ad1b7bfa9", cAlternateFileName="CF3050~1")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc641aa1, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc641aa1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1726223, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1da5, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1 [0189.759] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc641aa1, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc641aa1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1726223, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1da5, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 0 [0189.759] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.760] GetProcessHeap () returned 0xfd0000 [0189.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.760] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda90ec4a, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xda90ec4a, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1510392, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="perUserCache_0", cAlternateFileName="PERUSE~1")) returned 0 [0189.760] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0189.760] GetProcessHeap () returned 0xfd0000 [0189.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.760] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f86969, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.760] GetProcessHeap () returned 0xfd0000 [0189.760] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f86969, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.760] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f86969, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.760] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f86969, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.760] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.760] GetProcessHeap () returned 0xfd0000 [0189.760] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.760] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f8706e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.761] GetProcessHeap () returned 0xfd0000 [0189.761] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f8706e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.761] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f8706e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.761] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f8706e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.761] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.761] GetProcessHeap () returned 0xfd0000 [0189.761] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.761] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.761] GetProcessHeap () returned 0xfd0000 [0189.761] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.764] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.764] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4109748, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x4109748, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x4109748, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.764] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e351b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1984b4a8, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1984b4a8, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.764] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x87e78d6e, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x87e78d6e, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x87e78d6e, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.764] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x87e78d6e, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x87e78d6e, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x87e78d6e, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.765] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x87e78d6e, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x87e78d6e, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x87e78d6e, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.765] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.765] GetProcessHeap () returned 0xfd0000 [0189.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.765] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef652437, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.765] GetProcessHeap () returned 0xfd0000 [0189.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef652437, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.766] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef652437, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.766] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef652437, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.766] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.766] GetProcessHeap () returned 0xfd0000 [0189.766] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.766] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.766] GetProcessHeap () returned 0xfd0000 [0189.766] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.766] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.766] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.766] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.766] GetProcessHeap () returned 0xfd0000 [0189.766] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.766] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.766] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.767] GetProcessHeap () returned 0xfd0000 [0189.767] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.768] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XBO")) returned 1 [0189.768] GetProcessHeap () returned 0xfd0000 [0189.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.770] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.770] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x15f8ed9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3981f155, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3981f155, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.770] GetProcessHeap () returned 0xfd0000 [0189.770] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x15f8ed9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3981f155, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3981f155, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.775] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x15f8ed9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3981f155, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3981f155, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.775] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.775] GetProcessHeap () returned 0xfd0000 [0189.775] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.783] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.783] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.783] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.783] GetProcessHeap () returned 0xfd0000 [0189.784] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.784] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.784] GetProcessHeap () returned 0xfd0000 [0189.784] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.784] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.784] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.784] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.784] GetProcessHeap () returned 0xfd0000 [0189.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.785] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.785] GetProcessHeap () returned 0xfd0000 [0189.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.785] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.785] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.785] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.785] GetProcessHeap () returned 0xfd0000 [0189.785] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.785] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.785] GetProcessHeap () returned 0xfd0000 [0189.785] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.785] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.785] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.785] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.791] GetProcessHeap () returned 0xfd0000 [0189.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.791] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.791] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.791] GetProcessHeap () returned 0xfd0000 [0189.791] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.791] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.791] GetProcessHeap () returned 0xfd0000 [0189.791] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.792] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.792] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.792] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.792] GetProcessHeap () returned 0xfd0000 [0189.792] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.792] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.792] GetProcessHeap () returned 0xfd0000 [0189.792] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.792] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.792] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.793] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.793] GetProcessHeap () returned 0xfd0000 [0189.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.793] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.793] GetProcessHeap () returned 0xfd0000 [0189.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.793] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.793] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.793] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.793] GetProcessHeap () returned 0xfd0000 [0189.793] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.793] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.793] GetProcessHeap () returned 0xfd0000 [0189.793] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.794] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.794] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.794] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.794] GetProcessHeap () returned 0xfd0000 [0189.794] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.794] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.794] GetProcessHeap () returned 0xfd0000 [0189.794] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.820] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.820] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x15aca2b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.820] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa9d8782f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x27035a40, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.820] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x133ef956, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.820] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x133ef956, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.820] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x133ef956, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.821] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.821] GetProcessHeap () returned 0xfd0000 [0189.821] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.821] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94eafafc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.821] GetProcessHeap () returned 0xfd0000 [0189.821] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94eafafc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.829] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94eafafc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.829] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94eafafc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.829] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.829] GetProcessHeap () returned 0xfd0000 [0189.829] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.829] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.829] GetProcessHeap () returned 0xfd0000 [0189.829] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.830] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.830] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.830] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.830] GetProcessHeap () returned 0xfd0000 [0189.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.830] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.830] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.830] GetProcessHeap () returned 0xfd0000 [0189.830] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.831] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1 [0189.831] GetProcessHeap () returned 0xfd0000 [0189.831] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0189.839] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.839] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x39a819cf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39a819cf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.839] GetProcessHeap () returned 0xfd0000 [0189.839] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x39a819cf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39a819cf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.887] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x39a819cf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39a819cf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.887] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.887] GetProcessHeap () returned 0xfd0000 [0189.887] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.889] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.889] GetProcessHeap () returned 0xfd0000 [0189.889] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.889] GetProcessHeap () returned 0xfd0000 [0189.889] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.890] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.890] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.890] GetProcessHeap () returned 0xfd0000 [0189.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.890] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.890] GetProcessHeap () returned 0xfd0000 [0189.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.890] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.890] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.890] GetProcessHeap () returned 0xfd0000 [0189.890] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.890] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.890] GetProcessHeap () returned 0xfd0000 [0189.890] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.891] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.891] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.891] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.891] GetProcessHeap () returned 0xfd0000 [0189.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.891] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.891] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.891] GetProcessHeap () returned 0xfd0000 [0189.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.891] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.891] GetProcessHeap () returned 0xfd0000 [0189.891] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.891] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.891] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.891] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.891] GetProcessHeap () returned 0xfd0000 [0189.891] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.891] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9146357c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.892] GetProcessHeap () returned 0xfd0000 [0189.892] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9146357c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9146357c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.892] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9146357c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.892] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.892] GetProcessHeap () returned 0xfd0000 [0189.892] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.892] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91299917, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.893] GetProcessHeap () returned 0xfd0000 [0189.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91299917, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.893] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91299917, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.893] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91299917, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.893] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.893] GetProcessHeap () returned 0xfd0000 [0189.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.893] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9130c033, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.893] GetProcessHeap () returned 0xfd0000 [0189.893] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9130c033, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.893] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9130c033, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.893] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9130c033, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.893] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.893] GetProcessHeap () returned 0xfd0000 [0189.893] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.893] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9154838f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.893] GetProcessHeap () returned 0xfd0000 [0189.894] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9154838f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0189.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9154838f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9162d1b2, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda2ea5f5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda0ae1c0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda0ae1c0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda0ae1c0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0189.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda0ae1c0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda0ae1c0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda0ae1c0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0189.897] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda0ae1c0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda0ae1c0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda0ae1c0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0189.897] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0189.898] GetProcessHeap () returned 0xfd0000 [0189.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.898] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f3e6702, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.898] GetProcessHeap () returned 0xfd0000 [0189.898] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f3e6702, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0189.898] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f3e6702, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.898] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f3e6702, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.898] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0189.898] GetProcessHeap () returned 0xfd0000 [0189.898] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.898] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.898] GetProcessHeap () returned 0xfd0000 [0189.898] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.899] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.899] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.899] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.899] GetProcessHeap () returned 0xfd0000 [0189.899] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.899] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.899] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0189.899] GetProcessHeap () returned 0xfd0000 [0189.899] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.900] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameOverlay_8wekyb3d8bbwe", cAlternateFileName="MIF834~1.XBO")) returned 1 [0189.900] GetProcessHeap () returned 0xfd0000 [0189.900] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.917] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.917] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936165c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361c775, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361c775, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.917] GetProcessHeap () returned 0xfd0000 [0189.917] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936165c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361c775, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361c775, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.948] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936165c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361c775, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361c775, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.948] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361a05c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.948] GetProcessHeap () returned 0xfd0000 [0189.948] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361a05c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.949] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361a05c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.949] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361a05c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.949] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.949] GetProcessHeap () returned 0xfd0000 [0189.949] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.949] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.949] GetProcessHeap () returned 0xfd0000 [0189.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.949] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.949] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.949] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.950] GetProcessHeap () returned 0xfd0000 [0189.950] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.950] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.950] GetProcessHeap () returned 0xfd0000 [0189.950] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.950] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.950] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.950] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.950] GetProcessHeap () returned 0xfd0000 [0189.950] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.950] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.950] GetProcessHeap () returned 0xfd0000 [0189.950] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.951] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.951] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.951] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0189.951] GetProcessHeap () returned 0xfd0000 [0189.951] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.951] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.951] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.951] GetProcessHeap () returned 0xfd0000 [0189.951] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.951] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c21cd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.951] GetProcessHeap () returned 0xfd0000 [0189.951] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c21cd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0189.951] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c21cd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.951] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c21cd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.951] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0189.952] GetProcessHeap () returned 0xfd0000 [0189.952] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.952] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b8588, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.952] GetProcessHeap () returned 0xfd0000 [0189.952] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b8588, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.952] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b8588, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.952] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b8588, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.952] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.952] GetProcessHeap () returned 0xfd0000 [0189.952] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.952] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b10a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.952] GetProcessHeap () returned 0xfd0000 [0189.952] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b10a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0189.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b10a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.952] FindNextFileW (in: hFindFile=0x10b7c00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b10a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.952] FindClose (in: hFindFile=0x10b7c00 | out: hFindFile=0x10b7c00) returned 1 [0189.953] GetProcessHeap () returned 0xfd0000 [0189.953] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.953] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b376c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.953] GetProcessHeap () returned 0xfd0000 [0189.953] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b376c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.953] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b376c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.953] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b376c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.953] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.953] GetProcessHeap () returned 0xfd0000 [0189.953] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.953] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935bacb1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c355f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.953] GetProcessHeap () returned 0xfd0000 [0189.953] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935bacb1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c355f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.953] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935bacb1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c355f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.953] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935c355f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c355f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c355f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.953] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935bfac7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.953] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935bfac7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0189.954] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.954] GetProcessHeap () returned 0xfd0000 [0189.954] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.954] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935be769, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.954] GetProcessHeap () returned 0xfd0000 [0189.954] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935be769, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0189.954] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935be769, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.954] FindNextFileW (in: hFindFile=0x10b7bc0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935be769, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.954] FindClose (in: hFindFile=0x10b7bc0 | out: hFindFile=0x10b7bc0) returned 1 [0189.954] GetProcessHeap () returned 0xfd0000 [0189.954] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.954] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.954] GetProcessHeap () returned 0xfd0000 [0189.954] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.954] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.955] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.955] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.955] GetProcessHeap () returned 0xfd0000 [0189.955] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.955] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.955] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.955] GetProcessHeap () returned 0xfd0000 [0189.955] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.956] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxIdentityProvider_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.XBO")) returned 1 [0189.956] GetProcessHeap () returned 0xfd0000 [0189.956] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.956] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.956] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf22e0430, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.956] GetProcessHeap () returned 0xfd0000 [0189.956] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf22e0430, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.957] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf22e0430, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.958] GetProcessHeap () returned 0xfd0000 [0189.958] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0189.978] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.978] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.978] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0189.978] GetProcessHeap () returned 0xfd0000 [0189.978] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.978] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.978] GetProcessHeap () returned 0xfd0000 [0189.978] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.979] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.979] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.979] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.979] GetProcessHeap () returned 0xfd0000 [0189.979] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.979] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.979] GetProcessHeap () returned 0xfd0000 [0189.979] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.979] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.979] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.979] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.979] GetProcessHeap () returned 0xfd0000 [0189.979] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.979] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.979] GetProcessHeap () returned 0xfd0000 [0189.979] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.980] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.980] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.980] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.980] GetProcessHeap () returned 0xfd0000 [0189.980] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.980] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.980] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.980] GetProcessHeap () returned 0xfd0000 [0189.980] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.980] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.980] GetProcessHeap () returned 0xfd0000 [0189.980] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.980] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.980] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.980] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.980] GetProcessHeap () returned 0xfd0000 [0189.980] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.980] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.980] GetProcessHeap () returned 0xfd0000 [0189.981] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.981] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.981] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.981] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.981] GetProcessHeap () returned 0xfd0000 [0189.981] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.981] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.981] GetProcessHeap () returned 0xfd0000 [0189.981] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.981] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.981] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.981] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.981] GetProcessHeap () returned 0xfd0000 [0189.981] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.981] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.981] GetProcessHeap () returned 0xfd0000 [0189.982] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0189.982] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.982] FindNextFileW (in: hFindFile=0x10b7e40, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.982] FindClose (in: hFindFile=0x10b7e40 | out: hFindFile=0x10b7e40) returned 1 [0189.982] GetProcessHeap () returned 0xfd0000 [0189.982] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.982] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.982] GetProcessHeap () returned 0xfd0000 [0189.982] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.983] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0189.983] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.983] GetProcessHeap () returned 0xfd0000 [0189.983] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.983] GetProcessHeap () returned 0xfd0000 [0189.983] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0189.983] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.983] FindClose (in: hFindFile=0x10b78c0 | out: hFindFile=0x10b78c0) returned 1 [0189.983] GetProcessHeap () returned 0xfd0000 [0189.983] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.984] GetProcessHeap () returned 0xfd0000 [0189.984] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0189.986] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x10b7e80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.986] FindClose (in: hFindFile=0x10b7e80 | out: hFindFile=0x10b7e80) returned 1 [0189.986] GetProcessHeap () returned 0xfd0000 [0189.986] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.987] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.987] GetProcessHeap () returned 0xfd0000 [0189.987] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0189.988] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.XBO")) returned 1 [0189.988] GetProcessHeap () returned 0xfd0000 [0189.988] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0189.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0189.989] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.989] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0189.990] GetProcessHeap () returned 0xfd0000 [0189.990] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.992] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.992] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0189.992] GetProcessHeap () returned 0xfd0000 [0189.992] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0189.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.992] FindNextFileW (in: hFindFile=0x10b7d80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.992] FindClose (in: hFindFile=0x10b7d80 | out: hFindFile=0x10b7d80) returned 1 [0189.992] GetProcessHeap () returned 0xfd0000 [0189.992] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.992] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0189.993] GetProcessHeap () returned 0xfd0000 [0189.993] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0189.993] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.993] FindNextFileW (in: hFindFile=0x10b7e00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.993] FindClose (in: hFindFile=0x10b7e00 | out: hFindFile=0x10b7e00) returned 1 [0189.996] GetProcessHeap () returned 0xfd0000 [0189.996] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.996] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0189.997] GetProcessHeap () returned 0xfd0000 [0189.997] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0189.997] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.997] FindNextFileW (in: hFindFile=0x10b7d00, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.997] FindClose (in: hFindFile=0x10b7d00 | out: hFindFile=0x10b7d00) returned 1 [0189.997] GetProcessHeap () returned 0xfd0000 [0189.997] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.997] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0189.997] GetProcessHeap () returned 0xfd0000 [0189.997] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0189.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.997] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.997] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.997] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.997] GetProcessHeap () returned 0xfd0000 [0189.997] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0189.997] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0189.998] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.998] GetProcessHeap () returned 0xfd0000 [0189.998] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.998] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.998] GetProcessHeap () returned 0xfd0000 [0189.998] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0189.998] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.998] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.999] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0189.999] GetProcessHeap () returned 0xfd0000 [0189.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.999] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.999] GetProcessHeap () returned 0xfd0000 [0189.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0189.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.999] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.999] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0189.999] GetProcessHeap () returned 0xfd0000 [0189.999] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0189.999] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.999] GetProcessHeap () returned 0xfd0000 [0189.999] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0189.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0189.999] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.999] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.000] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0190.000] GetProcessHeap () returned 0xfd0000 [0190.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.000] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.000] GetProcessHeap () returned 0xfd0000 [0190.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.000] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.000] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0190.000] GetProcessHeap () returned 0xfd0000 [0190.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.000] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924aecaf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.000] GetProcessHeap () returned 0xfd0000 [0190.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924aecaf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.001] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924aecaf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.001] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924aecaf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924aecaf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924aecaf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0190.001] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0190.001] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0190.001] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0190.001] GetProcessHeap () returned 0xfd0000 [0190.001] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.001] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.001] GetProcessHeap () returned 0xfd0000 [0190.001] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.001] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.002] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.002] FindClose (in: hFindFile=0x10b77c0 | out: hFindFile=0x10b77c0) returned 1 [0190.002] GetProcessHeap () returned 0xfd0000 [0190.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.002] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.002] GetProcessHeap () returned 0xfd0000 [0190.002] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.002] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.002] FindNextFileW (in: hFindFile=0x10b7a80, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.002] FindClose (in: hFindFile=0x10b7a80 | out: hFindFile=0x10b7a80) returned 1 [0190.002] GetProcessHeap () returned 0xfd0000 [0190.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.002] FindNextFileW (in: hFindFile=0x10b7d40, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.002] FindClose (in: hFindFile=0x10b7d40 | out: hFindFile=0x10b7d40) returned 1 [0190.002] GetProcessHeap () returned 0xfd0000 [0190.002] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0190.003] FindNextFileW (in: hFindFile=0x10b7a40, lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneMusic_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ZUN")) returned 1 [0190.003] GetProcessHeap () returned 0xfd0000 [0190.003] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0190.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.005] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.005] FindNextFileW (in: hFindFile=0x10b77c0, lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfac4f463, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a02b33d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a02b33d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0190.006] GetProcessHeap () returned 0xfd0000 [0190.006] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfac4f463, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a02b33d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a02b33d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.008] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfac4f463, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a02b33d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a02b33d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.008] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0190.008] GetProcessHeap () returned 0xfd0000 [0190.008] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.189] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.189] FindNextFileW (in: hFindFile=0x10b7b80, lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.189] FindClose (in: hFindFile=0x10b7b80 | out: hFindFile=0x10b7b80) returned 1 [0190.189] GetProcessHeap () returned 0xfd0000 [0190.189] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.190] FindNextFileW (in: hFindFile=0x10b78c0, lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fb785, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0190.190] GetProcessHeap () returned 0xfd0000 [0190.190] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fb785, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.218] GetProcessHeap () returned 0xfd0000 [0190.218] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.218] GetProcessHeap () returned 0xfd0000 [0190.218] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc080, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.219] GetProcessHeap () returned 0xfd0000 [0190.219] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.219] GetProcessHeap () returned 0xfd0000 [0190.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc6b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.219] GetProcessHeap () returned 0xfd0000 [0190.219] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.219] GetProcessHeap () returned 0xfd0000 [0190.219] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.219] GetProcessHeap () returned 0xfd0000 [0190.219] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac02fce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.220] GetProcessHeap () returned 0xfd0000 [0190.220] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.220] GetProcessHeap () returned 0xfd0000 [0190.220] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd388, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac02fce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.386] GetProcessHeap () returned 0xfd0000 [0190.386] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.386] GetProcessHeap () returned 0xfd0000 [0190.386] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd7b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.387] GetProcessHeap () returned 0xfd0000 [0190.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.387] GetProcessHeap () returned 0xfd0000 [0190.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fdbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.387] GetProcessHeap () returned 0xfd0000 [0190.387] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.387] GetProcessHeap () returned 0xfd0000 [0190.387] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713b1523, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.390] GetProcessHeap () returned 0xfd0000 [0190.390] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.390] GetProcessHeap () returned 0xfd0000 [0190.390] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9120e63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9120e63a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.390] GetProcessHeap () returned 0xfd0000 [0190.390] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.391] GetProcessHeap () returned 0xfd0000 [0190.391] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2592721, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.391] GetProcessHeap () returned 0xfd0000 [0190.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.391] GetProcessHeap () returned 0xfd0000 [0190.391] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0190.392] GetProcessHeap () returned 0xfd0000 [0190.392] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0190.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8f25108d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.521] GetProcessHeap () returned 0xfd0000 [0190.521] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf68824d4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a34c4f0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a34c4f0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0190.535] GetProcessHeap () returned 0xfd0000 [0190.535] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26377f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.542] GetProcessHeap () returned 0xfd0000 [0190.542] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.542] GetProcessHeap () returned 0xfd0000 [0190.542] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26389a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.549] GetProcessHeap () returned 0xfd0000 [0190.549] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.549] GetProcessHeap () returned 0xfd0000 [0190.549] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26392d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.550] GetProcessHeap () returned 0xfd0000 [0190.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.550] GetProcessHeap () returned 0xfd0000 [0190.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2639eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.550] GetProcessHeap () returned 0xfd0000 [0190.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.550] GetProcessHeap () returned 0xfd0000 [0190.550] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.550] GetProcessHeap () returned 0xfd0000 [0190.550] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf685c2d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263aaf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf685c2d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.551] GetProcessHeap () returned 0xfd0000 [0190.551] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.551] GetProcessHeap () returned 0xfd0000 [0190.551] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263b30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf67c392c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.552] GetProcessHeap () returned 0xfd0000 [0190.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.552] GetProcessHeap () returned 0xfd0000 [0190.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263bbc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.552] GetProcessHeap () returned 0xfd0000 [0190.552] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.552] GetProcessHeap () returned 0xfd0000 [0190.552] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263c636, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.553] GetProcessHeap () returned 0xfd0000 [0190.553] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.553] GetProcessHeap () returned 0xfd0000 [0190.553] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713b1523, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.555] GetProcessHeap () returned 0xfd0000 [0190.555] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.555] GetProcessHeap () returned 0xfd0000 [0190.555] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8efa262b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8efa262b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0190.556] GetProcessHeap () returned 0xfd0000 [0190.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.556] GetProcessHeap () returned 0xfd0000 [0190.556] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26b6dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0190.556] GetProcessHeap () returned 0xfd0000 [0190.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.556] GetProcessHeap () returned 0xfd0000 [0190.556] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0190.557] GetProcessHeap () returned 0xfd0000 [0190.557] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0190.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x789ce851, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.559] GetProcessHeap () returned 0xfd0000 [0190.559] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9929a00a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a6b9b29, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a6b9b29, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.561] GetProcessHeap () returned 0xfd0000 [0190.561] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271cb8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0190.562] GetProcessHeap () returned 0xfd0000 [0190.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.563] GetProcessHeap () returned 0xfd0000 [0190.563] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271d40c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.563] GetProcessHeap () returned 0xfd0000 [0190.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.563] GetProcessHeap () returned 0xfd0000 [0190.563] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271dcb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.563] GetProcessHeap () returned 0xfd0000 [0190.563] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.563] GetProcessHeap () returned 0xfd0000 [0190.563] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27be9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.569] GetProcessHeap () returned 0xfd0000 [0190.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0190.569] GetProcessHeap () returned 0xfd0000 [0190.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.569] GetProcessHeap () returned 0xfd0000 [0190.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27bf9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992278f7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.569] GetProcessHeap () returned 0xfd0000 [0190.569] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.569] GetProcessHeap () returned 0xfd0000 [0190.569] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c03e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992278f7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.570] GetProcessHeap () returned 0xfd0000 [0190.570] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.570] GetProcessHeap () returned 0xfd0000 [0190.570] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c0cd9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0190.571] GetProcessHeap () returned 0xfd0000 [0190.571] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.571] GetProcessHeap () returned 0xfd0000 [0190.571] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c1412, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.571] GetProcessHeap () returned 0xfd0000 [0190.571] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.571] GetProcessHeap () returned 0xfd0000 [0190.571] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713b1523, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.574] GetProcessHeap () returned 0xfd0000 [0190.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.574] GetProcessHeap () returned 0xfd0000 [0190.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788510a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x788510a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.574] GetProcessHeap () returned 0xfd0000 [0190.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.574] GetProcessHeap () returned 0xfd0000 [0190.574] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd28ef8f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0190.574] GetProcessHeap () returned 0xfd0000 [0190.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.574] GetProcessHeap () returned 0xfd0000 [0190.574] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0190.575] GetProcessHeap () returned 0xfd0000 [0190.575] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0190.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a8cfa4e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0190.584] GetProcessHeap () returned 0xfd0000 [0190.584] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd295fed9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddce1aab, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.585] GetProcessHeap () returned 0xfd0000 [0190.585] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.585] GetProcessHeap () returned 0xfd0000 [0190.585] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddda05d6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddda05d6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0190.586] GetProcessHeap () returned 0xfd0000 [0190.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.586] GetProcessHeap () returned 0xfd0000 [0190.586] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960e32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddce1aab, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0190.586] GetProcessHeap () returned 0xfd0000 [0190.586] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.586] GetProcessHeap () returned 0xfd0000 [0190.587] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2961813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.587] GetProcessHeap () returned 0xfd0000 [0190.587] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.587] GetProcessHeap () returned 0xfd0000 [0190.587] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd29620e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.587] GetProcessHeap () returned 0xfd0000 [0190.587] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.588] GetProcessHeap () returned 0xfd0000 [0190.588] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.620] GetProcessHeap () returned 0xfd0000 [0190.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.620] GetProcessHeap () returned 0xfd0000 [0190.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a85e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.620] GetProcessHeap () returned 0xfd0000 [0190.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.620] GetProcessHeap () returned 0xfd0000 [0190.620] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0190.620] GetProcessHeap () returned 0xfd0000 [0190.620] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0190.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0190.763] GetProcessHeap () returned 0xfd0000 [0190.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8a6d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.763] GetProcessHeap () returned 0xfd0000 [0190.763] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.763] GetProcessHeap () returned 0xfd0000 [0190.763] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8acf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.764] GetProcessHeap () returned 0xfd0000 [0190.764] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.764] GetProcessHeap () returned 0xfd0000 [0190.764] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8b2eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.765] GetProcessHeap () returned 0xfd0000 [0190.765] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0190.765] GetProcessHeap () returned 0xfd0000 [0190.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0190.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a9b49e8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a9b49e8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0190.765] GetProcessHeap () returned 0xfd0000 [0190.765] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0190.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8c000, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe5aa5c7c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0190.767] GetProcessHeap () returned 0xfd0000 [0190.767] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0190.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe5aa5c7c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0190.768] GetProcessHeap () returned 0xfd0000 [0190.768] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0190.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5800ae7c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5800ae7c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0191.690] GetProcessHeap () returned 0xfd0000 [0191.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0191.690] GetProcessHeap () returned 0xfd0000 [0191.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0191.690] GetProcessHeap () returned 0xfd0000 [0191.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0191.690] GetProcessHeap () returned 0xfd0000 [0191.690] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.692] GetProcessHeap () returned 0xfd0000 [0191.692] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2c8c8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0191.693] GetProcessHeap () returned 0xfd0000 [0191.693] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.693] GetProcessHeap () returned 0xfd0000 [0191.693] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0191.696] GetProcessHeap () returned 0xfd0000 [0191.696] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.696] GetProcessHeap () returned 0xfd0000 [0191.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8832b29, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0191.696] GetProcessHeap () returned 0xfd0000 [0191.696] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.696] GetProcessHeap () returned 0xfd0000 [0191.696] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d31d85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0191.697] GetProcessHeap () returned 0xfd0000 [0191.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.697] GetProcessHeap () returned 0xfd0000 [0191.697] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0191.697] GetProcessHeap () returned 0xfd0000 [0191.697] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0191.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0191.698] GetProcessHeap () returned 0xfd0000 [0191.698] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33442, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0191.699] GetProcessHeap () returned 0xfd0000 [0191.699] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.699] GetProcessHeap () returned 0xfd0000 [0191.699] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0191.700] GetProcessHeap () returned 0xfd0000 [0191.700] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.700] GetProcessHeap () returned 0xfd0000 [0191.700] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34378, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0191.700] GetProcessHeap () returned 0xfd0000 [0191.700] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.700] GetProcessHeap () returned 0xfd0000 [0191.700] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34794, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e80 [0191.700] GetProcessHeap () returned 0xfd0000 [0191.700] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.700] GetProcessHeap () returned 0xfd0000 [0191.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34ce1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0191.701] GetProcessHeap () returned 0xfd0000 [0191.701] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.701] GetProcessHeap () returned 0xfd0000 [0191.701] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0191.703] GetProcessHeap () returned 0xfd0000 [0191.703] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.703] GetProcessHeap () returned 0xfd0000 [0191.703] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c3f1ef, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7c00 [0191.705] GetProcessHeap () returned 0xfd0000 [0191.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.705] GetProcessHeap () returned 0xfd0000 [0191.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2dc905d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0191.705] GetProcessHeap () returned 0xfd0000 [0191.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.705] GetProcessHeap () returned 0xfd0000 [0191.705] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0191.705] GetProcessHeap () returned 0xfd0000 [0191.705] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0191.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0191.707] GetProcessHeap () returned 0xfd0000 [0191.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3170f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0191.707] GetProcessHeap () returned 0xfd0000 [0191.707] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0191.707] GetProcessHeap () returned 0xfd0000 [0191.707] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0191.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e31e63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0192.044] GetProcessHeap () returned 0xfd0000 [0192.044] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.045] GetProcessHeap () returned 0xfd0000 [0192.045] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e32663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0192.045] GetProcessHeap () returned 0xfd0000 [0192.045] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.045] GetProcessHeap () returned 0xfd0000 [0192.045] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3325d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.045] GetProcessHeap () returned 0xfd0000 [0192.045] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.045] GetProcessHeap () returned 0xfd0000 [0192.045] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e342c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.046] GetProcessHeap () returned 0xfd0000 [0192.046] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.046] GetProcessHeap () returned 0xfd0000 [0192.046] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0192.048] GetProcessHeap () returned 0xfd0000 [0192.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.048] GetProcessHeap () returned 0xfd0000 [0192.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715dffc9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0192.048] GetProcessHeap () returned 0xfd0000 [0192.048] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.048] GetProcessHeap () returned 0xfd0000 [0192.048] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e8650f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0192.049] GetProcessHeap () returned 0xfd0000 [0192.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.049] GetProcessHeap () returned 0xfd0000 [0192.049] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.049] GetProcessHeap () returned 0xfd0000 [0192.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0192.049] GetProcessHeap () returned 0xfd0000 [0192.049] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3b14e24d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b14e24d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.051] GetProcessHeap () returned 0xfd0000 [0192.051] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetCache\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eeb4b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0192.053] GetProcessHeap () returned 0xfd0000 [0192.053] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.053] GetProcessHeap () returned 0xfd0000 [0192.053] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetCookies\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebab7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0192.054] GetProcessHeap () returned 0xfd0000 [0192.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.054] GetProcessHeap () returned 0xfd0000 [0192.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetHistory\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebfeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d40 [0192.054] GetProcessHeap () returned 0xfd0000 [0192.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.054] GetProcessHeap () returned 0xfd0000 [0192.054] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\Temp\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eec53c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d80 [0192.054] GetProcessHeap () returned 0xfd0000 [0192.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.054] GetProcessHeap () returned 0xfd0000 [0192.054] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.055] GetProcessHeap () returned 0xfd0000 [0192.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.055] GetProcessHeap () returned 0xfd0000 [0192.055] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0192.056] GetProcessHeap () returned 0xfd0000 [0192.056] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.057] GetProcessHeap () returned 0xfd0000 [0192.057] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.057] GetProcessHeap () returned 0xfd0000 [0192.057] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.058] GetProcessHeap () returned 0xfd0000 [0192.058] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0192.060] GetProcessHeap () returned 0xfd0000 [0192.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Fonts\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2fbade0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.060] GetProcessHeap () returned 0xfd0000 [0192.060] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.060] GetProcessHeap () returned 0xfd0000 [0192.060] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Licenses\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ee7f08, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28ee7f08, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x28ee7f08, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0192.061] GetProcessHeap () returned 0xfd0000 [0192.061] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.061] GetProcessHeap () returned 0xfd0000 [0192.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Microsoft.WindowsAlarms\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea121655, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea121655, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xea121655, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.061] GetProcessHeap () returned 0xfd0000 [0192.061] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.061] GetProcessHeap () returned 0xfd0000 [0192.061] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\SettingsContainer\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb1a72e3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0192.062] GetProcessHeap () returned 0xfd0000 [0192.062] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.062] GetProcessHeap () returned 0xfd0000 [0192.062] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.062] GetProcessHeap () returned 0xfd0000 [0192.062] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.063] GetProcessHeap () returned 0xfd0000 [0192.063] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xba3c3c7e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xba3c3c7e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.067] GetProcessHeap () returned 0xfd0000 [0192.067] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.067] GetProcessHeap () returned 0xfd0000 [0192.067] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.067] GetProcessHeap () returned 0xfd0000 [0192.067] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8e73b662, ftLastAccessTime.dwHighDateTime=0x1d5d80d, ftLastWriteTime.dwLowDateTime=0x8e73b662, ftLastWriteTime.dwHighDateTime=0x1d5d80d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0192.068] GetProcessHeap () returned 0xfd0000 [0192.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0192.068] GetProcessHeap () returned 0xfd0000 [0192.068] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.068] GetProcessHeap () returned 0xfd0000 [0192.068] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\UNP\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0192.070] GetProcessHeap () returned 0xfd0000 [0192.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0192.070] GetProcessHeap () returned 0xfd0000 [0192.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a21090 [0192.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x349eb48 | out: lpFindFileData=0x349eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5ec06a5d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5ec06a5d, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a40 [0192.070] GetProcessHeap () returned 0xfd0000 [0192.070] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3f42870 [0192.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\*", lpFindFileData=0x349e8c0 | out: lpFindFileData=0x349e8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x65fd52e1, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x65fd52e1, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b77c0 [0192.071] GetProcessHeap () returned 0xfd0000 [0192.071] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Common Files\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5ec06a5d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5ec06a5d, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.072] GetProcessHeap () returned 0xfd0000 [0192.072] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0192.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x5ec06a5d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5ec06a5d, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.072] GetProcessHeap () returned 0xfd0000 [0192.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0192.073] GetProcessHeap () returned 0xfd0000 [0192.073] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.073] GetProcessHeap () returned 0xfd0000 [0192.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x608c661a, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x608c661a, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7d00 [0192.073] GetProcessHeap () returned 0xfd0000 [0192.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0192.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x65faedd6, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x65faedd6, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.073] GetProcessHeap () returned 0xfd0000 [0192.073] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0192.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.074] GetProcessHeap () returned 0xfd0000 [0192.074] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x650bf45b, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x650bf45b, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.079] GetProcessHeap () returned 0xfd0000 [0192.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.079] GetProcessHeap () returned 0xfd0000 [0192.079] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0192.079] GetProcessHeap () returned 0xfd0000 [0192.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0192.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x65dd7b39, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x65dd7b39, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.080] GetProcessHeap () returned 0xfd0000 [0192.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x60c33acd, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x60c33acd, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.081] GetProcessHeap () returned 0xfd0000 [0192.081] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.081] GetProcessHeap () returned 0xfd0000 [0192.081] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x611b726c, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x6143f9ec, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.082] GetProcessHeap () returned 0xfd0000 [0192.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.082] GetProcessHeap () returned 0xfd0000 [0192.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x61bffa65, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x61c25662, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0192.082] GetProcessHeap () returned 0xfd0000 [0192.082] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.082] GetProcessHeap () returned 0xfd0000 [0192.082] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x621f5314, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x624c9ecc, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e00 [0192.083] GetProcessHeap () returned 0xfd0000 [0192.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.083] GetProcessHeap () returned 0xfd0000 [0192.083] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6320cf6e, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x635ece68, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.083] GetProcessHeap () returned 0xfd0000 [0192.083] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.083] GetProcessHeap () returned 0xfd0000 [0192.083] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x63828f4a, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x63828f4a, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7e40 [0192.084] GetProcessHeap () returned 0xfd0000 [0192.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a640c0 [0192.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x349dc18 | out: lpFindFileData=0x349dc18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x644872f8, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x644ad549, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.084] GetProcessHeap () returned 0xfd0000 [0192.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a640c0 | out: hHeap=0xfd0000) returned 1 [0192.084] GetProcessHeap () returned 0xfd0000 [0192.084] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.084] GetProcessHeap () returned 0xfd0000 [0192.084] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x6494be7f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x64971fc5, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0192.085] GetProcessHeap () returned 0xfd0000 [0192.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.085] GetProcessHeap () returned 0xfd0000 [0192.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x656f1f97, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x65717bcf, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0192.085] GetProcessHeap () returned 0xfd0000 [0192.085] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.085] GetProcessHeap () returned 0xfd0000 [0192.085] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x65daf07f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x65db1701, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.086] GetProcessHeap () returned 0xfd0000 [0192.086] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0192.086] GetProcessHeap () returned 0xfd0000 [0192.086] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0192.087] GetProcessHeap () returned 0xfd0000 [0192.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0192.087] GetProcessHeap () returned 0xfd0000 [0192.087] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0192.087] GetProcessHeap () returned 0xfd0000 [0192.087] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0xff7ee8 [0192.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Microsoft Office\\*", lpFindFileData=0x349e638 | out: lpFindFileData=0x349e638*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6896099f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x6896099f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b78c0 [0192.088] GetProcessHeap () returned 0xfd0000 [0192.088] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0192.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x65ffb33d, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x66021643, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.088] GetProcessHeap () returned 0xfd0000 [0192.088] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0192.088] GetProcessHeap () returned 0xfd0000 [0192.088] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0192.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x68403673, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x68403673, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.089] GetProcessHeap () returned 0xfd0000 [0192.089] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0192.089] GetProcessHeap () returned 0xfd0000 [0192.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40028c8 [0192.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x349e3b0 | out: lpFindFileData=0x349e3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6896099f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x6896099f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7a80 [0192.089] GetProcessHeap () returned 0xfd0000 [0192.089] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x40128d0 [0192.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x349e128 | out: lpFindFileData=0x349e128*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6896099f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x6896099f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7b80 [0192.090] GetProcessHeap () returned 0xfd0000 [0192.090] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a540b8 [0192.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x349dea0 | out: lpFindFileData=0x349dea0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7a9cc2af, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x7a9cc2af, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10b7bc0 [0193.131] GetProcessHeap () returned 0xfd0000 [0193.131] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a540b8 | out: hHeap=0xfd0000) returned 1 [0193.133] GetProcessHeap () returned 0xfd0000 [0193.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40128d0 | out: hHeap=0xfd0000) returned 1 [0193.133] GetProcessHeap () returned 0xfd0000 [0193.133] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40028c8 | out: hHeap=0xfd0000) returned 1 [0193.134] GetProcessHeap () returned 0xfd0000 [0193.134] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xff7ee8 | out: hHeap=0xfd0000) returned 1 [0193.134] GetProcessHeap () returned 0xfd0000 [0193.134] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f42870 | out: hHeap=0xfd0000) returned 1 [0193.134] GetProcessHeap () returned 0xfd0000 [0193.134] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a21090 | out: hHeap=0xfd0000) returned 1 [0193.135] GetProcessHeap () returned 0xfd0000 [0193.135] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ff28c0 | out: hHeap=0xfd0000) returned 1 [0193.137] GetProcessHeap () returned 0xfd0000 [0193.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3f20048 | out: hHeap=0xfd0000) returned 1 [0193.137] GetProcessHeap () returned 0xfd0000 [0193.137] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x10a7708 | out: hHeap=0xfd0000) returned 1 [0193.138] GetProcessHeap () returned 0xfd0000 [0193.138] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1045df0 | out: hHeap=0xfd0000) returned 1 [0193.139] GetProcessHeap () returned 0xfd0000 [0193.139] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1035de8 | out: hHeap=0xfd0000) returned 1 [0193.139] SetEvent (hEvent=0x2e8) returned 1 [0193.140] SetEvent (hEvent=0x2e4) returned 1 [0193.140] SetEvent (hEvent=0x2ec) returned 1 [0193.173] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0xffffffff) returned 0x0 [0193.173] SetEvent (hEvent=0x2e8) returned 1 [0193.173] SetEvent (hEvent=0x2e4) returned 1 [0193.173] SetEvent (hEvent=0x2ec) returned 1 [0193.173] WaitForMultipleObjects (nCount=0x2, lpHandles=0x349fa84*=0x2f0, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0193.173] CloseHandle (hObject=0x2f4) returned 1 [0193.173] CloseHandle (hObject=0x2f0) returned 1 [0193.173] GetProcessHeap () returned 0xfd0000 [0193.173] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0x40297f8 [0193.173] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0193.173] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0193.173] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0193.173] GetProcessHeap () returned 0xfd0000 [0193.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40297f8 | out: hHeap=0xfd0000) returned 1 [0193.173] GetProcessHeap () returned 0xfd0000 [0193.173] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1025de0 | out: hHeap=0xfd0000) returned 1 [0193.174] CloseHandle (hObject=0x2e4) returned 1 [0193.174] CloseHandle (hObject=0x2e8) returned 1 [0193.174] CloseHandle (hObject=0x2ec) returned 1 [0193.174] GetProcessHeap () returned 0xfd0000 [0193.175] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x1015dd8 | out: hHeap=0xfd0000) returned 1 [0193.176] GetProcessHeap () returned 0xfd0000 [0193.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe87c0 | out: hHeap=0xfd0000) returned 1 [0193.176] GetProcessHeap () returned 0xfd0000 [0193.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe9780 | out: hHeap=0xfd0000) returned 1 [0193.176] GetProcessHeap () returned 0xfd0000 [0193.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe1360 | out: hHeap=0xfd0000) returned 1 [0193.176] GetProcessHeap () returned 0xfd0000 [0193.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfee500 | out: hHeap=0xfd0000) returned 1 [0193.176] GetProcessHeap () returned 0xfd0000 [0193.176] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe8600 | out: hHeap=0xfd0000) returned 1 Thread: id = 88 os_tid = 0xdfc [0142.948] GetProcessHeap () returned 0xfd0000 [0142.948] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x39a0048 [0142.949] GetProcessHeap () returned 0xfd0000 [0142.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x39b0050 [0142.949] GetProcessHeap () returned 0xfd0000 [0142.949] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0x100cd70 [0142.950] GetProcessHeap () returned 0xfd0000 [0142.950] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x110102) returned 0x3aaa020 [0142.953] GetProcessHeap () returned 0xfd0000 [0142.953] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfe0490 [0142.953] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0142.953] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0142.953] Wow64DisableWow64FsRedirection (in: OldValue=0x35df85c | out: OldValue=0x35df85c*=0x0) returned 1 [0142.953] GetProcessHeap () returned 0xfd0000 [0142.953] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0142.953] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.953] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.953] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.953] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.953] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.953] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0142.974] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0177.219] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0177.220] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0177.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0177.221] ReadFile (in: hFile=0x384, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x4000, lpOverlapped=0x0) returned 1 [0177.254] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x4010, lpOverlapped=0x0) returned 1 [0177.255] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0177.256] CloseHandle (hObject=0x384) returned 1 [0177.256] CloseHandle (hObject=0x37c) returned 1 [0177.256] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1 [0177.257] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0177.269] ResetEvent (hEvent=0x2e8) returned 1 [0177.269] SetEvent (hEvent=0x2ec) returned 1 [0177.269] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.269] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=78913) returned 1 [0177.269] CloseHandle (hObject=0x39c) returned 1 [0177.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db")) returned 0x22 [0177.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db")) returned 0x22 [0177.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.270] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0177.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0177.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0177.270] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x22, hTemplateFile=0x0) returned 0x344 [0177.272] ReadFile (in: hFile=0x39c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x13441, lpOverlapped=0x0) returned 1 [0177.274] WriteFile (in: hFile=0x344, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x13450, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x13450, lpOverlapped=0x0) returned 1 [0177.276] WriteFile (in: hFile=0x344, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xf2, lpOverlapped=0x0) returned 1 [0177.277] CloseHandle (hObject=0x39c) returned 1 [0177.277] CloseHandle (hObject=0x344) returned 1 [0177.277] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db")) returned 1 [0177.278] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0177.376] ResetEvent (hEvent=0x2e8) returned 1 [0177.376] SetEvent (hEvent=0x2ec) returned 1 [0177.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\AppQuota.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\appquota.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.383] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=1572864) returned 1 [0177.383] CloseHandle (hObject=0x37c) returned 1 [0177.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\AppQuota.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\appquota.edb")) returned 0x220 [0177.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\AppQuota.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\appquota.edb"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\AppQuota.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\appquota.edb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0177.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Internet Explorer\\Indexed DB\\AppQuota.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\internet explorer\\indexed db\\appquota.edb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.384] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0177.384] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0177.384] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3aaa058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0177.399] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x80000, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0177.399] ReadFile (in: hFile=0x37c, lpBuffer=0x3aea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3aea058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0177.403] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x140000, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0177.403] ReadFile (in: hFile=0x37c, lpBuffer=0x3b2a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3b2a058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0177.420] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7c8 | out: lpNewFilePointer=0x0) returned 1 [0177.420] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xc0112, lpOverlapped=0x0) returned 1 [0177.523] SetEndOfFile (hFile=0x37c) returned 1 [0177.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x140000, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0177.523] WriteFile (in: hFile=0x37c, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0177.525] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x80000, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0177.525] WriteFile (in: hFile=0x37c, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0177.527] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0177.527] WriteFile (in: hFile=0x37c, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0177.529] CloseHandle (hObject=0x37c) returned 1 [0177.529] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0179.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0179.097] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=16384) returned 1 [0179.098] CloseHandle (hObject=0x390) returned 1 [0179.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0x20 [0179.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0x20 [0179.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0179.098] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.098] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0179.113] ReadFile (in: hFile=0x390, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x4000, lpOverlapped=0x0) returned 1 [0179.114] WriteFile (in: hFile=0x360, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x4010, lpOverlapped=0x0) returned 1 [0179.116] WriteFile (in: hFile=0x360, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xf2, lpOverlapped=0x0) returned 1 [0179.116] CloseHandle (hObject=0x390) returned 1 [0179.116] CloseHandle (hObject=0x360) returned 1 [0179.125] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 1 [0179.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.151] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=413432) returned 1 [0179.151] CloseHandle (hObject=0x37c) returned 1 [0179.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db")) returned 0x20 [0179.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db")) returned 0x20 [0179.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.152] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.152] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.152] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.152] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x398 [0179.160] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x64ef8, lpOverlapped=0x0) returned 1 [0179.169] WriteFile (in: hFile=0x398, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x64f00, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x64f00, lpOverlapped=0x0) returned 1 [0179.178] WriteFile (in: hFile=0x398, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x162, lpOverlapped=0x0) returned 1 [0179.178] CloseHandle (hObject=0x37c) returned 1 [0179.178] CloseHandle (hObject=0x398) returned 1 [0179.179] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2B16BD47-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{2b16bd47-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db")) returned 1 [0179.184] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.189] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=79536) returned 1 [0179.189] CloseHandle (hObject=0x37c) returned 1 [0179.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db")) returned 0x20 [0179.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db")) returned 0x20 [0179.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.190] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.190] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.190] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.190] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x390 [0179.190] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x136b0, lpOverlapped=0x0) returned 1 [0179.274] WriteFile (in: hFile=0x390, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x136c0, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x136c0, lpOverlapped=0x0) returned 1 [0179.276] WriteFile (in: hFile=0x390, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x162, lpOverlapped=0x0) returned 1 [0179.276] CloseHandle (hObject=0x37c) returned 1 [0179.276] CloseHandle (hObject=0x390) returned 1 [0179.332] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000020.db")) returned 1 [0179.335] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.336] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.336] CloseHandle (hObject=0x370) returned 1 [0179.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db")) returned 0x2020 [0179.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db")) returned 0x2020 [0179.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.337] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.337] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x37c [0179.338] ReadFile (in: hFile=0x370, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.339] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.340] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0179.340] CloseHandle (hObject=0x370) returned 1 [0179.340] CloseHandle (hObject=0x37c) returned 1 [0179.340] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db")) returned 1 [0179.341] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.341] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=1048576) returned 1 [0179.341] CloseHandle (hObject=0x37c) returned 1 [0179.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db")) returned 0x2020 [0179.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db")) returned 0x2020 [0179.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.342] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.342] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.343] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.343] CloseHandle (hObject=0x37c) returned 1 [0179.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db")) returned 0x2020 [0179.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db")) returned 0x2020 [0179.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.344] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.344] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.344] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.344] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x370 [0179.344] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.346] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.347] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0179.347] CloseHandle (hObject=0x37c) returned 1 [0179.347] CloseHandle (hObject=0x370) returned 1 [0179.347] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db")) returned 1 [0179.348] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.348] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=3145728) returned 1 [0179.348] CloseHandle (hObject=0x370) returned 1 [0179.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db")) returned 0x2020 [0179.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0179.349] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db")) returned 1 [0179.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.350] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=3145728) returned 1 [0179.350] CloseHandle (hObject=0x370) returned 1 [0179.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")) returned 0x2020 [0179.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0179.351] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")) returned 1 [0179.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.352] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.352] CloseHandle (hObject=0x370) returned 1 [0179.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db")) returned 0x2020 [0179.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db")) returned 0x2020 [0179.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.353] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.354] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.354] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x37c [0179.354] ReadFile (in: hFile=0x370, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.355] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.356] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0179.357] CloseHandle (hObject=0x370) returned 1 [0179.357] CloseHandle (hObject=0x37c) returned 1 [0179.357] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db")) returned 1 [0179.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.358] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.358] CloseHandle (hObject=0x37c) returned 1 [0179.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db")) returned 0x2020 [0179.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db")) returned 0x2020 [0179.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.359] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.359] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.359] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.359] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x370 [0179.359] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.360] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.361] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xf2, lpOverlapped=0x0) returned 1 [0179.362] CloseHandle (hObject=0x37c) returned 1 [0179.362] CloseHandle (hObject=0x370) returned 1 [0179.362] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db")) returned 1 [0179.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.378] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.378] CloseHandle (hObject=0x370) returned 1 [0179.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db")) returned 0x2020 [0179.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db")) returned 0x2020 [0179.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.378] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.378] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.378] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.378] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x37c [0179.385] ReadFile (in: hFile=0x370, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.386] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.387] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x112, lpOverlapped=0x0) returned 1 [0179.387] CloseHandle (hObject=0x370) returned 1 [0179.387] CloseHandle (hObject=0x37c) returned 1 [0179.387] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db")) returned 1 [0179.389] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.389] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.389] CloseHandle (hObject=0x37c) returned 1 [0179.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db")) returned 0x2020 [0179.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db")) returned 0x2020 [0179.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.530] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.530] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x37c [0179.581] ReadFile (in: hFile=0x384, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.582] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.583] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0179.583] CloseHandle (hObject=0x384) returned 1 [0179.583] CloseHandle (hObject=0x37c) returned 1 [0179.583] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db")) returned 1 [0179.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.614] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=116496) returned 1 [0179.614] CloseHandle (hObject=0x37c) returned 1 [0179.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")) returned 0x2020 [0179.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")) returned 0x2020 [0179.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.615] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.615] CloseHandle (hObject=0x37c) returned 1 [0179.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db")) returned 0x2020 [0179.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db")) returned 0x2020 [0179.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.615] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.616] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x370 [0179.621] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.622] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.623] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xf2, lpOverlapped=0x0) returned 1 [0179.623] CloseHandle (hObject=0x37c) returned 1 [0179.623] CloseHandle (hObject=0x370) returned 1 [0179.624] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db")) returned 1 [0179.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.625] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.625] CloseHandle (hObject=0x370) returned 1 [0179.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db")) returned 0x2020 [0179.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db")) returned 0x2020 [0179.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.625] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.626] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x37c [0179.626] ReadFile (in: hFile=0x370, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.627] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.629] WriteFile (in: hFile=0x37c, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0179.629] CloseHandle (hObject=0x370) returned 1 [0179.629] CloseHandle (hObject=0x37c) returned 1 [0179.629] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db")) returned 1 [0179.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.631] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.631] CloseHandle (hObject=0x37c) returned 1 [0179.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db")) returned 0x2020 [0179.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db")) returned 0x2020 [0179.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.632] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.632] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.632] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0179.632] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x370 [0179.632] ReadFile (in: hFile=0x37c, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x18, lpOverlapped=0x0) returned 1 [0179.634] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x20, lpOverlapped=0x0) returned 1 [0179.635] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x112, lpOverlapped=0x0) returned 1 [0179.635] CloseHandle (hObject=0x37c) returned 1 [0179.635] CloseHandle (hObject=0x370) returned 1 [0179.635] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db")) returned 1 [0179.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.636] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.636] CloseHandle (hObject=0x370) returned 1 [0179.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db")) returned 0x2020 [0179.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db")) returned 0x2020 [0179.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.637] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.638] CloseHandle (hObject=0x370) returned 1 [0179.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db")) returned 0x2020 [0179.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db")) returned 0x2020 [0179.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.638] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.639] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.639] CloseHandle (hObject=0x370) returned 1 [0179.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db")) returned 0x2020 [0179.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db")) returned 0x2020 [0179.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.640] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=1048576) returned 1 [0179.640] CloseHandle (hObject=0x370) returned 1 [0179.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0x2020 [0179.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0x2020 [0179.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.644] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.645] CloseHandle (hObject=0x370) returned 1 [0179.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db")) returned 0x2020 [0179.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db")) returned 0x2020 [0179.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.645] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.646] CloseHandle (hObject=0x370) returned 1 [0179.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0x2020 [0179.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0x2020 [0179.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.646] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=1048576) returned 1 [0179.647] CloseHandle (hObject=0x370) returned 1 [0179.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db")) returned 0x2020 [0179.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db")) returned 0x2020 [0179.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.648] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=1048576) returned 1 [0179.648] CloseHandle (hObject=0x370) returned 1 [0179.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db")) returned 0x2020 [0179.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db")) returned 0x2020 [0179.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.649] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.649] CloseHandle (hObject=0x370) returned 1 [0179.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0x2020 [0179.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0x2020 [0179.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.651] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.651] CloseHandle (hObject=0x370) returned 1 [0179.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db")) returned 0x2020 [0179.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db")) returned 0x2020 [0179.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.652] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.652] CloseHandle (hObject=0x370) returned 1 [0179.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db")) returned 0x2020 [0179.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db")) returned 0x2020 [0179.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.653] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=7416) returned 1 [0179.653] CloseHandle (hObject=0x370) returned 1 [0179.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0x2020 [0179.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0x2020 [0179.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.654] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.654] CloseHandle (hObject=0x370) returned 1 [0179.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0x2020 [0179.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0x2020 [0179.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.655] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.655] CloseHandle (hObject=0x370) returned 1 [0179.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db")) returned 0x2020 [0179.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db")) returned 0x2020 [0179.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.656] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=24) returned 1 [0179.656] CloseHandle (hObject=0x370) returned 1 [0179.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db")) returned 0x2020 [0179.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db")) returned 0x2020 [0179.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.657] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=1048576) returned 1 [0179.657] CloseHandle (hObject=0x370) returned 1 [0179.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db")) returned 0x20 [0179.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db")) returned 0x20 [0179.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-shm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.659] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=32768) returned 1 [0179.659] CloseHandle (hObject=0x370) returned 1 [0179.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-shm")) returned 0x20 [0179.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-shm")) returned 0x20 [0179.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-shm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-shm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.379] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.380] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0180.525] ResetEvent (hEvent=0x2e8) returned 1 [0180.525] SetEvent (hEvent=0x2ec) returned 1 [0180.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0180.526] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=262144) returned 1 [0180.526] CloseHandle (hObject=0x360) returned 1 [0180.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite")) returned 0x20 [0180.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite")) returned 0x20 [0180.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.526] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0180.526] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0180.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x384 [0180.528] ReadFile (in: hFile=0x360, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x40000, lpOverlapped=0x0) returned 1 [0180.535] WriteFile (in: hFile=0x384, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x40010, lpOverlapped=0x0) returned 1 [0180.542] WriteFile (in: hFile=0x384, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xf2, lpOverlapped=0x0) returned 1 [0180.542] CloseHandle (hObject=0x360) returned 1 [0180.542] CloseHandle (hObject=0x384) returned 1 [0180.542] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite")) returned 1 [0180.545] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0183.216] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0183.388] ResetEvent (hEvent=0x2e8) returned 1 [0183.388] SetEvent (hEvent=0x2ec) returned 1 [0183.388] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.390] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=2621440) returned 1 [0183.390] CloseHandle (hObject=0x398) returned 1 [0183.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb")) returned 0x220 [0183.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0183.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\IndexedDB.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\indexeddb.edb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.393] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0183.393] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0183.393] ReadFile (in: hFile=0x398, lpBuffer=0x3aaa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3aaa058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0183.398] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xd5555, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0183.398] ReadFile (in: hFile=0x398, lpBuffer=0x3aea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3aea058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0183.409] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x240000, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0183.409] ReadFile (in: hFile=0x398, lpBuffer=0x3b2a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3b2a058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0183.425] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7c8 | out: lpNewFilePointer=0x0) returned 1 [0183.425] WriteFile (in: hFile=0x398, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xc0112, lpOverlapped=0x0) returned 1 [0183.445] SetEndOfFile (hFile=0x398) returned 1 [0183.445] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x240000, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0183.445] WriteFile (in: hFile=0x398, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0183.447] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xd5555, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0183.447] WriteFile (in: hFile=0x398, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0183.561] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0183.561] WriteFile (in: hFile=0x398, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0183.564] CloseHandle (hObject=0x398) returned 1 [0183.564] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0187.489] ResetEvent (hEvent=0x2e8) returned 1 [0187.489] SetEvent (hEvent=0x2ec) returned 1 [0187.490] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.494] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=6815744) returned 1 [0187.494] CloseHandle (hObject=0x370) returned 1 [0187.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb")) returned 0x220 [0187.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0187.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.504] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0187.504] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0187.504] ReadFile (in: hFile=0x370, lpBuffer=0x3aaa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3aaa058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0187.510] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x22aaaa, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0187.510] ReadFile (in: hFile=0x370, lpBuffer=0x3aea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3aea058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0187.521] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x640000, lpNewFilePointer=0x0, dwMoveMethod=0x35df658 | out: lpNewFilePointer=0x0) returned 1 [0187.521] ReadFile (in: hFile=0x370, lpBuffer=0x3b2a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35df664, lpOverlapped=0x0 | out: lpBuffer=0x3b2a058*, lpNumberOfBytesRead=0x35df664*=0x40000, lpOverlapped=0x0) returned 1 [0187.535] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7c8 | out: lpNewFilePointer=0x0) returned 1 [0187.535] WriteFile (in: hFile=0x370, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0xc0112, lpOverlapped=0x0) returned 1 [0187.757] SetEndOfFile (hFile=0x370) returned 1 [0187.758] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x640000, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0187.758] WriteFile (in: hFile=0x370, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x22aaaa, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0187.760] WriteFile (in: hFile=0x370, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0187.762] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df660 | out: lpNewFilePointer=0x0) returned 1 [0187.762] WriteFile (in: hFile=0x370, lpBuffer=0x3b6a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35df66c, lpOverlapped=0x0 | out: lpBuffer=0x3b6a14a*, lpNumberOfBytesWritten=0x35df66c*=0x40000, lpOverlapped=0x0) returned 1 [0187.763] CloseHandle (hObject=0x370) returned 1 [0187.763] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0188.238] ResetEvent (hEvent=0x2e8) returned 1 [0188.238] SetEvent (hEvent=0x2ec) returned 1 [0188.239] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.245] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x35df808 | out: lpFileSize=0x35df808*=4096) returned 1 [0188.245] CloseHandle (hObject=0x344) returned 1 [0188.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite")) returned 0x20 [0188.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite")) returned 0x20 [0188.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.245] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.245] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0188.245] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35df7d0 | out: lpNewFilePointer=0x0) returned 1 [0188.245] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x398 [0188.247] ReadFile (in: hFile=0x344, lpBuffer=0x3aaa020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x35df7dc, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesRead=0x35df7dc*=0x1000, lpOverlapped=0x0) returned 1 [0188.249] WriteFile (in: hFile=0x398, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x1010, lpOverlapped=0x0) returned 1 [0188.250] WriteFile (in: hFile=0x398, lpBuffer=0x3aaa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35df7c0, lpOverlapped=0x0 | out: lpBuffer=0x3aaa020*, lpNumberOfBytesWritten=0x35df7c0*=0x102, lpOverlapped=0x0) returned 1 [0188.251] CloseHandle (hObject=0x344) returned 1 [0188.251] CloseHandle (hObject=0x398) returned 1 [0188.251] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite")) returned 1 [0188.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0192.069] ResetEvent (hEvent=0x2e8) returned 1 [0192.069] SetEvent (hEvent=0x2ec) returned 1 [0192.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.070] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0193.162] GetProcessHeap () returned 0xfd0000 [0193.162] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0x40298a8 [0193.162] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0193.162] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0193.162] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0193.162] GetProcessHeap () returned 0xfd0000 [0193.162] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40298a8 | out: hHeap=0xfd0000) returned 1 [0193.162] SetEvent (hEvent=0x2e8) returned 1 [0193.162] SetEvent (hEvent=0x2e4) returned 1 [0193.162] SetEvent (hEvent=0x2ec) returned 1 [0193.162] GetProcessHeap () returned 0xfd0000 [0193.162] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3aaa020 | out: hHeap=0xfd0000) returned 1 [0193.167] GetProcessHeap () returned 0xfd0000 [0193.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100cd70 | out: hHeap=0xfd0000) returned 1 [0193.167] GetProcessHeap () returned 0xfd0000 [0193.167] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x39a0048 | out: hHeap=0xfd0000) returned 1 [0193.168] GetProcessHeap () returned 0xfd0000 [0193.168] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x39b0050 | out: hHeap=0xfd0000) returned 1 Thread: id = 89 os_tid = 0xe00 [0142.996] GetProcessHeap () returned 0xfd0000 [0142.996] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x39c0058 [0142.996] GetProcessHeap () returned 0xfd0000 [0142.996] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x39d0060 [0142.997] GetProcessHeap () returned 0xfd0000 [0142.997] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0x100cda0 [0142.997] GetProcessHeap () returned 0xfd0000 [0142.997] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x110102) returned 0x3bc0020 [0143.000] GetProcessHeap () returned 0xfd0000 [0143.000] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfe0490 [0143.000] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0143.000] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0143.000] Wow64DisableWow64FsRedirection (in: OldValue=0x371fb0c | out: OldValue=0x371fb0c*=0x0) returned 1 [0143.000] GetProcessHeap () returned 0xfd0000 [0143.000] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0143.000] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.000] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.000] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.001] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.002] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.003] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.004] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.005] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.006] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.007] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.008] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.009] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.010] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.011] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.012] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.013] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.014] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.015] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.016] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.017] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.018] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0143.020] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0179.112] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.112] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x398 [0179.126] ReadFile (in: hFile=0x37c, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x4000, lpOverlapped=0x0) returned 1 [0179.142] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x4010, lpOverlapped=0x0) returned 1 [0179.146] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0xf2, lpOverlapped=0x0) returned 1 [0179.146] CloseHandle (hObject=0x37c) returned 1 [0179.146] CloseHandle (hObject=0x398) returned 1 [0179.148] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db")) returned 0 [0179.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0179.149] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=95104) returned 1 [0179.149] CloseHandle (hObject=0x398) returned 1 [0179.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db")) returned 0x20 [0179.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db")) returned 0x20 [0179.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0179.150] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.150] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.150] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0179.152] ReadFile (in: hFile=0x398, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x17380, lpOverlapped=0x0) returned 1 [0179.155] WriteFile (in: hFile=0x360, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x17390, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x17390, lpOverlapped=0x0) returned 1 [0179.157] WriteFile (in: hFile=0x360, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x162, lpOverlapped=0x0) returned 1 [0179.157] CloseHandle (hObject=0x398) returned 1 [0179.158] CloseHandle (hObject=0x360) returned 1 [0179.158] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000031.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000031.db")) returned 0 [0179.158] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.159] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=99952) returned 1 [0179.159] CloseHandle (hObject=0x360) returned 1 [0179.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db")) returned 0x20 [0179.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db")) returned 0x20 [0179.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.159] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.159] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.159] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x398 [0179.184] ReadFile (in: hFile=0x360, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x18670, lpOverlapped=0x0) returned 1 [0179.186] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x18680, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x18680, lpOverlapped=0x0) returned 1 [0179.264] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x162, lpOverlapped=0x0) returned 1 [0179.264] CloseHandle (hObject=0x360) returned 1 [0179.264] CloseHandle (hObject=0x398) returned 1 [0179.264] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000032.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.3.ver0x0000000000000032.db")) returned 0 [0179.264] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0179.265] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=79424) returned 1 [0179.265] CloseHandle (hObject=0x398) returned 1 [0179.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db")) returned 0x20 [0179.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db")) returned 0x20 [0179.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.272] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0179.272] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.272] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.273] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0179.303] ReadFile (in: hFile=0x398, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x13640, lpOverlapped=0x0) returned 1 [0179.315] WriteFile (in: hFile=0x360, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x13650, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x13650, lpOverlapped=0x0) returned 1 [0179.317] WriteFile (in: hFile=0x360, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x162, lpOverlapped=0x0) returned 1 [0179.317] CloseHandle (hObject=0x398) returned 1 [0179.318] CloseHandle (hObject=0x360) returned 1 [0179.318] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000021.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000021.db")) returned 0 [0179.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.320] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=24) returned 1 [0179.320] CloseHandle (hObject=0x360) returned 1 [0179.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db")) returned 0x2020 [0179.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db")) returned 0x2020 [0179.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.320] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.320] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.320] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0179.320] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x398 [0179.321] ReadFile (in: hFile=0x360, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x18, lpOverlapped=0x0) returned 1 [0179.322] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x20, lpOverlapped=0x0) returned 1 [0179.324] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x102, lpOverlapped=0x0) returned 1 [0179.324] CloseHandle (hObject=0x360) returned 1 [0179.324] CloseHandle (hObject=0x398) returned 1 [0179.324] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db")) returned 1 [0179.325] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0179.325] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=2097152) returned 1 [0179.325] CloseHandle (hObject=0x398) returned 1 [0179.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db")) returned 0x2020 [0179.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0179.326] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0179.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0179.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0179.327] ReadFile (in: hFile=0x398, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x371f914, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x371f914*=0x40000, lpOverlapped=0x0) returned 1 [0179.366] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0179.366] ReadFile (in: hFile=0x398, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x371f914, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x371f914*=0x40000, lpOverlapped=0x0) returned 1 [0179.399] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0179.399] ReadFile (in: hFile=0x398, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x371f914, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x371f914*=0x40000, lpOverlapped=0x0) returned 1 [0179.531] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa78 | out: lpNewFilePointer=0x0) returned 1 [0179.531] WriteFile (in: hFile=0x398, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0xc0112, lpOverlapped=0x0) returned 1 [0180.322] SetEndOfFile (hFile=0x398) returned 1 [0180.323] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x371f910 | out: lpNewFilePointer=0x0) returned 1 [0180.323] WriteFile (in: hFile=0x398, lpBuffer=0x3c8014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x371f91c, lpOverlapped=0x0 | out: lpBuffer=0x3c8014a*, lpNumberOfBytesWritten=0x371f91c*=0x40000, lpOverlapped=0x0) returned 1 [0180.325] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x371f910 | out: lpNewFilePointer=0x0) returned 1 [0180.325] WriteFile (in: hFile=0x398, lpBuffer=0x3c8014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x371f91c, lpOverlapped=0x0 | out: lpBuffer=0x3c8014a*, lpNumberOfBytesWritten=0x371f91c*=0x40000, lpOverlapped=0x0) returned 1 [0180.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371f910 | out: lpNewFilePointer=0x0) returned 1 [0180.327] WriteFile (in: hFile=0x398, lpBuffer=0x3c8014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x371f91c, lpOverlapped=0x0 | out: lpBuffer=0x3c8014a*, lpNumberOfBytesWritten=0x371f91c*=0x40000, lpOverlapped=0x0) returned 1 [0180.330] CloseHandle (hObject=0x398) returned 1 [0180.330] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-wal"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.331] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=98912) returned 1 [0180.331] CloseHandle (hObject=0x398) returned 1 [0180.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-wal")) returned 0x20 [0180.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-wal")) returned 0x20 [0180.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-wal.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-wal.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.331] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpndatabase.db-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\notifications\\wpndatabase.db-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.332] ResetEvent (hEvent=0x2e8) returned 1 [0180.332] SetEvent (hEvent=0x2ec) returned 1 [0180.332] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.334] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=1441792) returned 1 [0180.334] CloseHandle (hObject=0x398) returned 1 [0180.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb")) returned 0x20 [0180.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb")) returned 0x20 [0180.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.334] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.334] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0180.334] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa80 | out: lpNewFilePointer=0x0) returned 1 [0180.334] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0180.335] ReadFile (in: hFile=0x398, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x110100, lpOverlapped=0x0) returned 1 [0180.562] WriteFile (in: hFile=0x368, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x110100, lpOverlapped=0x0) returned 1 [0180.691] ReadFile (in: hFile=0x398, lpBuffer=0x3bc0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x371fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesRead=0x371fa8c*=0x4ff00, lpOverlapped=0x0) returned 1 [0180.694] WriteFile (in: hFile=0x368, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0x4ff10, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0x4ff10, lpOverlapped=0x0) returned 1 [0180.701] WriteFile (in: hFile=0x368, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0xf2, lpOverlapped=0x0) returned 1 [0180.701] CloseHandle (hObject=0x398) returned 1 [0180.701] CloseHandle (hObject=0x368) returned 1 [0180.702] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\metastore\\meta.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\settingsync\\metastore\\meta.edb")) returned 1 [0180.766] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0183.216] ResetEvent (hEvent=0x2e8) returned 1 [0183.216] SetEvent (hEvent=0x2ec) returned 1 [0183.216] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0183.277] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x371fab8 | out: lpFileSize=0x371fab8*=2097152) returned 1 [0183.277] CloseHandle (hObject=0x25c) returned 1 [0183.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb")) returned 0x2020 [0183.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb"), lpNewFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0183.279] CreateFileW (lpFileName="\\\\?\\C:\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\spartan.edb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\spartan.edb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0183.279] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0183.279] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0183.279] ReadFile (in: hFile=0x25c, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x371f914, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x371f914*=0x40000, lpOverlapped=0x0) returned 1 [0183.310] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0183.310] ReadFile (in: hFile=0x25c, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x371f914, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x371f914*=0x40000, lpOverlapped=0x0) returned 1 [0183.317] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x371f908 | out: lpNewFilePointer=0x0) returned 1 [0183.317] ReadFile (in: hFile=0x25c, lpBuffer=0x3c40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x371f914, lpOverlapped=0x0 | out: lpBuffer=0x3c40058*, lpNumberOfBytesRead=0x371f914*=0x40000, lpOverlapped=0x0) returned 1 [0183.329] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371fa78 | out: lpNewFilePointer=0x0) returned 1 [0183.329] WriteFile (in: hFile=0x25c, lpBuffer=0x3bc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x371fa70, lpOverlapped=0x0 | out: lpBuffer=0x3bc0020*, lpNumberOfBytesWritten=0x371fa70*=0xc0102, lpOverlapped=0x0) returned 1 [0183.513] SetEndOfFile (hFile=0x25c) returned 1 [0183.514] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x371f910 | out: lpNewFilePointer=0x0) returned 1 [0183.514] WriteFile (in: hFile=0x25c, lpBuffer=0x3c8013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x371f91c, lpOverlapped=0x0 | out: lpBuffer=0x3c8013a*, lpNumberOfBytesWritten=0x371f91c*=0x40000, lpOverlapped=0x0) returned 1 [0183.516] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x371f910 | out: lpNewFilePointer=0x0) returned 1 [0183.516] WriteFile (in: hFile=0x25c, lpBuffer=0x3c8013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x371f91c, lpOverlapped=0x0 | out: lpBuffer=0x3c8013a*, lpNumberOfBytesWritten=0x371f91c*=0x40000, lpOverlapped=0x0) returned 1 [0183.518] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x371f910 | out: lpNewFilePointer=0x0) returned 1 [0183.518] WriteFile (in: hFile=0x25c, lpBuffer=0x3c8013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x371f91c, lpOverlapped=0x0 | out: lpBuffer=0x3c8013a*, lpNumberOfBytesWritten=0x371f91c*=0x40000, lpOverlapped=0x0) returned 1 [0183.520] CloseHandle (hObject=0x25c) returned 1 [0183.520] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0187.492] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0188.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0192.070] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0193.140] GetProcessHeap () returned 0xfd0000 [0193.140] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0x40296f0 [0193.140] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0193.140] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0193.140] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0193.140] GetProcessHeap () returned 0xfd0000 [0193.140] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x40296f0 | out: hHeap=0xfd0000) returned 1 [0193.140] SetEvent (hEvent=0x2e8) returned 1 [0193.140] SetEvent (hEvent=0x2e4) returned 1 [0193.140] SetEvent (hEvent=0x2ec) returned 1 [0193.140] GetProcessHeap () returned 0xfd0000 [0193.140] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3bc0020 | out: hHeap=0xfd0000) returned 1 [0193.147] GetProcessHeap () returned 0xfd0000 [0193.147] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100cda0 | out: hHeap=0xfd0000) returned 1 [0193.147] GetProcessHeap () returned 0xfd0000 [0193.147] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x39c0058 | out: hHeap=0xfd0000) returned 1 [0193.147] GetProcessHeap () returned 0xfd0000 [0193.147] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x39d0060 | out: hHeap=0xfd0000) returned 1 Thread: id = 90 os_tid = 0xe04 [0143.065] GetProcessHeap () returned 0xfd0000 [0143.065] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x39e0068 [0143.066] GetProcessHeap () returned 0xfd0000 [0143.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x39f0070 [0143.066] GetProcessHeap () returned 0xfd0000 [0143.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0x100ca10 [0143.066] GetProcessHeap () returned 0xfd0000 [0143.066] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x110102) returned 0x3ce5020 [0143.069] GetProcessHeap () returned 0xfd0000 [0143.069] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfe0490 [0143.070] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0143.070] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0143.070] Wow64DisableWow64FsRedirection (in: OldValue=0x385fe2c | out: OldValue=0x385fe2c*=0x0) returned 1 [0143.070] GetProcessHeap () returned 0xfd0000 [0143.070] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0143.070] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0143.070] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=129) returned 1 [0143.070] CloseHandle (hObject=0x320) returned 1 [0143.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0143.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0143.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0x26 [0143.072] ResetEvent (hEvent=0x300) returned 1 [0143.072] SetEvent (hEvent=0x304) returned 1 [0143.072] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0143.075] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=0) returned 1 [0143.075] CloseHandle (hObject=0x320) returned 1 [0143.075] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.450] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.454] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=0) returned 1 [0143.455] CloseHandle (hObject=0x334) returned 1 [0143.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.456] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=99744) returned 1 [0143.456] CloseHandle (hObject=0x334) returned 1 [0143.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0143.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0143.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.456] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.457] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.457] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=76632) returned 1 [0143.457] CloseHandle (hObject=0x334) returned 1 [0143.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0143.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0143.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.458] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.458] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.458] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=75616) returned 1 [0143.458] CloseHandle (hObject=0x334) returned 1 [0143.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0143.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0143.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.459] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.459] ResetEvent (hEvent=0x300) returned 1 [0143.459] SetEvent (hEvent=0x304) returned 1 [0143.459] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.461] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45472) returned 1 [0143.461] CloseHandle (hObject=0x334) returned 1 [0143.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0143.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0143.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.462] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.462] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.465] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45984) returned 1 [0143.465] CloseHandle (hObject=0x334) returned 1 [0143.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0143.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0143.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.466] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.466] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.467] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.469] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=74072) returned 1 [0143.469] CloseHandle (hObject=0x334) returned 1 [0143.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0143.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0143.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.469] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.469] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.472] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=44960) returned 1 [0143.472] CloseHandle (hObject=0x334) returned 1 [0143.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0143.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0143.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.473] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.473] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.474] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.478] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=77664) returned 1 [0143.478] CloseHandle (hObject=0x334) returned 1 [0143.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0143.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0143.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.479] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.479] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.482] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=76640) returned 1 [0143.482] CloseHandle (hObject=0x334) returned 1 [0143.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0143.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0143.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.482] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.482] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.487] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.492] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3878410) returned 1 [0143.492] CloseHandle (hObject=0x334) returned 1 [0143.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0143.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0143.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0143.492] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.499] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1985867) returned 1 [0143.499] CloseHandle (hObject=0x334) returned 1 [0143.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0143.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0143.501] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0143.501] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.509] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=177414) returned 1 [0143.509] CloseHandle (hObject=0x334) returned 1 [0143.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0143.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0143.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.518] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=143754) returned 1 [0143.518] CloseHandle (hObject=0x334) returned 1 [0143.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0143.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0143.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.520] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.524] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=154427) returned 1 [0143.524] CloseHandle (hObject=0x334) returned 1 [0143.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0143.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0143.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.525] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=156245) returned 1 [0143.525] CloseHandle (hObject=0x334) returned 1 [0143.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0143.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0143.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.527] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=44859) returned 1 [0143.527] CloseHandle (hObject=0x334) returned 1 [0143.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0143.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0143.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.529] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=79200) returned 1 [0143.529] CloseHandle (hObject=0x334) returned 1 [0143.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0143.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0143.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.530] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=79192) returned 1 [0143.530] CloseHandle (hObject=0x334) returned 1 [0143.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0143.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0143.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.530] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45984) returned 1 [0143.530] CloseHandle (hObject=0x334) returned 1 [0143.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0143.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0143.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.531] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=76640) returned 1 [0143.531] CloseHandle (hObject=0x334) returned 1 [0143.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0143.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0143.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.532] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=78688) returned 1 [0143.532] CloseHandle (hObject=0x334) returned 1 [0143.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0143.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0143.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.532] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45976) returned 1 [0143.532] CloseHandle (hObject=0x334) returned 1 [0143.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0143.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0143.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.533] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=77144) returned 1 [0143.533] CloseHandle (hObject=0x334) returned 1 [0143.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0143.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0143.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.534] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.534] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45472) returned 1 [0143.534] CloseHandle (hObject=0x334) returned 1 [0143.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0143.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0143.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.535] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=67424) returned 1 [0143.535] CloseHandle (hObject=0x334) returned 1 [0143.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0143.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0143.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.536] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42904) returned 1 [0143.536] CloseHandle (hObject=0x334) returned 1 [0143.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0143.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0143.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.536] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=66912) returned 1 [0143.536] CloseHandle (hObject=0x334) returned 1 [0143.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0143.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0143.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.537] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42912) returned 1 [0143.537] CloseHandle (hObject=0x334) returned 1 [0143.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0143.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0143.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.538] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.538] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=75616) returned 1 [0143.538] CloseHandle (hObject=0x334) returned 1 [0143.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0143.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0143.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.538] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.538] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.539] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=75608) returned 1 [0143.539] CloseHandle (hObject=0x334) returned 1 [0143.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0143.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0143.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.539] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.539] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.539] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=811936) returned 1 [0143.539] CloseHandle (hObject=0x334) returned 1 [0143.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0143.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0143.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\memtest.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.540] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.540] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.540] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=75616) returned 1 [0143.540] CloseHandle (hObject=0x334) returned 1 [0143.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0143.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0143.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.540] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.541] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.750] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45472) returned 1 [0143.750] CloseHandle (hObject=0x34c) returned 1 [0143.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0143.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0143.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.751] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.751] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.751] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=76640) returned 1 [0143.751] CloseHandle (hObject=0x34c) returned 1 [0143.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0143.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0143.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.751] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.752] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=77152) returned 1 [0143.752] CloseHandle (hObject=0x34c) returned 1 [0143.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0143.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0143.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.753] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=44888) returned 1 [0143.753] CloseHandle (hObject=0x34c) returned 1 [0143.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0143.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0143.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.753] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.753] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.753] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=77152) returned 1 [0143.753] CloseHandle (hObject=0x34c) returned 1 [0143.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0143.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0143.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.754] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.754] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.754] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=76128) returned 1 [0143.754] CloseHandle (hObject=0x34c) returned 1 [0143.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0143.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0143.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.754] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.755] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.755] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=44952) returned 1 [0143.755] CloseHandle (hObject=0x34c) returned 1 [0143.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0143.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0143.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.755] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.755] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.755] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=75096) returned 1 [0143.755] CloseHandle (hObject=0x34c) returned 1 [0143.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0143.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0143.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.756] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.756] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.756] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45472) returned 1 [0143.756] CloseHandle (hObject=0x34c) returned 1 [0143.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0143.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0143.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.756] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.757] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.757] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=77152) returned 1 [0143.757] CloseHandle (hObject=0x34c) returned 1 [0143.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0143.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0143.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.757] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.757] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.758] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4662) returned 1 [0143.758] CloseHandle (hObject=0x34c) returned 1 [0143.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0143.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0143.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.759] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.759] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.759] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=63840) returned 1 [0143.759] CloseHandle (hObject=0x34c) returned 1 [0143.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0143.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0143.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.759] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.760] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.760] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42400) returned 1 [0143.760] CloseHandle (hObject=0x34c) returned 1 [0143.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0143.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0143.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.760] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.760] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.760] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=63832) returned 1 [0143.761] CloseHandle (hObject=0x34c) returned 1 [0143.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0143.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0143.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.761] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.761] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.761] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42328) returned 1 [0143.761] CloseHandle (hObject=0x34c) returned 1 [0143.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0143.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0143.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.761] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.762] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.762] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=63840) returned 1 [0143.762] CloseHandle (hObject=0x34c) returned 1 [0143.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0143.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0143.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.762] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.762] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.763] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42392) returned 1 [0143.763] CloseHandle (hObject=0x34c) returned 1 [0143.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0143.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0143.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.763] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.763] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0143.765] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=395226) returned 1 [0143.765] CloseHandle (hObject=0x34c) returned 1 [0143.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0143.765] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0143.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0143.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootmgr.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.767] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.767] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0143.767] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.767] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0143.955] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0143.955] CloseHandle (hObject=0x35c) returned 1 [0143.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0143.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0143.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0x20 [0143.956] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0143.959] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0143.959] CloseHandle (hObject=0x35c) returned 1 [0143.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0143.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0143.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0x20 [0143.959] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0143.960] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0143.960] CloseHandle (hObject=0x35c) returned 1 [0143.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0143.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0143.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.960] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0143.960] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0143.960] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0143.960] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0143.963] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.177] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0144.180] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x132, lpOverlapped=0x0) returned 1 [0144.180] CloseHandle (hObject=0x35c) returned 1 [0144.180] CloseHandle (hObject=0x360) returned 1 [0144.182] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0144.184] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.184] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0144.184] CloseHandle (hObject=0x360) returned 1 [0144.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0144.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0144.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.184] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.184] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.184] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.185] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0144.185] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.189] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0144.191] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0144.191] CloseHandle (hObject=0x360) returned 1 [0144.191] CloseHandle (hObject=0x35c) returned 1 [0144.193] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0144.195] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.195] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0144.195] CloseHandle (hObject=0x35c) returned 1 [0144.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0144.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0144.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.196] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.196] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.196] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.196] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0144.196] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.200] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0144.202] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x132, lpOverlapped=0x0) returned 1 [0144.203] CloseHandle (hObject=0x35c) returned 1 [0144.203] CloseHandle (hObject=0x360) returned 1 [0144.205] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0144.206] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.206] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0144.206] CloseHandle (hObject=0x360) returned 1 [0144.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0144.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0144.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.207] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.207] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.207] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.207] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0144.208] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.419] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0144.421] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x182, lpOverlapped=0x0) returned 1 [0144.421] CloseHandle (hObject=0x360) returned 1 [0144.421] CloseHandle (hObject=0x35c) returned 1 [0144.423] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0144.425] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.425] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0144.425] CloseHandle (hObject=0x35c) returned 1 [0144.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0144.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0144.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.426] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.426] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.426] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.426] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0144.426] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.430] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0144.432] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x152, lpOverlapped=0x0) returned 1 [0144.432] CloseHandle (hObject=0x35c) returned 1 [0144.432] CloseHandle (hObject=0x360) returned 1 [0144.434] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0144.436] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.437] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0144.437] CloseHandle (hObject=0x360) returned 1 [0144.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0144.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0144.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.437] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.437] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.437] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.437] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0144.438] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.441] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0144.443] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x132, lpOverlapped=0x0) returned 1 [0144.443] CloseHandle (hObject=0x360) returned 1 [0144.443] CloseHandle (hObject=0x35c) returned 1 [0144.447] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0144.448] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.449] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1052672) returned 1 [0144.449] CloseHandle (hObject=0x35c) returned 1 [0144.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0144.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0144.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.449] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0144.449] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.449] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.449] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0144.449] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x101000, lpOverlapped=0x0) returned 1 [0144.665] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x101010, lpOverlapped=0x0) returned 1 [0144.871] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0144.871] CloseHandle (hObject=0x35c) returned 1 [0144.871] CloseHandle (hObject=0x360) returned 1 [0144.896] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0144.897] SetEvent (hEvent=0x2fc) returned 1 [0144.897] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.897] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69632) returned 1 [0144.897] CloseHandle (hObject=0x360) returned 1 [0144.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0144.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0144.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\setup.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.898] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0144.898] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.898] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0144.898] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\setup.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0144.899] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11000, lpOverlapped=0x0) returned 1 [0144.903] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0145.129] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0145.129] CloseHandle (hObject=0x360) returned 1 [0145.129] CloseHandle (hObject=0x35c) returned 1 [0145.131] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0145.133] SetEvent (hEvent=0x2fc) returned 1 [0145.133] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.134] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1118208) returned 1 [0145.134] CloseHandle (hObject=0x35c) returned 1 [0145.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0145.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0145.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\system.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.134] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0145.134] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0145.134] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0145.134] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\system.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0145.135] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x110100, lpOverlapped=0x0) returned 1 [0145.162] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x110100, lpOverlapped=0x0) returned 1 [0145.388] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf00, lpOverlapped=0x0) returned 1 [0145.389] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf10, lpOverlapped=0x0) returned 1 [0145.389] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0145.389] CloseHandle (hObject=0x35c) returned 1 [0145.389] CloseHandle (hObject=0x360) returned 1 [0145.414] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0145.415] SetEvent (hEvent=0x2fc) returned 1 [0145.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.809] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18624) returned 1 [0145.809] CloseHandle (hObject=0x378) returned 1 [0145.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0145.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0145.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.809] SetEvent (hEvent=0x2fc) returned 1 [0145.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.810] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=263896) returned 1 [0145.810] CloseHandle (hObject=0x378) returned 1 [0145.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0145.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0145.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.812] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=820416) returned 1 [0145.812] CloseHandle (hObject=0x374) returned 1 [0145.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0145.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0145.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.812] SetEvent (hEvent=0x2fc) returned 1 [0145.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.813] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1208928) returned 1 [0145.813] CloseHandle (hObject=0x374) returned 1 [0145.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0145.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0145.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.814] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4136) returned 1 [0145.814] CloseHandle (hObject=0x374) returned 1 [0145.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0145.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0145.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.815] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=902328) returned 1 [0145.815] CloseHandle (hObject=0x374) returned 1 [0145.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0145.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0145.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.815] SetEvent (hEvent=0x2fc) returned 1 [0145.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.816] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=332968) returned 1 [0145.816] CloseHandle (hObject=0x374) returned 1 [0145.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0145.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0145.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.817] SetEvent (hEvent=0x2fc) returned 1 [0145.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.817] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=102) returned 1 [0145.817] CloseHandle (hObject=0x374) returned 1 [0145.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0145.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0145.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.818] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=102) returned 1 [0145.818] CloseHandle (hObject=0x374) returned 1 [0145.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0145.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0145.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.818] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1093248) returned 1 [0145.819] CloseHandle (hObject=0x374) returned 1 [0145.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0145.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0145.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.821] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=358616) returned 1 [0145.821] CloseHandle (hObject=0x378) returned 1 [0145.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0145.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0145.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.824] SetEvent (hEvent=0x2fc) returned 1 [0145.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.824] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3144288) returned 1 [0145.824] CloseHandle (hObject=0x378) returned 1 [0145.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0145.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0 [0145.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.825] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4677216) returned 1 [0145.825] CloseHandle (hObject=0x378) returned 1 [0145.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0145.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0 [0145.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.825] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3177152) returned 1 [0145.825] CloseHandle (hObject=0x378) returned 1 [0145.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0145.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0 [0145.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.826] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9330784) returned 1 [0145.826] CloseHandle (hObject=0x378) returned 1 [0145.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0145.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0 [0145.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.827] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=61024) returned 1 [0145.827] CloseHandle (hObject=0x378) returned 1 [0145.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0145.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0145.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.827] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=660136) returned 1 [0145.827] CloseHandle (hObject=0x378) returned 1 [0145.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0145.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0145.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.828] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=635040) returned 1 [0145.828] CloseHandle (hObject=0x378) returned 1 [0145.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0145.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0145.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.829] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=963240) returned 1 [0145.829] CloseHandle (hObject=0x378) returned 1 [0145.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0145.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0145.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.833] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5967976) returned 1 [0145.833] CloseHandle (hObject=0x36c) returned 1 [0145.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0145.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0 [0145.833] SetEvent (hEvent=0x2fc) returned 1 [0145.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.833] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=996568) returned 1 [0145.833] CloseHandle (hObject=0x36c) returned 1 [0145.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0145.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0145.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.834] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2776664) returned 1 [0145.834] CloseHandle (hObject=0x36c) returned 1 [0145.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0145.834] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0 [0145.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0145.836] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4782) returned 1 [0145.836] CloseHandle (hObject=0x33c) returned 1 [0145.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0145.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0145.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.836] SetEvent (hEvent=0x2fc) returned 1 [0145.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0145.836] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4450) returned 1 [0145.836] CloseHandle (hObject=0x33c) returned 1 [0145.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0145.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0145.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0145.837] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1053784) returned 1 [0145.837] CloseHandle (hObject=0x33c) returned 1 [0145.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0145.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0145.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0145.838] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=982720) returned 1 [0145.838] CloseHandle (hObject=0x33c) returned 1 [0145.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0145.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0145.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.842] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=390320) returned 1 [0145.842] CloseHandle (hObject=0x36c) returned 1 [0145.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0145.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0145.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.842] SetEvent (hEvent=0x2fc) returned 1 [0145.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.842] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=88752) returned 1 [0145.843] CloseHandle (hObject=0x36c) returned 1 [0145.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0145.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0145.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.856] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=791421) returned 1 [0145.856] CloseHandle (hObject=0x36c) returned 1 [0145.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0145.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0145.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.859] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9728) returned 1 [0145.859] CloseHandle (hObject=0x36c) returned 1 [0145.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0145.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0145.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.859] SetEvent (hEvent=0x2fc) returned 1 [0145.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.861] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0145.861] CloseHandle (hObject=0x36c) returned 1 [0145.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0145.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0145.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.862] SetEvent (hEvent=0x2fc) returned 1 [0145.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.862] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10752) returned 1 [0145.862] CloseHandle (hObject=0x36c) returned 1 [0145.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0145.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0145.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.865] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9728) returned 1 [0145.865] CloseHandle (hObject=0x36c) returned 1 [0145.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0145.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0145.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.865] SetEvent (hEvent=0x2fc) returned 1 [0145.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.160] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=48936) returned 1 [0146.160] CloseHandle (hObject=0x374) returned 1 [0146.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0146.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0146.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.160] SetEvent (hEvent=0x2fc) returned 1 [0146.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.162] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=46622) returned 1 [0146.162] CloseHandle (hObject=0x374) returned 1 [0146.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0146.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0146.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.162] SetEvent (hEvent=0x2fc) returned 1 [0146.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.163] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=84190) returned 1 [0146.163] CloseHandle (hObject=0x374) returned 1 [0146.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0146.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0146.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.164] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=180172) returned 1 [0146.164] CloseHandle (hObject=0x374) returned 1 [0146.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0146.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0146.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.164] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=208408) returned 1 [0146.164] CloseHandle (hObject=0x374) returned 1 [0146.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0146.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0146.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.166] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8704) returned 1 [0146.166] CloseHandle (hObject=0x374) returned 1 [0146.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0146.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0146.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.166] SetEvent (hEvent=0x2fc) returned 1 [0146.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.167] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5120) returned 1 [0146.167] CloseHandle (hObject=0x374) returned 1 [0146.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0146.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0146.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.168] SetEvent (hEvent=0x2fc) returned 1 [0146.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.168] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3072) returned 1 [0146.168] CloseHandle (hObject=0x374) returned 1 [0146.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0146.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0146.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.170] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=23040) returned 1 [0146.170] CloseHandle (hObject=0x374) returned 1 [0146.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0146.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0146.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.170] SetEvent (hEvent=0x2fc) returned 1 [0146.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.171] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=199994) returned 1 [0146.171] CloseHandle (hObject=0x374) returned 1 [0146.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0146.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0146.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.172] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9216) returned 1 [0146.172] CloseHandle (hObject=0x374) returned 1 [0146.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0146.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0146.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.173] SetEvent (hEvent=0x2fc) returned 1 [0146.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.174] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10752) returned 1 [0146.174] CloseHandle (hObject=0x374) returned 1 [0146.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0146.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0146.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.175] SetEvent (hEvent=0x2fc) returned 1 [0146.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.176] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3072) returned 1 [0146.176] CloseHandle (hObject=0x374) returned 1 [0146.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0146.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0146.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.177] SetEvent (hEvent=0x2fc) returned 1 [0146.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.178] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3072) returned 1 [0146.178] CloseHandle (hObject=0x374) returned 1 [0146.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0146.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0146.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.187] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0146.187] CloseHandle (hObject=0x374) returned 1 [0146.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0146.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0146.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.187] SetEvent (hEvent=0x2fc) returned 1 [0146.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.189] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=25088) returned 1 [0146.189] CloseHandle (hObject=0x374) returned 1 [0146.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0146.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0146.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.197] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1600388) returned 1 [0146.197] CloseHandle (hObject=0x374) returned 1 [0146.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0146.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0146.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.200] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11264) returned 1 [0146.200] CloseHandle (hObject=0x374) returned 1 [0146.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0146.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0146.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.204] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1434) returned 1 [0146.204] CloseHandle (hObject=0x374) returned 1 [0146.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0146.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0146.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.205] SetEvent (hEvent=0x2fc) returned 1 [0146.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.207] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=903) returned 1 [0146.207] CloseHandle (hObject=0x374) returned 1 [0146.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0146.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0146.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.207] SetEvent (hEvent=0x2fc) returned 1 [0146.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.210] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=384) returned 1 [0146.210] CloseHandle (hObject=0x374) returned 1 [0146.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0146.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0146.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.210] SetEvent (hEvent=0x2fc) returned 1 [0146.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.214] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=392) returned 1 [0146.214] CloseHandle (hObject=0x374) returned 1 [0146.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0146.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0146.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.215] SetEvent (hEvent=0x2fc) returned 1 [0146.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.215] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3524) returned 1 [0146.215] CloseHandle (hObject=0x374) returned 1 [0146.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0146.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0146.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.216] SetEvent (hEvent=0x2fc) returned 1 [0146.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.216] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3529) returned 1 [0146.216] CloseHandle (hObject=0x374) returned 1 [0146.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0146.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0146.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.220] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=804) returned 1 [0146.220] CloseHandle (hObject=0x374) returned 1 [0146.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0146.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0146.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.221] SetEvent (hEvent=0x2fc) returned 1 [0146.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.226] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=617) returned 1 [0146.226] CloseHandle (hObject=0x378) returned 1 [0146.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0146.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0146.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.226] SetEvent (hEvent=0x2fc) returned 1 [0146.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.227] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16616) returned 1 [0146.227] CloseHandle (hObject=0x378) returned 1 [0146.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0146.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0146.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.227] SetEvent (hEvent=0x2fc) returned 1 [0146.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.230] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9803) returned 1 [0146.230] CloseHandle (hObject=0x378) returned 1 [0146.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0146.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0146.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.230] SetEvent (hEvent=0x2fc) returned 1 [0146.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.232] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10947) returned 1 [0146.232] CloseHandle (hObject=0x378) returned 1 [0146.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0146.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0146.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.233] SetEvent (hEvent=0x2fc) returned 1 [0146.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.235] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=221) returned 1 [0146.235] CloseHandle (hObject=0x378) returned 1 [0146.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0146.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0146.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.245] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=215) returned 1 [0146.245] CloseHandle (hObject=0x378) returned 1 [0146.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0146.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0146.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.245] SetEvent (hEvent=0x2fc) returned 1 [0146.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.247] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=591) returned 1 [0146.247] CloseHandle (hObject=0x378) returned 1 [0146.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0146.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0146.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.247] SetEvent (hEvent=0x2fc) returned 1 [0146.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.247] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9728) returned 1 [0146.248] CloseHandle (hObject=0x378) returned 1 [0146.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0146.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0146.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.248] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.248] CloseHandle (hObject=0x378) returned 1 [0146.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0146.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0146.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.249] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.249] CloseHandle (hObject=0x378) returned 1 [0146.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0146.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0146.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.251] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=46624) returned 1 [0146.251] CloseHandle (hObject=0x378) returned 1 [0146.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0146.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0146.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.254] SetEvent (hEvent=0x2fc) returned 1 [0146.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.254] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=498624) returned 1 [0146.254] CloseHandle (hObject=0x378) returned 1 [0146.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0146.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0146.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.255] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1100592) returned 1 [0146.255] CloseHandle (hObject=0x378) returned 1 [0146.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0146.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0146.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.257] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2515696) returned 1 [0146.257] CloseHandle (hObject=0x378) returned 1 [0146.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0146.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0146.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.259] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=361472) returned 1 [0146.259] CloseHandle (hObject=0x378) returned 1 [0146.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0146.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0146.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.260] SetEvent (hEvent=0x2fc) returned 1 [0146.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.261] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2018304) returned 1 [0146.261] CloseHandle (hObject=0x378) returned 1 [0146.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0146.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0146.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.265] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2592) returned 1 [0146.265] CloseHandle (hObject=0x378) returned 1 [0146.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0146.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0146.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.265] SetEvent (hEvent=0x2fc) returned 1 [0146.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.266] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2462) returned 1 [0146.266] CloseHandle (hObject=0x378) returned 1 [0146.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0146.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0146.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.266] SetEvent (hEvent=0x2fc) returned 1 [0146.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.267] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2436) returned 1 [0146.267] CloseHandle (hObject=0x378) returned 1 [0146.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0146.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0146.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.268] SetEvent (hEvent=0x2fc) returned 1 [0146.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.270] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2514) returned 1 [0146.270] CloseHandle (hObject=0x378) returned 1 [0146.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0146.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0146.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.271] SetEvent (hEvent=0x2fc) returned 1 [0146.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.274] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2616) returned 1 [0146.274] CloseHandle (hObject=0x358) returned 1 [0146.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0146.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0146.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.275] SetEvent (hEvent=0x2fc) returned 1 [0146.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.276] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2618) returned 1 [0146.276] CloseHandle (hObject=0x358) returned 1 [0146.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0146.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0146.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.279] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2658) returned 1 [0146.279] CloseHandle (hObject=0x358) returned 1 [0146.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0146.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0146.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.283] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2518) returned 1 [0146.283] CloseHandle (hObject=0x358) returned 1 [0146.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0146.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0146.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.284] SetEvent (hEvent=0x2fc) returned 1 [0146.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.284] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2652) returned 1 [0146.284] CloseHandle (hObject=0x358) returned 1 [0146.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0146.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0146.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.285] SetEvent (hEvent=0x2fc) returned 1 [0146.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.285] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2570) returned 1 [0146.285] CloseHandle (hObject=0x358) returned 1 [0146.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0146.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0146.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.286] SetEvent (hEvent=0x2fc) returned 1 [0146.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.287] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2522) returned 1 [0146.287] CloseHandle (hObject=0x358) returned 1 [0146.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0146.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0146.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.290] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2626) returned 1 [0146.290] CloseHandle (hObject=0x358) returned 1 [0146.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0146.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0146.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.294] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2600) returned 1 [0146.294] CloseHandle (hObject=0x358) returned 1 [0146.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0146.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0146.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.295] SetEvent (hEvent=0x2fc) returned 1 [0146.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.295] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=125952) returned 1 [0146.295] CloseHandle (hObject=0x358) returned 1 [0146.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0146.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0146.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.296] SetEvent (hEvent=0x2fc) returned 1 [0146.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.297] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2246) returned 1 [0146.297] CloseHandle (hObject=0x358) returned 1 [0146.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0146.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0146.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.297] SetEvent (hEvent=0x2fc) returned 1 [0146.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.298] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2644) returned 1 [0146.298] CloseHandle (hObject=0x358) returned 1 [0146.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0146.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0146.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.299] SetEvent (hEvent=0x2fc) returned 1 [0146.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.300] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2542) returned 1 [0146.300] CloseHandle (hObject=0x358) returned 1 [0146.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0146.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0146.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.300] SetEvent (hEvent=0x2fc) returned 1 [0146.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.301] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2568) returned 1 [0146.301] CloseHandle (hObject=0x358) returned 1 [0146.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0146.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0146.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.301] SetEvent (hEvent=0x2fc) returned 1 [0146.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.303] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2520) returned 1 [0146.303] CloseHandle (hObject=0x358) returned 1 [0146.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0146.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0146.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.303] SetEvent (hEvent=0x2fc) returned 1 [0146.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.304] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2720) returned 1 [0146.304] CloseHandle (hObject=0x358) returned 1 [0146.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0146.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0146.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.304] SetEvent (hEvent=0x2fc) returned 1 [0146.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.308] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10752) returned 1 [0146.308] CloseHandle (hObject=0x358) returned 1 [0146.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0146.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0146.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.533] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.533] CloseHandle (hObject=0x35c) returned 1 [0146.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0146.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0146.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.533] SetEvent (hEvent=0x2fc) returned 1 [0146.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.534] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10752) returned 1 [0146.534] CloseHandle (hObject=0x35c) returned 1 [0146.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0146.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0146.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.535] SetEvent (hEvent=0x2fc) returned 1 [0146.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.536] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10752) returned 1 [0146.536] CloseHandle (hObject=0x35c) returned 1 [0146.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0146.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0146.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.537] SetEvent (hEvent=0x2fc) returned 1 [0146.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.538] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=177664) returned 1 [0146.538] CloseHandle (hObject=0x35c) returned 1 [0146.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0146.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0146.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.539] SetEvent (hEvent=0x2fc) returned 1 [0146.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.539] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.539] CloseHandle (hObject=0x35c) returned 1 [0146.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0146.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0146.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.541] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=733696) returned 1 [0146.541] CloseHandle (hObject=0x35c) returned 1 [0146.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0146.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0146.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.542] SetEvent (hEvent=0x2fc) returned 1 [0146.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.543] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10752) returned 1 [0146.543] CloseHandle (hObject=0x35c) returned 1 [0146.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0146.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0146.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.543] SetEvent (hEvent=0x2fc) returned 1 [0146.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.544] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.544] CloseHandle (hObject=0x35c) returned 1 [0146.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0146.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0146.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.545] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9728) returned 1 [0146.545] CloseHandle (hObject=0x35c) returned 1 [0146.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0146.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0146.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.546] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.546] CloseHandle (hObject=0x35c) returned 1 [0146.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0146.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0146.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.548] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=41984) returned 1 [0146.548] CloseHandle (hObject=0x35c) returned 1 [0146.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0146.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0146.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.549] SetEvent (hEvent=0x2fc) returned 1 [0146.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.549] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4101632) returned 1 [0146.549] CloseHandle (hObject=0x35c) returned 1 [0146.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0146.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.549] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0146.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.550] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=391040) returned 1 [0146.550] CloseHandle (hObject=0x35c) returned 1 [0146.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0146.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0146.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.551] SetEvent (hEvent=0x2fc) returned 1 [0146.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.551] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9728) returned 1 [0146.551] CloseHandle (hObject=0x35c) returned 1 [0146.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0146.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0146.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.553] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1086464) returned 1 [0146.553] CloseHandle (hObject=0x35c) returned 1 [0146.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0146.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0146.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.554] SetEvent (hEvent=0x2fc) returned 1 [0146.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.555] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=22016) returned 1 [0146.555] CloseHandle (hObject=0x35c) returned 1 [0146.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0146.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0146.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.556] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1053184) returned 1 [0146.556] CloseHandle (hObject=0x35c) returned 1 [0146.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0146.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0146.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.556] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=647584) returned 1 [0146.556] CloseHandle (hObject=0x35c) returned 1 [0146.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0146.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0146.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.558] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=96768) returned 1 [0146.558] CloseHandle (hObject=0x35c) returned 1 [0146.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0146.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0146.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.558] SetEvent (hEvent=0x2fc) returned 1 [0146.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.559] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.559] CloseHandle (hObject=0x35c) returned 1 [0146.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0146.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0146.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.559] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.560] CloseHandle (hObject=0x35c) returned 1 [0146.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0146.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0146.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.560] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7168) returned 1 [0146.560] CloseHandle (hObject=0x35c) returned 1 [0146.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0146.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0146.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.561] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7168) returned 1 [0146.561] CloseHandle (hObject=0x35c) returned 1 [0146.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0146.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0146.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.563] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30720) returned 1 [0146.563] CloseHandle (hObject=0x35c) returned 1 [0146.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0146.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0146.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.564] SetEvent (hEvent=0x2fc) returned 1 [0146.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.564] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=363728) returned 1 [0146.564] CloseHandle (hObject=0x35c) returned 1 [0146.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0146.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0146.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.565] SetEvent (hEvent=0x2fc) returned 1 [0146.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.566] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1475160) returned 1 [0146.566] CloseHandle (hObject=0x35c) returned 1 [0146.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0146.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0146.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.567] SetEvent (hEvent=0x2fc) returned 1 [0146.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.568] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=590523) returned 1 [0146.568] CloseHandle (hObject=0x35c) returned 1 [0146.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0146.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0146.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.568] SetEvent (hEvent=0x2fc) returned 1 [0146.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.882] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18624) returned 1 [0146.882] CloseHandle (hObject=0x35c) returned 1 [0146.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0146.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0146.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.883] SetEvent (hEvent=0x2fc) returned 1 [0146.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.897] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=987136) returned 1 [0146.897] CloseHandle (hObject=0x35c) returned 1 [0146.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0146.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0146.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.898] SetEvent (hEvent=0x2fc) returned 1 [0146.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.902] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14856) returned 1 [0146.903] CloseHandle (hObject=0x35c) returned 1 [0146.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0146.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0146.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.904] SetEvent (hEvent=0x2fc) returned 1 [0146.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.906] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0146.906] CloseHandle (hObject=0x35c) returned 1 [0146.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0146.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0146.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.909] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=50688) returned 1 [0146.909] CloseHandle (hObject=0x35c) returned 1 [0146.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0146.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0146.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.913] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=70656) returned 1 [0146.913] CloseHandle (hObject=0x35c) returned 1 [0146.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0146.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0146.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.913] SetEvent (hEvent=0x2fc) returned 1 [0146.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.915] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=71168) returned 1 [0146.915] CloseHandle (hObject=0x35c) returned 1 [0146.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0146.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0146.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.919] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=364032) returned 1 [0146.919] CloseHandle (hObject=0x35c) returned 1 [0146.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0146.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0146.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.920] SetEvent (hEvent=0x2fc) returned 1 [0146.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.921] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=45568) returned 1 [0146.921] CloseHandle (hObject=0x35c) returned 1 [0146.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0146.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0146.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.927] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=91136) returned 1 [0146.927] CloseHandle (hObject=0x35c) returned 1 [0146.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0146.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0146.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.931] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=630) returned 1 [0146.931] CloseHandle (hObject=0x35c) returned 1 [0146.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0146.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0146.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.931] SetEvent (hEvent=0x2fc) returned 1 [0146.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.934] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10240) returned 1 [0146.934] CloseHandle (hObject=0x35c) returned 1 [0146.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0146.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0146.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.937] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7680) returned 1 [0146.937] CloseHandle (hObject=0x35c) returned 1 [0146.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0146.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0146.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.938] SetEvent (hEvent=0x2fc) returned 1 [0146.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.938] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6144) returned 1 [0146.938] CloseHandle (hObject=0x35c) returned 1 [0146.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0146.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0146.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.939] SetEvent (hEvent=0x2fc) returned 1 [0146.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.941] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=695296) returned 1 [0146.941] CloseHandle (hObject=0x35c) returned 1 [0146.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0146.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0146.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.289] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=279552) returned 1 [0147.289] CloseHandle (hObject=0x368) returned 1 [0147.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0147.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0147.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.292] SetEvent (hEvent=0x2fc) returned 1 [0147.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.292] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0147.292] CloseHandle (hObject=0x368) returned 1 [0147.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0147.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0147.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.296] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0147.296] CloseHandle (hObject=0x368) returned 1 [0147.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0147.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0147.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.297] SetEvent (hEvent=0x2fc) returned 1 [0147.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.298] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=221696) returned 1 [0147.298] CloseHandle (hObject=0x368) returned 1 [0147.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0147.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0147.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.299] SetEvent (hEvent=0x2fc) returned 1 [0147.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.299] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0147.299] CloseHandle (hObject=0x368) returned 1 [0147.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0147.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0147.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.300] SetEvent (hEvent=0x2fc) returned 1 [0147.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.302] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31744) returned 1 [0147.302] CloseHandle (hObject=0x368) returned 1 [0147.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0147.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0147.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.302] SetEvent (hEvent=0x2fc) returned 1 [0147.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.342] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=48128) returned 1 [0147.342] CloseHandle (hObject=0x370) returned 1 [0147.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0147.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0147.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.343] SetEvent (hEvent=0x2fc) returned 1 [0147.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.346] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=44032) returned 1 [0147.346] CloseHandle (hObject=0x370) returned 1 [0147.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0147.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0147.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.346] SetEvent (hEvent=0x2fc) returned 1 [0147.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.347] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=99840) returned 1 [0147.347] CloseHandle (hObject=0x370) returned 1 [0147.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0147.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0147.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.347] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=376320) returned 1 [0147.347] CloseHandle (hObject=0x370) returned 1 [0147.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0147.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0147.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.349] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=698368) returned 1 [0147.349] CloseHandle (hObject=0x370) returned 1 [0147.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0147.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0147.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.350] SetEvent (hEvent=0x2fc) returned 1 [0147.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.350] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=117248) returned 1 [0147.350] CloseHandle (hObject=0x370) returned 1 [0147.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0147.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0147.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.382] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=942080) returned 1 [0147.382] CloseHandle (hObject=0x368) returned 1 [0147.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0147.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0147.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.405] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9975) returned 1 [0147.405] CloseHandle (hObject=0x368) returned 1 [0147.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0147.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0147.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.408] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=326144) returned 1 [0147.408] CloseHandle (hObject=0x368) returned 1 [0147.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0147.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0147.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.409] SetEvent (hEvent=0x2fc) returned 1 [0147.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.410] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0147.410] CloseHandle (hObject=0x368) returned 1 [0147.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0147.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0147.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.411] SetEvent (hEvent=0x2fc) returned 1 [0147.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.421] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=964096) returned 1 [0147.421] CloseHandle (hObject=0x35c) returned 1 [0147.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0147.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0147.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.422] SetEvent (hEvent=0x2fc) returned 1 [0147.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.425] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2560) returned 1 [0147.425] CloseHandle (hObject=0x370) returned 1 [0147.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0147.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0147.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.426] SetEvent (hEvent=0x2fc) returned 1 [0147.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.430] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5632) returned 1 [0147.430] CloseHandle (hObject=0x370) returned 1 [0147.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0147.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0147.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.431] SetEvent (hEvent=0x2fc) returned 1 [0147.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.435] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=80384) returned 1 [0147.436] CloseHandle (hObject=0x370) returned 1 [0147.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe")) returned 0x20 [0147.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe")) returned 0x20 [0147.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.440] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=501760) returned 1 [0147.440] CloseHandle (hObject=0x35c) returned 1 [0147.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0147.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0147.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.446] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=407552) returned 1 [0147.446] CloseHandle (hObject=0x35c) returned 1 [0147.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0147.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0147.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.447] SetEvent (hEvent=0x2fc) returned 1 [0147.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.449] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=824128) returned 1 [0147.449] CloseHandle (hObject=0x370) returned 1 [0147.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0147.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0147.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.450] SetEvent (hEvent=0x2fc) returned 1 [0147.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.451] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=452) returned 1 [0147.451] CloseHandle (hObject=0x370) returned 1 [0147.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0147.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0147.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.451] SetEvent (hEvent=0x2fc) returned 1 [0147.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.457] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=49688) returned 1 [0147.457] CloseHandle (hObject=0x370) returned 1 [0147.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0147.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0147.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.465] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1516608) returned 1 [0147.466] CloseHandle (hObject=0x370) returned 1 [0147.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0147.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0147.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.762] SetEvent (hEvent=0x2fc) returned 1 [0147.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.764] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=186944) returned 1 [0147.764] CloseHandle (hObject=0x360) returned 1 [0147.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0147.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0147.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.765] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=265792) returned 1 [0147.765] CloseHandle (hObject=0x360) returned 1 [0147.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0147.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0147.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.766] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=455744) returned 1 [0147.766] CloseHandle (hObject=0x360) returned 1 [0147.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0147.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0147.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.768] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=619584) returned 1 [0147.768] CloseHandle (hObject=0x360) returned 1 [0147.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0147.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0147.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.768] SetEvent (hEvent=0x2fc) returned 1 [0147.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.769] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=158272) returned 1 [0147.769] CloseHandle (hObject=0x360) returned 1 [0147.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0147.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0147.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.770] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=123456) returned 1 [0147.770] CloseHandle (hObject=0x360) returned 1 [0147.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0147.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0147.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.771] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19008) returned 1 [0147.771] CloseHandle (hObject=0x360) returned 1 [0147.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0147.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0147.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.772] SetEvent (hEvent=0x2fc) returned 1 [0147.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.772] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=63552) returned 1 [0147.772] CloseHandle (hObject=0x360) returned 1 [0147.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0147.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0147.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.773] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21056) returned 1 [0147.773] CloseHandle (hObject=0x360) returned 1 [0147.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0147.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0147.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.774] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=34368) returned 1 [0147.774] CloseHandle (hObject=0x360) returned 1 [0147.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0147.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0147.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.184] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15936) returned 1 [0148.184] CloseHandle (hObject=0x35c) returned 1 [0148.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0148.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0148.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.185] SetEvent (hEvent=0x2fc) returned 1 [0148.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.185] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.185] CloseHandle (hObject=0x35c) returned 1 [0148.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0148.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0148.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.187] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.187] CloseHandle (hObject=0x35c) returned 1 [0148.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0148.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0148.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.188] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.188] CloseHandle (hObject=0x35c) returned 1 [0148.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0148.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0148.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.189] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=233536) returned 1 [0148.189] CloseHandle (hObject=0x35c) returned 1 [0148.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0148.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0148.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.190] SetEvent (hEvent=0x2fc) returned 1 [0148.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.190] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=36928) returned 1 [0148.190] CloseHandle (hObject=0x35c) returned 1 [0148.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0148.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0148.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.192] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=653888) returned 1 [0148.192] CloseHandle (hObject=0x35c) returned 1 [0148.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0148.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0148.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.192] SetEvent (hEvent=0x2fc) returned 1 [0148.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.193] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=660128) returned 1 [0148.193] CloseHandle (hObject=0x35c) returned 1 [0148.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0148.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0148.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.194] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=829264) returned 1 [0148.194] CloseHandle (hObject=0x35c) returned 1 [0148.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0148.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0148.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.195] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=963232) returned 1 [0148.195] CloseHandle (hObject=0x35c) returned 1 [0148.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0148.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0148.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.197] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=96832) returned 1 [0148.197] CloseHandle (hObject=0x35c) returned 1 [0148.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0148.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0148.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.201] SetEvent (hEvent=0x2fc) returned 1 [0148.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.202] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=60480) returned 1 [0148.202] CloseHandle (hObject=0x35c) returned 1 [0148.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0148.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0148.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.203] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19008) returned 1 [0148.203] CloseHandle (hObject=0x35c) returned 1 [0148.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0148.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0148.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.204] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.204] CloseHandle (hObject=0x35c) returned 1 [0148.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0148.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0148.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.205] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.205] CloseHandle (hObject=0x35c) returned 1 [0148.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0148.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0148.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.206] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=829264) returned 1 [0148.206] CloseHandle (hObject=0x35c) returned 1 [0148.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0148.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0148.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.207] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=234560) returned 1 [0148.207] CloseHandle (hObject=0x35c) returned 1 [0148.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0148.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0148.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.208] SetEvent (hEvent=0x2fc) returned 1 [0148.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.208] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.209] CloseHandle (hObject=0x35c) returned 1 [0148.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0148.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0148.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.209] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=57408) returned 1 [0148.209] CloseHandle (hObject=0x35c) returned 1 [0148.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0148.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0148.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.211] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=130624) returned 1 [0148.211] CloseHandle (hObject=0x35c) returned 1 [0148.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0148.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0148.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.211] SetEvent (hEvent=0x2fc) returned 1 [0148.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.212] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=97856) returned 1 [0148.212] CloseHandle (hObject=0x35c) returned 1 [0148.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0148.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0148.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.213] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15424) returned 1 [0148.213] CloseHandle (hObject=0x35c) returned 1 [0148.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0148.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0148.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.215] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15936) returned 1 [0148.215] CloseHandle (hObject=0x35c) returned 1 [0148.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0148.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0148.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.216] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16448) returned 1 [0148.216] CloseHandle (hObject=0x35c) returned 1 [0148.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0148.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0148.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.217] SetEvent (hEvent=0x2fc) returned 1 [0148.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.217] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18677760) returned 1 [0148.217] CloseHandle (hObject=0x35c) returned 1 [0148.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0148.218] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0155.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0155.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.763] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc28 | out: lpNewFilePointer=0x0) returned 1 [0155.763] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc28 | out: lpNewFilePointer=0x0) returned 1 [0155.763] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc34, lpOverlapped=0x0 | out: lpBuffer=0x3ce5058*, lpNumberOfBytesRead=0x385fc34*=0x40000, lpOverlapped=0x0) returned 1 [0155.764] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc28 | out: lpNewFilePointer=0x0) returned 1 [0155.764] ReadFile (in: hFile=0x35c, lpBuffer=0x3d25058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc34, lpOverlapped=0x0 | out: lpBuffer=0x3d25058*, lpNumberOfBytesRead=0x385fc34*=0x40000, lpOverlapped=0x0) returned 1 [0155.769] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc28 | out: lpNewFilePointer=0x0) returned 1 [0155.769] ReadFile (in: hFile=0x35c, lpBuffer=0x3d65058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc34, lpOverlapped=0x0 | out: lpBuffer=0x3d65058*, lpNumberOfBytesRead=0x385fc34*=0x40000, lpOverlapped=0x0) returned 1 [0155.778] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fd98 | out: lpNewFilePointer=0x0) returned 1 [0155.778] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc0102, lpOverlapped=0x0) returned 1 [0156.348] SetEndOfFile (hFile=0x35c) returned 1 [0156.348] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc30 | out: lpNewFilePointer=0x0) returned 1 [0156.348] WriteFile (in: hFile=0x35c, lpBuffer=0x3da513a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3da513a*, lpNumberOfBytesWritten=0x385fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0156.351] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc30 | out: lpNewFilePointer=0x0) returned 1 [0156.351] WriteFile (in: hFile=0x35c, lpBuffer=0x3da513a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3da513a*, lpNumberOfBytesWritten=0x385fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0156.353] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc30 | out: lpNewFilePointer=0x0) returned 1 [0156.353] WriteFile (in: hFile=0x35c, lpBuffer=0x3da513a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3da513a*, lpNumberOfBytesWritten=0x385fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0156.354] CloseHandle (hObject=0x35c) returned 1 [0157.297] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-2869].[robinhood@countermail.com].eject", dwFileAttributes=0x21) returned 1 [0157.297] SetEvent (hEvent=0x2fc) returned 1 [0157.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.298] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=40) returned 1 [0157.298] CloseHandle (hObject=0x35c) returned 1 [0157.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0157.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0157.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.299] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.299] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0157.301] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x28, lpOverlapped=0x0) returned 1 [0157.302] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x30, lpOverlapped=0x0) returned 1 [0157.303] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe2, lpOverlapped=0x0) returned 1 [0157.303] CloseHandle (hObject=0x35c) returned 1 [0157.303] CloseHandle (hObject=0x37c) returned 1 [0157.303] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0 [0157.303] SetEvent (hEvent=0x2fc) returned 1 [0157.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.304] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=46) returned 1 [0157.304] CloseHandle (hObject=0x37c) returned 1 [0157.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0157.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0157.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.305] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.305] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0157.306] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2e, lpOverlapped=0x0) returned 1 [0157.306] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x30, lpOverlapped=0x0) returned 1 [0157.307] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0157.307] CloseHandle (hObject=0x37c) returned 1 [0157.308] CloseHandle (hObject=0x35c) returned 1 [0157.308] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0 [0157.308] SetEvent (hEvent=0x2fc) returned 1 [0157.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.308] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=528) returned 1 [0157.309] CloseHandle (hObject=0x35c) returned 1 [0157.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0157.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0157.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.317] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.317] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0157.318] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x210, lpOverlapped=0x0) returned 1 [0157.319] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x220, lpOverlapped=0x0) returned 1 [0157.320] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe2, lpOverlapped=0x0) returned 1 [0157.320] CloseHandle (hObject=0x35c) returned 1 [0157.320] CloseHandle (hObject=0x37c) returned 1 [0157.320] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0 [0157.321] SetEvent (hEvent=0x2fc) returned 1 [0157.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.321] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=63933) returned 1 [0157.321] CloseHandle (hObject=0x37c) returned 1 [0157.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0157.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0157.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.322] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.322] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0157.322] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf9bd, lpOverlapped=0x0) returned 1 [0157.326] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf9c0, lpOverlapped=0x0) returned 1 [0157.327] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x122, lpOverlapped=0x0) returned 1 [0157.328] CloseHandle (hObject=0x37c) returned 1 [0157.328] CloseHandle (hObject=0x35c) returned 1 [0157.328] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0 [0157.328] SetEvent (hEvent=0x2fc) returned 1 [0157.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.329] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=145180) returned 1 [0157.329] CloseHandle (hObject=0x35c) returned 1 [0157.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0157.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0157.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.329] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.329] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0157.330] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2371c, lpOverlapped=0x0) returned 1 [0157.335] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x23720, lpOverlapped=0x0) returned 1 [0157.338] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x112, lpOverlapped=0x0) returned 1 [0157.338] CloseHandle (hObject=0x35c) returned 1 [0157.338] CloseHandle (hObject=0x37c) returned 1 [0157.339] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0 [0157.339] SetEvent (hEvent=0x2fc) returned 1 [0157.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.339] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=955) returned 1 [0157.339] CloseHandle (hObject=0x37c) returned 1 [0157.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0157.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0157.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.340] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.340] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x35c [0157.651] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3bb, lpOverlapped=0x0) returned 1 [0157.662] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3c0, lpOverlapped=0x0) returned 1 [0157.663] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0157.663] CloseHandle (hObject=0x37c) returned 1 [0157.663] CloseHandle (hObject=0x35c) returned 1 [0157.664] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0 [0157.664] SetEvent (hEvent=0x2fc) returned 1 [0157.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.667] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=387356) returned 1 [0157.667] CloseHandle (hObject=0x35c) returned 1 [0157.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.668] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.668] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0157.671] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5e91c, lpOverlapped=0x0) returned 1 [0157.683] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5e920, lpOverlapped=0x0) returned 1 [0157.690] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0157.690] CloseHandle (hObject=0x35c) returned 1 [0157.691] CloseHandle (hObject=0x37c) returned 1 [0157.691] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0 [0157.691] SetEvent (hEvent=0x2fc) returned 1 [0157.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.692] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1533) returned 1 [0157.692] CloseHandle (hObject=0x37c) returned 1 [0157.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0157.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0157.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.692] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.693] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x35c [0157.695] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5fd, lpOverlapped=0x0) returned 1 [0157.943] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x600, lpOverlapped=0x0) returned 1 [0157.944] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0157.944] CloseHandle (hObject=0x37c) returned 1 [0157.944] CloseHandle (hObject=0x35c) returned 1 [0157.945] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0 [0157.945] SetEvent (hEvent=0x2fc) returned 1 [0157.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.946] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=496513) returned 1 [0157.946] CloseHandle (hObject=0x35c) returned 1 [0157.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0157.949] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0157.950] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x79381, lpOverlapped=0x0) returned 1 [0158.145] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x79390, lpOverlapped=0x0) returned 1 [0158.155] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0158.155] CloseHandle (hObject=0x35c) returned 1 [0158.155] CloseHandle (hObject=0x37c) returned 1 [0158.156] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0 [0158.156] SetEvent (hEvent=0x2fc) returned 1 [0158.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.157] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1124942) returned 1 [0158.157] CloseHandle (hObject=0x37c) returned 1 [0158.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0158.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0158.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0158.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0158.158] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0158.158] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0158.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x35c [0158.158] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x110100, lpOverlapped=0x0) returned 1 [0158.438] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x110100, lpOverlapped=0x0) returned 1 [0159.793] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x294e, lpOverlapped=0x0) returned 1 [0159.793] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2950, lpOverlapped=0x0) returned 1 [0159.793] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0159.793] CloseHandle (hObject=0x37c) returned 1 [0159.794] CloseHandle (hObject=0x35c) returned 1 [0159.794] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0 [0159.795] SetEvent (hEvent=0x2fc) returned 1 [0159.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0159.795] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1261) returned 1 [0159.795] CloseHandle (hObject=0x35c) returned 1 [0159.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0159.796] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0159.796] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0159.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0159.797] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4ed, lpOverlapped=0x0) returned 1 [0159.798] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f0, lpOverlapped=0x0) returned 1 [0159.804] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0159.804] CloseHandle (hObject=0x35c) returned 1 [0159.804] CloseHandle (hObject=0x37c) returned 1 [0159.804] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0 [0159.804] SetEvent (hEvent=0x2fc) returned 1 [0159.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.805] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1261) returned 1 [0159.805] CloseHandle (hObject=0x37c) returned 1 [0159.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0159.806] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0159.806] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0159.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x35c [0159.806] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4ed, lpOverlapped=0x0) returned 1 [0159.808] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f0, lpOverlapped=0x0) returned 1 [0159.809] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0159.809] CloseHandle (hObject=0x37c) returned 1 [0159.810] CloseHandle (hObject=0x35c) returned 1 [0159.810] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0 [0159.810] SetEvent (hEvent=0x2fc) returned 1 [0159.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0159.811] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2147) returned 1 [0159.811] CloseHandle (hObject=0x35c) returned 1 [0159.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0159.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0159.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0159.812] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0159.812] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0159.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0159.812] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x863, lpOverlapped=0x0) returned 1 [0159.814] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x870, lpOverlapped=0x0) returned 1 [0159.815] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0159.815] CloseHandle (hObject=0x35c) returned 1 [0160.061] CloseHandle (hObject=0x37c) returned 1 [0160.061] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0 [0160.062] SetEvent (hEvent=0x2fc) returned 1 [0160.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.062] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14913) returned 1 [0160.062] CloseHandle (hObject=0x37c) returned 1 [0160.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.063] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.063] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0160.064] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3a41, lpOverlapped=0x0) returned 1 [0160.066] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3a50, lpOverlapped=0x0) returned 1 [0160.067] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0160.067] CloseHandle (hObject=0x37c) returned 1 [0160.067] CloseHandle (hObject=0x344) returned 1 [0160.067] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0 [0160.068] SetEvent (hEvent=0x2fc) returned 1 [0160.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0160.068] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=357349) returned 1 [0160.068] CloseHandle (hObject=0x344) returned 1 [0160.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0160.069] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.069] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0160.070] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x573e5, lpOverlapped=0x0) returned 1 [0160.082] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x573f0, lpOverlapped=0x0) returned 1 [0160.089] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0160.089] CloseHandle (hObject=0x344) returned 1 [0160.089] CloseHandle (hObject=0x37c) returned 1 [0160.089] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0 [0160.089] SetEvent (hEvent=0x2fc) returned 1 [0160.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.359] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1261) returned 1 [0160.359] CloseHandle (hObject=0x370) returned 1 [0160.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.545] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.545] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0160.546] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4ed, lpOverlapped=0x0) returned 1 [0160.577] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f0, lpOverlapped=0x0) returned 1 [0160.578] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0160.578] CloseHandle (hObject=0x370) returned 1 [0160.578] CloseHandle (hObject=0x380) returned 1 [0160.578] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0 [0160.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0160.579] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=399528) returned 1 [0160.579] CloseHandle (hObject=0x380) returned 1 [0160.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0160.580] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.580] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0160.580] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x618a8, lpOverlapped=0x0) returned 1 [0160.597] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x618b0, lpOverlapped=0x0) returned 1 [0160.604] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0160.604] CloseHandle (hObject=0x380) returned 1 [0160.605] CloseHandle (hObject=0x370) returned 1 [0160.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0 [0160.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.606] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1450) returned 1 [0160.606] CloseHandle (hObject=0x370) returned 1 [0160.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.607] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.607] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0160.618] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5aa, lpOverlapped=0x0) returned 1 [0160.622] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5b0, lpOverlapped=0x0) returned 1 [0160.623] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0160.623] CloseHandle (hObject=0x370) returned 1 [0160.624] CloseHandle (hObject=0x38c) returned 1 [0160.624] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0 [0160.624] SetEvent (hEvent=0x2fc) returned 1 [0160.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0160.625] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3754) returned 1 [0160.625] CloseHandle (hObject=0x38c) returned 1 [0160.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0160.626] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.626] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0160.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0160.626] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xeaa, lpOverlapped=0x0) returned 1 [0160.787] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xeb0, lpOverlapped=0x0) returned 1 [0160.835] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0160.835] CloseHandle (hObject=0x38c) returned 1 [0160.835] CloseHandle (hObject=0x370) returned 1 [0160.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0 [0160.837] SetEvent (hEvent=0x2fc) returned 1 [0160.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.120] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1261) returned 1 [0161.120] CloseHandle (hObject=0x38c) returned 1 [0161.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0161.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0161.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.121] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0161.121] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4ed, lpOverlapped=0x0) returned 1 [0161.123] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f0, lpOverlapped=0x0) returned 1 [0161.124] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0161.124] CloseHandle (hObject=0x38c) returned 1 [0161.125] CloseHandle (hObject=0x390) returned 1 [0161.125] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0 [0161.125] SetEvent (hEvent=0x2fc) returned 1 [0161.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.126] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1261) returned 1 [0161.126] CloseHandle (hObject=0x390) returned 1 [0161.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0161.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0161.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.127] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.127] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0161.127] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4ed, lpOverlapped=0x0) returned 1 [0161.129] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f0, lpOverlapped=0x0) returned 1 [0161.130] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0161.130] CloseHandle (hObject=0x390) returned 1 [0161.130] CloseHandle (hObject=0x38c) returned 1 [0161.131] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0 [0161.131] SetEvent (hEvent=0x2fc) returned 1 [0161.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.131] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3375) returned 1 [0161.131] CloseHandle (hObject=0x38c) returned 1 [0161.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0161.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0161.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.132] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0161.134] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd2f, lpOverlapped=0x0) returned 1 [0161.135] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xd30, lpOverlapped=0x0) returned 1 [0161.136] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x142, lpOverlapped=0x0) returned 1 [0161.136] CloseHandle (hObject=0x38c) returned 1 [0161.137] CloseHandle (hObject=0x390) returned 1 [0161.137] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0 [0161.137] SetEvent (hEvent=0x2fc) returned 1 [0161.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.138] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2173046) returned 1 [0161.138] CloseHandle (hObject=0x390) returned 1 [0161.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0161.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0161.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0 [0161.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.139] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9831) returned 1 [0161.139] CloseHandle (hObject=0x390) returned 1 [0161.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0161.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0161.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.140] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.140] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0161.141] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2667, lpOverlapped=0x0) returned 1 [0161.143] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2670, lpOverlapped=0x0) returned 1 [0161.145] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x112, lpOverlapped=0x0) returned 1 [0161.146] CloseHandle (hObject=0x390) returned 1 [0161.146] CloseHandle (hObject=0x38c) returned 1 [0161.146] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0 [0161.146] SetEvent (hEvent=0x2fc) returned 1 [0161.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.147] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=373) returned 1 [0161.147] CloseHandle (hObject=0x38c) returned 1 [0161.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0161.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0161.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.148] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0161.148] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x175, lpOverlapped=0x0) returned 1 [0161.149] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x180, lpOverlapped=0x0) returned 1 [0161.150] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x102, lpOverlapped=0x0) returned 1 [0161.152] CloseHandle (hObject=0x38c) returned 1 [0161.152] CloseHandle (hObject=0x390) returned 1 [0161.152] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0 [0161.152] SetEvent (hEvent=0x2fc) returned 1 [0161.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.683] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18624) returned 1 [0161.684] CloseHandle (hObject=0x37c) returned 1 [0161.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0161.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0161.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.684] SetEvent (hEvent=0x2fc) returned 1 [0161.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.685] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=820416) returned 1 [0161.685] CloseHandle (hObject=0x37c) returned 1 [0161.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll")) returned 0x420 [0161.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll")) returned 0x420 [0161.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.686] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1208928) returned 1 [0161.686] CloseHandle (hObject=0x37c) returned 1 [0161.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll")) returned 0x420 [0161.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll")) returned 0x420 [0161.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.687] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=332968) returned 1 [0161.687] CloseHandle (hObject=0x37c) returned 1 [0161.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 0x220 [0161.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 0x220 [0161.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.689] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5653664) returned 1 [0161.689] CloseHandle (hObject=0x37c) returned 1 [0161.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0x220 [0161.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0161.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0 [0161.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.691] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=660136) returned 1 [0161.691] CloseHandle (hObject=0x37c) returned 1 [0161.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 0x220 [0161.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 0x220 [0161.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.691] SetEvent (hEvent=0x2fc) returned 1 [0161.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.692] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=635040) returned 1 [0161.692] CloseHandle (hObject=0x37c) returned 1 [0161.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 0x220 [0161.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 0x220 [0161.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.693] SetEvent (hEvent=0x2fc) returned 1 [0161.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.694] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=963240) returned 1 [0161.694] CloseHandle (hObject=0x37c) returned 1 [0161.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll")) returned 0x220 [0161.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll")) returned 0x220 [0161.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.695] SetEvent (hEvent=0x2fc) returned 1 [0161.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.695] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=982720) returned 1 [0161.696] CloseHandle (hObject=0x37c) returned 1 [0161.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll")) returned 0x220 [0161.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll")) returned 0x220 [0161.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.696] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=390320) returned 1 [0161.696] CloseHandle (hObject=0x37c) returned 1 [0161.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll")) returned 0x220 [0161.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll")) returned 0x220 [0161.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.698] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=88752) returned 1 [0161.698] CloseHandle (hObject=0x37c) returned 1 [0161.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll")) returned 0x220 [0161.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll")) returned 0x220 [0161.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.699] SetEvent (hEvent=0x2fc) returned 1 [0161.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.700] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9024) returned 1 [0161.700] CloseHandle (hObject=0x37c) returned 1 [0161.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0161.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0161.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.701] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.701] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0161.705] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2340, lpOverlapped=0x0) returned 1 [0161.707] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2350, lpOverlapped=0x0) returned 1 [0161.708] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0161.708] CloseHandle (hObject=0x37c) returned 1 [0161.708] CloseHandle (hObject=0x380) returned 1 [0161.709] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0 [0161.709] SetEvent (hEvent=0x2fc) returned 1 [0161.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.710] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7216) returned 1 [0161.710] CloseHandle (hObject=0x380) returned 1 [0161.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0161.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0161.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.711] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.711] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0161.712] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1c30, lpOverlapped=0x0) returned 1 [0161.713] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1c40, lpOverlapped=0x0) returned 1 [0161.714] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0161.714] CloseHandle (hObject=0x380) returned 1 [0161.714] CloseHandle (hObject=0x37c) returned 1 [0161.715] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0 [0161.715] SetEvent (hEvent=0x2fc) returned 1 [0161.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.715] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14873) returned 1 [0161.716] CloseHandle (hObject=0x37c) returned 1 [0161.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0161.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0161.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.716] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.716] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0161.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0161.719] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3a19, lpOverlapped=0x0) returned 1 [0161.721] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3a20, lpOverlapped=0x0) returned 1 [0161.722] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0161.722] CloseHandle (hObject=0x37c) returned 1 [0161.722] CloseHandle (hObject=0x384) returned 1 [0161.723] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0 [0161.724] SetEvent (hEvent=0x2fc) returned 1 [0161.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.910] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6684) returned 1 [0161.910] CloseHandle (hObject=0x38c) returned 1 [0161.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0161.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0161.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.142] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.143] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1a1c, lpOverlapped=0x0) returned 1 [0162.146] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1a20, lpOverlapped=0x0) returned 1 [0162.147] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.147] CloseHandle (hObject=0x38c) returned 1 [0162.147] CloseHandle (hObject=0x394) returned 1 [0162.147] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0 [0162.147] SetEvent (hEvent=0x2fc) returned 1 [0162.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.148] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12702) returned 1 [0162.148] CloseHandle (hObject=0x394) returned 1 [0162.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0162.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0162.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.149] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.149] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.150] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x319e, lpOverlapped=0x0) returned 1 [0162.152] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x31a0, lpOverlapped=0x0) returned 1 [0162.153] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.153] CloseHandle (hObject=0x394) returned 1 [0162.153] CloseHandle (hObject=0x38c) returned 1 [0162.153] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0 [0162.154] SetEvent (hEvent=0x2fc) returned 1 [0162.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.154] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3484) returned 1 [0162.154] CloseHandle (hObject=0x38c) returned 1 [0162.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0162.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0162.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.155] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.155] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.156] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd9c, lpOverlapped=0x0) returned 1 [0162.157] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xda0, lpOverlapped=0x0) returned 1 [0162.158] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.158] CloseHandle (hObject=0x38c) returned 1 [0162.158] CloseHandle (hObject=0x394) returned 1 [0162.158] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0 [0162.159] SetEvent (hEvent=0x2fc) returned 1 [0162.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.159] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3140) returned 1 [0162.159] CloseHandle (hObject=0x394) returned 1 [0162.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0162.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0162.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.160] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.160] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.161] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc44, lpOverlapped=0x0) returned 1 [0162.163] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc50, lpOverlapped=0x0) returned 1 [0162.164] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.164] CloseHandle (hObject=0x394) returned 1 [0162.164] CloseHandle (hObject=0x38c) returned 1 [0162.165] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0 [0162.165] SetEvent (hEvent=0x2fc) returned 1 [0162.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.166] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12482) returned 1 [0162.166] CloseHandle (hObject=0x38c) returned 1 [0162.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0162.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0162.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.167] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.167] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.167] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x30c2, lpOverlapped=0x0) returned 1 [0162.169] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x30d0, lpOverlapped=0x0) returned 1 [0162.170] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.170] CloseHandle (hObject=0x38c) returned 1 [0162.170] CloseHandle (hObject=0x394) returned 1 [0162.170] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0 [0162.171] SetEvent (hEvent=0x2fc) returned 1 [0162.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.172] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2596) returned 1 [0162.172] CloseHandle (hObject=0x394) returned 1 [0162.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0162.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0162.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.173] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.173] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.174] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa24, lpOverlapped=0x0) returned 1 [0162.177] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa30, lpOverlapped=0x0) returned 1 [0162.178] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.179] CloseHandle (hObject=0x394) returned 1 [0162.179] CloseHandle (hObject=0x38c) returned 1 [0162.179] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0 [0162.433] SetEvent (hEvent=0x2fc) returned 1 [0162.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.434] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1146) returned 1 [0162.434] CloseHandle (hObject=0x38c) returned 1 [0162.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0162.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0162.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.435] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.435] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.436] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x47a, lpOverlapped=0x0) returned 1 [0162.437] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x480, lpOverlapped=0x0) returned 1 [0162.438] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.438] CloseHandle (hObject=0x38c) returned 1 [0162.438] CloseHandle (hObject=0x390) returned 1 [0162.439] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0 [0162.439] SetEvent (hEvent=0x2fc) returned 1 [0162.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.440] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7583) returned 1 [0162.440] CloseHandle (hObject=0x390) returned 1 [0162.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0162.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0162.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.441] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.441] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.441] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1d9f, lpOverlapped=0x0) returned 1 [0162.443] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1da0, lpOverlapped=0x0) returned 1 [0162.444] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.444] CloseHandle (hObject=0x390) returned 1 [0162.444] CloseHandle (hObject=0x38c) returned 1 [0162.444] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0 [0162.445] SetEvent (hEvent=0x2fc) returned 1 [0162.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.445] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6984) returned 1 [0162.445] CloseHandle (hObject=0x38c) returned 1 [0162.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0162.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0162.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.447] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b48, lpOverlapped=0x0) returned 1 [0162.449] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b50, lpOverlapped=0x0) returned 1 [0162.450] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.450] CloseHandle (hObject=0x38c) returned 1 [0162.450] CloseHandle (hObject=0x390) returned 1 [0162.450] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0 [0162.451] SetEvent (hEvent=0x2fc) returned 1 [0162.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.451] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13254) returned 1 [0162.451] CloseHandle (hObject=0x390) returned 1 [0162.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0162.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0162.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.452] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.452] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.452] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x33c6, lpOverlapped=0x0) returned 1 [0162.454] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x33d0, lpOverlapped=0x0) returned 1 [0162.456] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.456] CloseHandle (hObject=0x390) returned 1 [0162.456] CloseHandle (hObject=0x38c) returned 1 [0162.456] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0 [0162.456] SetEvent (hEvent=0x2fc) returned 1 [0162.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.457] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8582) returned 1 [0162.457] CloseHandle (hObject=0x38c) returned 1 [0162.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0162.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0162.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.458] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.458] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.468] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2186, lpOverlapped=0x0) returned 1 [0162.470] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2190, lpOverlapped=0x0) returned 1 [0162.471] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.471] CloseHandle (hObject=0x38c) returned 1 [0162.471] CloseHandle (hObject=0x390) returned 1 [0162.472] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0 [0162.474] SetEvent (hEvent=0x2fc) returned 1 [0162.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.474] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4894) returned 1 [0162.474] CloseHandle (hObject=0x390) returned 1 [0162.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0162.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0162.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.475] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.475] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.476] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x131e, lpOverlapped=0x0) returned 1 [0162.478] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1320, lpOverlapped=0x0) returned 1 [0162.479] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.479] CloseHandle (hObject=0x390) returned 1 [0162.479] CloseHandle (hObject=0x38c) returned 1 [0162.479] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0 [0162.480] SetEvent (hEvent=0x2fc) returned 1 [0162.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.481] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5375) returned 1 [0162.481] CloseHandle (hObject=0x38c) returned 1 [0162.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0162.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0162.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.482] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.483] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x14ff, lpOverlapped=0x0) returned 1 [0162.484] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1500, lpOverlapped=0x0) returned 1 [0162.485] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.486] CloseHandle (hObject=0x38c) returned 1 [0162.486] CloseHandle (hObject=0x390) returned 1 [0162.486] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0 [0162.486] SetEvent (hEvent=0x2fc) returned 1 [0162.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.487] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9248) returned 1 [0162.487] CloseHandle (hObject=0x390) returned 1 [0162.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0162.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0162.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.488] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.488] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.488] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2420, lpOverlapped=0x0) returned 1 [0162.730] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2430, lpOverlapped=0x0) returned 1 [0162.732] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.732] CloseHandle (hObject=0x390) returned 1 [0162.732] CloseHandle (hObject=0x38c) returned 1 [0162.732] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0 [0162.732] SetEvent (hEvent=0x2fc) returned 1 [0162.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.734] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5684) returned 1 [0162.734] CloseHandle (hObject=0x38c) returned 1 [0162.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0162.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0162.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.735] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.735] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.736] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1634, lpOverlapped=0x0) returned 1 [0162.737] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1640, lpOverlapped=0x0) returned 1 [0162.738] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.738] CloseHandle (hObject=0x38c) returned 1 [0162.739] CloseHandle (hObject=0x390) returned 1 [0162.739] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0 [0162.739] SetEvent (hEvent=0x2fc) returned 1 [0162.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.740] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20578) returned 1 [0162.740] CloseHandle (hObject=0x390) returned 1 [0162.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0162.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0162.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.740] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.740] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.744] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5062, lpOverlapped=0x0) returned 1 [0162.746] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5070, lpOverlapped=0x0) returned 1 [0162.750] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.750] CloseHandle (hObject=0x390) returned 1 [0162.750] CloseHandle (hObject=0x380) returned 1 [0162.750] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0 [0162.750] SetEvent (hEvent=0x2fc) returned 1 [0162.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.751] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14428) returned 1 [0162.751] CloseHandle (hObject=0x380) returned 1 [0162.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0162.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0162.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.752] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.752] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.752] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x385c, lpOverlapped=0x0) returned 1 [0162.754] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3860, lpOverlapped=0x0) returned 1 [0162.755] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.755] CloseHandle (hObject=0x380) returned 1 [0162.755] CloseHandle (hObject=0x390) returned 1 [0162.756] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0 [0162.756] SetEvent (hEvent=0x2fc) returned 1 [0162.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.757] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7072) returned 1 [0162.757] CloseHandle (hObject=0x390) returned 1 [0162.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0162.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0162.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.757] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.757] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.758] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ba0, lpOverlapped=0x0) returned 1 [0162.760] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1bb0, lpOverlapped=0x0) returned 1 [0162.761] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.761] CloseHandle (hObject=0x390) returned 1 [0162.761] CloseHandle (hObject=0x380) returned 1 [0162.761] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0 [0162.761] SetEvent (hEvent=0x2fc) returned 1 [0162.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.762] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3344) returned 1 [0162.762] CloseHandle (hObject=0x380) returned 1 [0162.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0162.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0162.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.763] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.763] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.764] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd10, lpOverlapped=0x0) returned 1 [0162.765] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xd20, lpOverlapped=0x0) returned 1 [0162.766] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.766] CloseHandle (hObject=0x380) returned 1 [0162.766] CloseHandle (hObject=0x390) returned 1 [0162.767] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0 [0162.767] SetEvent (hEvent=0x2fc) returned 1 [0162.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.769] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1596) returned 1 [0162.769] CloseHandle (hObject=0x390) returned 1 [0162.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0162.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0162.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0162.769] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.769] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.770] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x63c, lpOverlapped=0x0) returned 1 [0162.993] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x640, lpOverlapped=0x0) returned 1 [0162.994] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0162.994] CloseHandle (hObject=0x390) returned 1 [0162.994] CloseHandle (hObject=0x380) returned 1 [0162.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0 [0162.995] SetEvent (hEvent=0x2fc) returned 1 [0162.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.995] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5836) returned 1 [0162.995] CloseHandle (hObject=0x380) returned 1 [0162.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0162.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0162.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.996] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.996] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0162.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0162.997] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16cc, lpOverlapped=0x0) returned 1 [0163.037] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16d0, lpOverlapped=0x0) returned 1 [0163.038] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.039] CloseHandle (hObject=0x380) returned 1 [0163.039] CloseHandle (hObject=0x390) returned 1 [0163.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0 [0163.039] SetEvent (hEvent=0x2fc) returned 1 [0163.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0163.040] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3012) returned 1 [0163.040] CloseHandle (hObject=0x390) returned 1 [0163.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0163.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0163.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0163.041] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.041] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0163.042] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xbc4, lpOverlapped=0x0) returned 1 [0163.043] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xbd0, lpOverlapped=0x0) returned 1 [0163.044] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.044] CloseHandle (hObject=0x390) returned 1 [0163.044] CloseHandle (hObject=0x380) returned 1 [0163.045] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0 [0163.045] SetEvent (hEvent=0x2fc) returned 1 [0163.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.045] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2756) returned 1 [0163.045] CloseHandle (hObject=0x380) returned 1 [0163.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0163.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0163.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.046] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.046] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0163.355] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xac4, lpOverlapped=0x0) returned 1 [0163.358] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xad0, lpOverlapped=0x0) returned 1 [0163.359] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.359] CloseHandle (hObject=0x380) returned 1 [0163.360] CloseHandle (hObject=0x37c) returned 1 [0163.360] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0 [0163.360] SetEvent (hEvent=0x2fc) returned 1 [0163.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.361] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7540) returned 1 [0163.361] CloseHandle (hObject=0x37c) returned 1 [0163.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0163.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0163.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.362] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.362] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0163.363] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1d74, lpOverlapped=0x0) returned 1 [0163.364] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1d80, lpOverlapped=0x0) returned 1 [0163.365] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.365] CloseHandle (hObject=0x37c) returned 1 [0163.366] CloseHandle (hObject=0x380) returned 1 [0163.366] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0 [0163.366] SetEvent (hEvent=0x2fc) returned 1 [0163.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.367] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6632) returned 1 [0163.367] CloseHandle (hObject=0x380) returned 1 [0163.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0163.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0163.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.368] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.368] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0163.368] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x19e8, lpOverlapped=0x0) returned 1 [0163.370] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x19f0, lpOverlapped=0x0) returned 1 [0163.371] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.371] CloseHandle (hObject=0x380) returned 1 [0163.371] CloseHandle (hObject=0x37c) returned 1 [0163.371] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0 [0163.372] SetEvent (hEvent=0x2fc) returned 1 [0163.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.372] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2108) returned 1 [0163.372] CloseHandle (hObject=0x37c) returned 1 [0163.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0163.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0163.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.373] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.373] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0163.373] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x83c, lpOverlapped=0x0) returned 1 [0163.375] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x840, lpOverlapped=0x0) returned 1 [0163.376] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.376] CloseHandle (hObject=0x37c) returned 1 [0163.376] CloseHandle (hObject=0x380) returned 1 [0163.376] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0 [0163.379] SetEvent (hEvent=0x2fc) returned 1 [0163.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.379] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9240) returned 1 [0163.379] CloseHandle (hObject=0x380) returned 1 [0163.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0163.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0163.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.380] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.380] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0163.752] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2418, lpOverlapped=0x0) returned 1 [0163.764] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2420, lpOverlapped=0x0) returned 1 [0163.765] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.765] CloseHandle (hObject=0x380) returned 1 [0163.765] CloseHandle (hObject=0x39c) returned 1 [0163.765] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0 [0163.765] SetEvent (hEvent=0x2fc) returned 1 [0163.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.766] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6060) returned 1 [0163.766] CloseHandle (hObject=0x39c) returned 1 [0163.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0163.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0163.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.767] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.767] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0163.767] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x17ac, lpOverlapped=0x0) returned 1 [0163.777] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x17b0, lpOverlapped=0x0) returned 1 [0163.778] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0163.779] CloseHandle (hObject=0x39c) returned 1 [0163.779] CloseHandle (hObject=0x380) returned 1 [0163.779] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0 [0163.779] SetEvent (hEvent=0x2fc) returned 1 [0163.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.780] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2636) returned 1 [0163.780] CloseHandle (hObject=0x380) returned 1 [0163.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0163.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0163.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0163.780] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.781] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0163.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0163.781] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa4c, lpOverlapped=0x0) returned 1 [0164.028] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa50, lpOverlapped=0x0) returned 1 [0164.029] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.029] CloseHandle (hObject=0x380) returned 1 [0164.029] CloseHandle (hObject=0x39c) returned 1 [0164.029] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0 [0164.030] SetEvent (hEvent=0x2fc) returned 1 [0164.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.031] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4612) returned 1 [0164.031] CloseHandle (hObject=0x39c) returned 1 [0164.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0164.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0164.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.031] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.031] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.032] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1204, lpOverlapped=0x0) returned 1 [0164.038] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1210, lpOverlapped=0x0) returned 1 [0164.039] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.039] CloseHandle (hObject=0x39c) returned 1 [0164.039] CloseHandle (hObject=0x380) returned 1 [0164.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0 [0164.040] SetEvent (hEvent=0x2fc) returned 1 [0164.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.290] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7668) returned 1 [0164.290] CloseHandle (hObject=0x380) returned 1 [0164.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0164.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0164.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.338] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.338] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0164.339] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1df4, lpOverlapped=0x0) returned 1 [0164.340] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1e00, lpOverlapped=0x0) returned 1 [0164.341] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.341] CloseHandle (hObject=0x384) returned 1 [0164.342] CloseHandle (hObject=0x38c) returned 1 [0164.342] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0 [0164.342] SetEvent (hEvent=0x2fc) returned 1 [0164.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.346] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4870) returned 1 [0164.346] CloseHandle (hObject=0x39c) returned 1 [0164.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0164.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0164.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.347] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.347] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.348] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1306, lpOverlapped=0x0) returned 1 [0164.351] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1310, lpOverlapped=0x0) returned 1 [0164.352] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.352] CloseHandle (hObject=0x39c) returned 1 [0164.352] CloseHandle (hObject=0x380) returned 1 [0164.353] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0 [0164.353] SetEvent (hEvent=0x2fc) returned 1 [0164.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.354] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=28948) returned 1 [0164.354] CloseHandle (hObject=0x380) returned 1 [0164.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0164.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0164.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.355] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.355] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0164.511] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7114, lpOverlapped=0x0) returned 1 [0164.516] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7120, lpOverlapped=0x0) returned 1 [0164.517] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.518] CloseHandle (hObject=0x380) returned 1 [0164.518] CloseHandle (hObject=0x384) returned 1 [0164.518] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0 [0164.519] SetEvent (hEvent=0x2fc) returned 1 [0164.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.519] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11636) returned 1 [0164.519] CloseHandle (hObject=0x384) returned 1 [0164.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0164.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0164.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.520] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.520] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.521] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2d74, lpOverlapped=0x0) returned 1 [0164.529] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2d80, lpOverlapped=0x0) returned 1 [0164.530] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.530] CloseHandle (hObject=0x384) returned 1 [0164.530] CloseHandle (hObject=0x380) returned 1 [0164.531] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0 [0164.531] SetEvent (hEvent=0x2fc) returned 1 [0164.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.532] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16180) returned 1 [0164.532] CloseHandle (hObject=0x380) returned 1 [0164.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0164.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0164.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.532] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.532] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0164.533] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3f34, lpOverlapped=0x0) returned 1 [0164.538] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3f40, lpOverlapped=0x0) returned 1 [0164.540] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.541] CloseHandle (hObject=0x380) returned 1 [0164.541] CloseHandle (hObject=0x384) returned 1 [0164.541] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0 [0164.541] SetEvent (hEvent=0x2fc) returned 1 [0164.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.725] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16112) returned 1 [0164.725] CloseHandle (hObject=0x398) returned 1 [0164.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0164.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0164.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.726] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.726] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0164.727] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3ef0, lpOverlapped=0x0) returned 1 [0164.729] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3f00, lpOverlapped=0x0) returned 1 [0164.730] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.730] CloseHandle (hObject=0x398) returned 1 [0164.730] CloseHandle (hObject=0x388) returned 1 [0164.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0 [0164.731] SetEvent (hEvent=0x2fc) returned 1 [0164.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.732] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26748) returned 1 [0164.732] CloseHandle (hObject=0x388) returned 1 [0164.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0164.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0164.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.733] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0164.734] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x687c, lpOverlapped=0x0) returned 1 [0164.736] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6880, lpOverlapped=0x0) returned 1 [0164.737] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.737] CloseHandle (hObject=0x388) returned 1 [0164.737] CloseHandle (hObject=0x398) returned 1 [0164.738] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0 [0164.738] SetEvent (hEvent=0x2fc) returned 1 [0164.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.739] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4924) returned 1 [0164.739] CloseHandle (hObject=0x398) returned 1 [0164.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0164.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0164.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.740] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.740] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0164.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0164.740] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x133c, lpOverlapped=0x0) returned 1 [0164.742] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1340, lpOverlapped=0x0) returned 1 [0164.744] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0164.744] CloseHandle (hObject=0x398) returned 1 [0164.744] CloseHandle (hObject=0x388) returned 1 [0164.744] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0 [0164.744] SetEvent (hEvent=0x2fc) returned 1 [0164.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.015] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4066) returned 1 [0165.015] CloseHandle (hObject=0x380) returned 1 [0165.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0165.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0165.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.016] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.016] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0165.017] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xfe2, lpOverlapped=0x0) returned 1 [0165.019] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xff0, lpOverlapped=0x0) returned 1 [0165.020] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.020] CloseHandle (hObject=0x380) returned 1 [0165.021] CloseHandle (hObject=0x384) returned 1 [0165.021] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0 [0165.021] SetEvent (hEvent=0x2fc) returned 1 [0165.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.022] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20554) returned 1 [0165.022] CloseHandle (hObject=0x384) returned 1 [0165.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0165.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0165.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.023] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.023] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.024] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x504a, lpOverlapped=0x0) returned 1 [0165.026] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5050, lpOverlapped=0x0) returned 1 [0165.027] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.027] CloseHandle (hObject=0x384) returned 1 [0165.027] CloseHandle (hObject=0x380) returned 1 [0165.028] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0 [0165.028] SetEvent (hEvent=0x2fc) returned 1 [0165.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.029] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7966) returned 1 [0165.029] CloseHandle (hObject=0x380) returned 1 [0165.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0165.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0165.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.029] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.029] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0165.030] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f1e, lpOverlapped=0x0) returned 1 [0165.032] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f20, lpOverlapped=0x0) returned 1 [0165.033] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.033] CloseHandle (hObject=0x380) returned 1 [0165.033] CloseHandle (hObject=0x384) returned 1 [0165.034] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0 [0165.034] SetEvent (hEvent=0x2fc) returned 1 [0165.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.035] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13515) returned 1 [0165.035] CloseHandle (hObject=0x384) returned 1 [0165.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0165.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0165.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.036] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.036] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.036] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x34cb, lpOverlapped=0x0) returned 1 [0165.038] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x34d0, lpOverlapped=0x0) returned 1 [0165.039] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.039] CloseHandle (hObject=0x384) returned 1 [0165.040] CloseHandle (hObject=0x380) returned 1 [0165.040] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0 [0165.040] SetEvent (hEvent=0x2fc) returned 1 [0165.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.041] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20189) returned 1 [0165.041] CloseHandle (hObject=0x380) returned 1 [0165.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0165.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0165.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.042] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.042] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0165.042] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4edd, lpOverlapped=0x0) returned 1 [0165.045] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4ee0, lpOverlapped=0x0) returned 1 [0165.046] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.046] CloseHandle (hObject=0x380) returned 1 [0165.046] CloseHandle (hObject=0x384) returned 1 [0165.047] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0 [0165.047] SetEvent (hEvent=0x2fc) returned 1 [0165.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.047] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20454) returned 1 [0165.047] CloseHandle (hObject=0x384) returned 1 [0165.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0165.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0165.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.048] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.048] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.049] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4fe6, lpOverlapped=0x0) returned 1 [0165.051] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4ff0, lpOverlapped=0x0) returned 1 [0165.181] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.181] CloseHandle (hObject=0x384) returned 1 [0165.182] CloseHandle (hObject=0x380) returned 1 [0165.182] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0 [0165.183] SetEvent (hEvent=0x2fc) returned 1 [0165.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.190] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15733) returned 1 [0165.190] CloseHandle (hObject=0x380) returned 1 [0165.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0165.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0165.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.191] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.191] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0165.191] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3d75, lpOverlapped=0x0) returned 1 [0165.211] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3d80, lpOverlapped=0x0) returned 1 [0165.212] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.212] CloseHandle (hObject=0x380) returned 1 [0165.212] CloseHandle (hObject=0x384) returned 1 [0165.492] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0 [0165.505] SetEvent (hEvent=0x2fc) returned 1 [0165.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.641] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12520) returned 1 [0165.641] CloseHandle (hObject=0x380) returned 1 [0165.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0165.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0165.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.643] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x30e8, lpOverlapped=0x0) returned 1 [0165.645] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x30f0, lpOverlapped=0x0) returned 1 [0165.646] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.647] CloseHandle (hObject=0x380) returned 1 [0165.647] CloseHandle (hObject=0x38c) returned 1 [0165.647] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0 [0165.647] SetEvent (hEvent=0x2fc) returned 1 [0165.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.648] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10146) returned 1 [0165.648] CloseHandle (hObject=0x38c) returned 1 [0165.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0165.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0165.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.649] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.649] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.649] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x27a2, lpOverlapped=0x0) returned 1 [0165.651] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x27b0, lpOverlapped=0x0) returned 1 [0165.652] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.653] CloseHandle (hObject=0x38c) returned 1 [0165.653] CloseHandle (hObject=0x380) returned 1 [0165.653] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0 [0165.653] SetEvent (hEvent=0x2fc) returned 1 [0165.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.655] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1464) returned 1 [0165.655] CloseHandle (hObject=0x380) returned 1 [0165.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0165.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0165.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.656] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.656] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.656] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5b8, lpOverlapped=0x0) returned 1 [0165.658] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5c0, lpOverlapped=0x0) returned 1 [0165.659] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.659] CloseHandle (hObject=0x380) returned 1 [0165.659] CloseHandle (hObject=0x38c) returned 1 [0165.660] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0 [0165.660] SetEvent (hEvent=0x2fc) returned 1 [0165.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.661] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1696) returned 1 [0165.661] CloseHandle (hObject=0x38c) returned 1 [0165.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0165.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0165.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.662] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.662] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.663] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6a0, lpOverlapped=0x0) returned 1 [0165.665] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6b0, lpOverlapped=0x0) returned 1 [0165.666] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.666] CloseHandle (hObject=0x38c) returned 1 [0165.666] CloseHandle (hObject=0x380) returned 1 [0165.666] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0 [0165.667] SetEvent (hEvent=0x2fc) returned 1 [0165.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.667] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1516) returned 1 [0165.667] CloseHandle (hObject=0x380) returned 1 [0165.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0165.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0165.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.668] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.668] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.669] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5ec, lpOverlapped=0x0) returned 1 [0165.672] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5f0, lpOverlapped=0x0) returned 1 [0165.673] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.673] CloseHandle (hObject=0x380) returned 1 [0165.673] CloseHandle (hObject=0x38c) returned 1 [0165.674] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0 [0165.674] SetEvent (hEvent=0x2fc) returned 1 [0165.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.675] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3986) returned 1 [0165.675] CloseHandle (hObject=0x38c) returned 1 [0165.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0165.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0165.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.676] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.676] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.676] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf92, lpOverlapped=0x0) returned 1 [0165.678] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xfa0, lpOverlapped=0x0) returned 1 [0165.679] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.679] CloseHandle (hObject=0x38c) returned 1 [0165.679] CloseHandle (hObject=0x380) returned 1 [0165.680] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0 [0165.680] SetEvent (hEvent=0x2fc) returned 1 [0165.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.858] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8070) returned 1 [0165.858] CloseHandle (hObject=0x39c) returned 1 [0165.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0165.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0165.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.859] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.859] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0165.864] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f86, lpOverlapped=0x0) returned 1 [0165.866] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f90, lpOverlapped=0x0) returned 1 [0165.867] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.867] CloseHandle (hObject=0x39c) returned 1 [0165.867] CloseHandle (hObject=0x384) returned 1 [0165.868] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0 [0165.868] SetEvent (hEvent=0x2fc) returned 1 [0165.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.868] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12482) returned 1 [0165.869] CloseHandle (hObject=0x384) returned 1 [0165.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0165.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0165.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0165.869] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.869] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0165.870] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x30c2, lpOverlapped=0x0) returned 1 [0165.873] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x30d0, lpOverlapped=0x0) returned 1 [0165.875] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.875] CloseHandle (hObject=0x384) returned 1 [0165.875] CloseHandle (hObject=0x39c) returned 1 [0165.875] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0 [0165.875] SetEvent (hEvent=0x2fc) returned 1 [0165.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.876] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2556) returned 1 [0165.876] CloseHandle (hObject=0x39c) returned 1 [0165.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0165.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0165.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.877] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.877] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0165.878] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9fc, lpOverlapped=0x0) returned 1 [0165.879] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa00, lpOverlapped=0x0) returned 1 [0165.881] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.881] CloseHandle (hObject=0x39c) returned 1 [0165.881] CloseHandle (hObject=0x384) returned 1 [0165.881] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0 [0165.881] SetEvent (hEvent=0x2fc) returned 1 [0165.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.886] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5752) returned 1 [0165.886] CloseHandle (hObject=0x380) returned 1 [0165.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0165.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0165.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.887] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.887] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.888] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1678, lpOverlapped=0x0) returned 1 [0165.889] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1680, lpOverlapped=0x0) returned 1 [0165.890] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.891] CloseHandle (hObject=0x380) returned 1 [0165.891] CloseHandle (hObject=0x388) returned 1 [0165.891] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0 [0165.891] SetEvent (hEvent=0x2fc) returned 1 [0165.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.892] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5272) returned 1 [0165.892] CloseHandle (hObject=0x388) returned 1 [0165.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0165.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0165.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.893] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.893] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.893] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1498, lpOverlapped=0x0) returned 1 [0165.895] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x14a0, lpOverlapped=0x0) returned 1 [0165.896] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0165.896] CloseHandle (hObject=0x388) returned 1 [0165.896] CloseHandle (hObject=0x380) returned 1 [0165.897] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0 [0165.897] SetEvent (hEvent=0x2fc) returned 1 [0165.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.898] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3016) returned 1 [0165.898] CloseHandle (hObject=0x380) returned 1 [0165.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0165.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0165.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0165.899] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.899] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0165.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.899] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xbc8, lpOverlapped=0x0) returned 1 [0166.090] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xbd0, lpOverlapped=0x0) returned 1 [0166.091] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.091] CloseHandle (hObject=0x380) returned 1 [0166.091] CloseHandle (hObject=0x388) returned 1 [0166.472] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0 [0166.478] SetEvent (hEvent=0x2fc) returned 1 [0166.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.500] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=812) returned 1 [0166.500] CloseHandle (hObject=0x388) returned 1 [0166.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0166.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0166.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.511] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.511] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0166.512] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x32c, lpOverlapped=0x0) returned 1 [0166.514] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x330, lpOverlapped=0x0) returned 1 [0166.515] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.515] CloseHandle (hObject=0x39c) returned 1 [0166.515] CloseHandle (hObject=0x388) returned 1 [0166.515] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0 [0166.516] SetEvent (hEvent=0x2fc) returned 1 [0166.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.516] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11500) returned 1 [0166.516] CloseHandle (hObject=0x388) returned 1 [0166.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0166.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0166.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.517] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.518] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2cec, lpOverlapped=0x0) returned 1 [0166.520] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2cf0, lpOverlapped=0x0) returned 1 [0166.521] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.521] CloseHandle (hObject=0x388) returned 1 [0166.521] CloseHandle (hObject=0x39c) returned 1 [0166.522] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0 [0166.522] SetEvent (hEvent=0x2fc) returned 1 [0166.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.522] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4408) returned 1 [0166.523] CloseHandle (hObject=0x39c) returned 1 [0166.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0166.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0166.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0166.524] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1138, lpOverlapped=0x0) returned 1 [0166.530] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1140, lpOverlapped=0x0) returned 1 [0166.531] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.531] CloseHandle (hObject=0x39c) returned 1 [0166.531] CloseHandle (hObject=0x388) returned 1 [0166.531] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0 [0166.532] SetEvent (hEvent=0x2fc) returned 1 [0166.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.532] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6256) returned 1 [0166.532] CloseHandle (hObject=0x388) returned 1 [0166.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0166.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0166.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.533] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.533] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.534] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1870, lpOverlapped=0x0) returned 1 [0166.535] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1880, lpOverlapped=0x0) returned 1 [0166.536] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.537] CloseHandle (hObject=0x388) returned 1 [0166.537] CloseHandle (hObject=0x39c) returned 1 [0166.537] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0 [0166.537] SetEvent (hEvent=0x2fc) returned 1 [0166.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.538] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19476) returned 1 [0166.538] CloseHandle (hObject=0x39c) returned 1 [0166.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0166.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0166.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.538] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.539] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0166.539] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4c14, lpOverlapped=0x0) returned 1 [0166.543] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4c20, lpOverlapped=0x0) returned 1 [0166.544] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.544] CloseHandle (hObject=0x39c) returned 1 [0166.545] CloseHandle (hObject=0x388) returned 1 [0166.545] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0 [0166.545] SetEvent (hEvent=0x2fc) returned 1 [0166.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.545] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3768) returned 1 [0166.545] CloseHandle (hObject=0x388) returned 1 [0166.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0166.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0166.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.547] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.547] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.547] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xeb8, lpOverlapped=0x0) returned 1 [0166.549] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xec0, lpOverlapped=0x0) returned 1 [0166.550] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.550] CloseHandle (hObject=0x388) returned 1 [0166.550] CloseHandle (hObject=0x39c) returned 1 [0166.551] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0 [0166.551] SetEvent (hEvent=0x2fc) returned 1 [0166.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.552] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3350) returned 1 [0166.552] CloseHandle (hObject=0x39c) returned 1 [0166.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0166.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0166.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.553] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.553] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.773] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd16, lpOverlapped=0x0) returned 1 [0166.774] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xd20, lpOverlapped=0x0) returned 1 [0166.776] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.776] CloseHandle (hObject=0x39c) returned 1 [0166.777] CloseHandle (hObject=0x38c) returned 1 [0166.777] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0 [0166.777] SetEvent (hEvent=0x2fc) returned 1 [0166.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.778] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2166) returned 1 [0166.778] CloseHandle (hObject=0x38c) returned 1 [0166.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0166.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0166.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.779] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.779] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.779] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x876, lpOverlapped=0x0) returned 1 [0166.809] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x880, lpOverlapped=0x0) returned 1 [0166.810] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.810] CloseHandle (hObject=0x38c) returned 1 [0166.810] CloseHandle (hObject=0x39c) returned 1 [0166.811] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0 [0166.811] SetEvent (hEvent=0x2fc) returned 1 [0166.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.811] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1712) returned 1 [0166.812] CloseHandle (hObject=0x39c) returned 1 [0166.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0166.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0166.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.813] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.814] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6b0, lpOverlapped=0x0) returned 1 [0166.817] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6c0, lpOverlapped=0x0) returned 1 [0166.818] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.818] CloseHandle (hObject=0x39c) returned 1 [0166.818] CloseHandle (hObject=0x38c) returned 1 [0166.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0 [0166.819] SetEvent (hEvent=0x2fc) returned 1 [0166.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.819] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8366) returned 1 [0166.819] CloseHandle (hObject=0x38c) returned 1 [0166.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0166.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0166.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.820] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.820] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.823] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x20ae, lpOverlapped=0x0) returned 1 [0166.830] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x20b0, lpOverlapped=0x0) returned 1 [0166.831] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.831] CloseHandle (hObject=0x38c) returned 1 [0166.831] CloseHandle (hObject=0x39c) returned 1 [0166.832] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0 [0166.832] SetEvent (hEvent=0x2fc) returned 1 [0166.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.835] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4976) returned 1 [0166.835] CloseHandle (hObject=0x388) returned 1 [0166.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0166.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0166.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.836] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.836] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1370, lpOverlapped=0x0) returned 1 [0166.842] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1380, lpOverlapped=0x0) returned 1 [0166.844] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.844] CloseHandle (hObject=0x388) returned 1 [0166.844] CloseHandle (hObject=0x380) returned 1 [0166.844] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0 [0166.844] SetEvent (hEvent=0x2fc) returned 1 [0166.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.845] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12788) returned 1 [0166.845] CloseHandle (hObject=0x380) returned 1 [0166.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0166.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0166.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.846] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.846] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0166.846] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x31f4, lpOverlapped=0x0) returned 1 [0166.849] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3200, lpOverlapped=0x0) returned 1 [0166.850] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.850] CloseHandle (hObject=0x380) returned 1 [0166.850] CloseHandle (hObject=0x388) returned 1 [0166.851] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0 [0166.851] SetEvent (hEvent=0x2fc) returned 1 [0166.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.852] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3104) returned 1 [0166.852] CloseHandle (hObject=0x388) returned 1 [0166.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0166.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0166.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0166.853] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.853] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.853] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc20, lpOverlapped=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc30, lpOverlapped=0x0) returned 1 [0166.857] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.857] CloseHandle (hObject=0x388) returned 1 [0166.857] CloseHandle (hObject=0x380) returned 1 [0166.857] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0 [0166.857] SetEvent (hEvent=0x2fc) returned 1 [0166.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.858] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1588) returned 1 [0166.858] CloseHandle (hObject=0x380) returned 1 [0166.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0166.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0166.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.859] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.859] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0166.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.861] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x634, lpOverlapped=0x0) returned 1 [0166.864] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x640, lpOverlapped=0x0) returned 1 [0166.865] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0166.865] CloseHandle (hObject=0x380) returned 1 [0167.087] CloseHandle (hObject=0x38c) returned 1 [0167.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0 [0167.088] SetEvent (hEvent=0x2fc) returned 1 [0167.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.089] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1676) returned 1 [0167.089] CloseHandle (hObject=0x38c) returned 1 [0167.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0167.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0167.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.090] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.090] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.091] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x68c, lpOverlapped=0x0) returned 1 [0167.093] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x690, lpOverlapped=0x0) returned 1 [0167.094] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.094] CloseHandle (hObject=0x38c) returned 1 [0167.094] CloseHandle (hObject=0x390) returned 1 [0167.094] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0 [0167.094] SetEvent (hEvent=0x2fc) returned 1 [0167.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.096] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3896) returned 1 [0167.096] CloseHandle (hObject=0x390) returned 1 [0167.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0167.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0167.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.096] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.097] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0167.098] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf38, lpOverlapped=0x0) returned 1 [0167.099] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf40, lpOverlapped=0x0) returned 1 [0167.100] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.100] CloseHandle (hObject=0x390) returned 1 [0167.100] CloseHandle (hObject=0x38c) returned 1 [0167.101] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0 [0167.101] SetEvent (hEvent=0x2fc) returned 1 [0167.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.102] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3796) returned 1 [0167.102] CloseHandle (hObject=0x38c) returned 1 [0167.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0167.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0167.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.118] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.121] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.126] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xed4, lpOverlapped=0x0) returned 1 [0167.128] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xee0, lpOverlapped=0x0) returned 1 [0167.129] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.130] CloseHandle (hObject=0x38c) returned 1 [0167.130] CloseHandle (hObject=0x390) returned 1 [0167.130] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0 [0167.130] SetEvent (hEvent=0x2fc) returned 1 [0167.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.131] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2436) returned 1 [0167.131] CloseHandle (hObject=0x390) returned 1 [0167.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0167.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0167.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.132] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.132] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0167.133] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x984, lpOverlapped=0x0) returned 1 [0167.134] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x990, lpOverlapped=0x0) returned 1 [0167.135] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.135] CloseHandle (hObject=0x390) returned 1 [0167.136] CloseHandle (hObject=0x38c) returned 1 [0167.136] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0 [0167.136] SetEvent (hEvent=0x2fc) returned 1 [0167.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.136] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2732) returned 1 [0167.137] CloseHandle (hObject=0x38c) returned 1 [0167.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0167.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0167.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0167.137] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.137] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.138] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xaac, lpOverlapped=0x0) returned 1 [0167.139] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xab0, lpOverlapped=0x0) returned 1 [0167.142] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.142] CloseHandle (hObject=0x38c) returned 1 [0167.142] CloseHandle (hObject=0x390) returned 1 [0167.142] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0 [0167.142] SetEvent (hEvent=0x2fc) returned 1 [0167.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.145] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7176) returned 1 [0167.145] CloseHandle (hObject=0x390) returned 1 [0167.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0167.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0167.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.145] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.145] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x3a0 [0167.284] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1c08, lpOverlapped=0x0) returned 1 [0167.311] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1c10, lpOverlapped=0x0) returned 1 [0167.313] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.313] CloseHandle (hObject=0x390) returned 1 [0167.314] CloseHandle (hObject=0x3a0) returned 1 [0167.314] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0 [0167.314] SetEvent (hEvent=0x2fc) returned 1 [0167.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.315] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9322) returned 1 [0167.315] CloseHandle (hObject=0x3a0) returned 1 [0167.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0167.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0167.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.316] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.316] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.317] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x246a, lpOverlapped=0x0) returned 1 [0167.319] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2470, lpOverlapped=0x0) returned 1 [0167.320] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.320] CloseHandle (hObject=0x3a0) returned 1 [0167.320] CloseHandle (hObject=0x390) returned 1 [0167.320] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0 [0167.321] SetEvent (hEvent=0x2fc) returned 1 [0167.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.321] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3564) returned 1 [0167.321] CloseHandle (hObject=0x390) returned 1 [0167.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0167.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0167.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.322] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.322] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x3a0 [0167.323] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xdec, lpOverlapped=0x0) returned 1 [0167.325] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xdf0, lpOverlapped=0x0) returned 1 [0167.326] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.326] CloseHandle (hObject=0x390) returned 1 [0167.326] CloseHandle (hObject=0x3a0) returned 1 [0167.326] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0 [0167.327] SetEvent (hEvent=0x2fc) returned 1 [0167.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.327] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2422) returned 1 [0167.328] CloseHandle (hObject=0x3a0) returned 1 [0167.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0167.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0167.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.328] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.328] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.329] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x976, lpOverlapped=0x0) returned 1 [0167.331] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x980, lpOverlapped=0x0) returned 1 [0167.332] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.332] CloseHandle (hObject=0x3a0) returned 1 [0167.332] CloseHandle (hObject=0x390) returned 1 [0167.332] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0 [0167.332] SetEvent (hEvent=0x2fc) returned 1 [0167.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.334] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2262) returned 1 [0167.334] CloseHandle (hObject=0x390) returned 1 [0167.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0167.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0167.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.334] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.335] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x3a0 [0167.335] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8d6, lpOverlapped=0x0) returned 1 [0167.337] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8e0, lpOverlapped=0x0) returned 1 [0167.338] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.338] CloseHandle (hObject=0x390) returned 1 [0167.338] CloseHandle (hObject=0x3a0) returned 1 [0167.339] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0 [0167.339] SetEvent (hEvent=0x2fc) returned 1 [0167.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.339] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2262) returned 1 [0167.339] CloseHandle (hObject=0x3a0) returned 1 [0167.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0167.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0167.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0167.340] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.340] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.341] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8d6, lpOverlapped=0x0) returned 1 [0167.344] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8e0, lpOverlapped=0x0) returned 1 [0167.345] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.345] CloseHandle (hObject=0x3a0) returned 1 [0167.345] CloseHandle (hObject=0x390) returned 1 [0167.345] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0 [0167.345] SetEvent (hEvent=0x2fc) returned 1 [0167.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.346] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6970) returned 1 [0167.346] CloseHandle (hObject=0x390) returned 1 [0167.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0167.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0167.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.347] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.347] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.534] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b3a, lpOverlapped=0x0) returned 1 [0167.536] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b40, lpOverlapped=0x0) returned 1 [0167.537] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.537] CloseHandle (hObject=0x390) returned 1 [0167.537] CloseHandle (hObject=0x380) returned 1 [0167.537] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0 [0167.538] SetEvent (hEvent=0x2fc) returned 1 [0167.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.539] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5270) returned 1 [0167.539] CloseHandle (hObject=0x380) returned 1 [0167.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0167.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0167.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.540] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.540] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1496, lpOverlapped=0x0) returned 1 [0167.542] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x14a0, lpOverlapped=0x0) returned 1 [0167.543] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.543] CloseHandle (hObject=0x380) returned 1 [0167.543] CloseHandle (hObject=0x390) returned 1 [0167.543] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0 [0167.544] SetEvent (hEvent=0x2fc) returned 1 [0167.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.546] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=49546) returned 1 [0167.546] CloseHandle (hObject=0x390) returned 1 [0167.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0167.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0167.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.547] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.547] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.548] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc18a, lpOverlapped=0x0) returned 1 [0167.586] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc190, lpOverlapped=0x0) returned 1 [0167.588] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.589] CloseHandle (hObject=0x390) returned 1 [0167.589] CloseHandle (hObject=0x380) returned 1 [0167.589] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0 [0167.589] SetEvent (hEvent=0x2fc) returned 1 [0167.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.590] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10326) returned 1 [0167.590] CloseHandle (hObject=0x380) returned 1 [0167.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0167.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0167.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.594] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.594] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.594] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2856, lpOverlapped=0x0) returned 1 [0167.596] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2860, lpOverlapped=0x0) returned 1 [0167.597] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.597] CloseHandle (hObject=0x380) returned 1 [0167.598] CloseHandle (hObject=0x390) returned 1 [0167.598] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0 [0167.598] SetEvent (hEvent=0x2fc) returned 1 [0167.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.599] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31122) returned 1 [0167.599] CloseHandle (hObject=0x390) returned 1 [0167.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0167.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0167.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.601] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7992, lpOverlapped=0x0) returned 1 [0167.603] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x79a0, lpOverlapped=0x0) returned 1 [0167.605] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.605] CloseHandle (hObject=0x390) returned 1 [0167.605] CloseHandle (hObject=0x380) returned 1 [0167.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0 [0167.605] SetEvent (hEvent=0x2fc) returned 1 [0167.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.607] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8256) returned 1 [0167.607] CloseHandle (hObject=0x380) returned 1 [0167.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0167.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0167.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.607] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.607] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.608] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2040, lpOverlapped=0x0) returned 1 [0167.800] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2050, lpOverlapped=0x0) returned 1 [0167.802] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.802] CloseHandle (hObject=0x380) returned 1 [0167.802] CloseHandle (hObject=0x390) returned 1 [0167.802] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0 [0167.802] SetEvent (hEvent=0x2fc) returned 1 [0167.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.804] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=792) returned 1 [0167.804] CloseHandle (hObject=0x390) returned 1 [0167.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0167.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0167.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.805] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.805] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.806] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x318, lpOverlapped=0x0) returned 1 [0167.810] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x320, lpOverlapped=0x0) returned 1 [0167.812] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.812] CloseHandle (hObject=0x390) returned 1 [0167.812] CloseHandle (hObject=0x380) returned 1 [0167.812] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0 [0167.812] SetEvent (hEvent=0x2fc) returned 1 [0167.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.813] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17584) returned 1 [0167.813] CloseHandle (hObject=0x380) returned 1 [0167.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0167.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0167.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.814] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.814] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.815] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x44b0, lpOverlapped=0x0) returned 1 [0167.817] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x44c0, lpOverlapped=0x0) returned 1 [0167.818] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.818] CloseHandle (hObject=0x380) returned 1 [0167.818] CloseHandle (hObject=0x390) returned 1 [0167.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0 [0167.819] SetEvent (hEvent=0x2fc) returned 1 [0167.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.820] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7828) returned 1 [0167.820] CloseHandle (hObject=0x390) returned 1 [0167.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0167.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0167.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.820] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.821] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.821] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1e94, lpOverlapped=0x0) returned 1 [0167.823] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1ea0, lpOverlapped=0x0) returned 1 [0167.824] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.824] CloseHandle (hObject=0x390) returned 1 [0167.824] CloseHandle (hObject=0x380) returned 1 [0167.824] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0 [0167.825] SetEvent (hEvent=0x2fc) returned 1 [0167.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.825] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42992) returned 1 [0167.825] CloseHandle (hObject=0x380) returned 1 [0167.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0167.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0167.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.826] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.826] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0167.827] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa7f0, lpOverlapped=0x0) returned 1 [0167.829] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa800, lpOverlapped=0x0) returned 1 [0167.831] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0167.831] CloseHandle (hObject=0x380) returned 1 [0167.831] CloseHandle (hObject=0x390) returned 1 [0167.831] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0 [0167.832] SetEvent (hEvent=0x2fc) returned 1 [0167.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.832] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42908) returned 1 [0167.832] CloseHandle (hObject=0x390) returned 1 [0167.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0167.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0167.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0167.835] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.835] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0167.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.836] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa79c, lpOverlapped=0x0) returned 1 [0167.838] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa7a0, lpOverlapped=0x0) returned 1 [0168.034] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.034] CloseHandle (hObject=0x390) returned 1 [0168.034] CloseHandle (hObject=0x380) returned 1 [0168.034] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0 [0168.034] SetEvent (hEvent=0x2fc) returned 1 [0168.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.035] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2226) returned 1 [0168.036] CloseHandle (hObject=0x380) returned 1 [0168.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0168.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0168.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.036] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.037] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0168.037] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8b2, lpOverlapped=0x0) returned 1 [0168.040] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8c0, lpOverlapped=0x0) returned 1 [0168.041] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.042] CloseHandle (hObject=0x380) returned 1 [0168.042] CloseHandle (hObject=0x390) returned 1 [0168.042] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0 [0168.042] SetEvent (hEvent=0x2fc) returned 1 [0168.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.043] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14820) returned 1 [0168.043] CloseHandle (hObject=0x390) returned 1 [0168.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0168.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0168.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.044] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.044] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0168.220] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x39e4, lpOverlapped=0x0) returned 1 [0168.238] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x39f0, lpOverlapped=0x0) returned 1 [0168.239] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.239] CloseHandle (hObject=0x390) returned 1 [0168.239] CloseHandle (hObject=0x384) returned 1 [0168.240] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0 [0168.240] SetEvent (hEvent=0x2fc) returned 1 [0168.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.241] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3692) returned 1 [0168.241] CloseHandle (hObject=0x384) returned 1 [0168.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0168.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0168.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.241] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.242] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0168.242] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe6c, lpOverlapped=0x0) returned 1 [0168.247] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe70, lpOverlapped=0x0) returned 1 [0168.248] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.249] CloseHandle (hObject=0x384) returned 1 [0168.249] CloseHandle (hObject=0x390) returned 1 [0168.249] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0 [0168.249] SetEvent (hEvent=0x2fc) returned 1 [0168.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.250] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3632) returned 1 [0168.250] CloseHandle (hObject=0x390) returned 1 [0168.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0168.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0168.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0168.250] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.251] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0168.251] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe30, lpOverlapped=0x0) returned 1 [0168.259] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe40, lpOverlapped=0x0) returned 1 [0168.260] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.260] CloseHandle (hObject=0x390) returned 1 [0168.260] CloseHandle (hObject=0x384) returned 1 [0168.260] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0 [0168.261] SetEvent (hEvent=0x2fc) returned 1 [0168.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.262] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2140) returned 1 [0168.262] CloseHandle (hObject=0x384) returned 1 [0168.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0168.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0168.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.262] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.262] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.266] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x85c, lpOverlapped=0x0) returned 1 [0168.268] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x860, lpOverlapped=0x0) returned 1 [0168.269] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.269] CloseHandle (hObject=0x384) returned 1 [0168.269] CloseHandle (hObject=0x380) returned 1 [0168.269] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0 [0168.270] SetEvent (hEvent=0x2fc) returned 1 [0168.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.270] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2796) returned 1 [0168.270] CloseHandle (hObject=0x380) returned 1 [0168.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0168.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0168.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.271] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.271] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0168.272] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xaec, lpOverlapped=0x0) returned 1 [0168.284] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xaf0, lpOverlapped=0x0) returned 1 [0168.285] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.286] CloseHandle (hObject=0x380) returned 1 [0168.286] CloseHandle (hObject=0x384) returned 1 [0168.286] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0 [0168.286] SetEvent (hEvent=0x2fc) returned 1 [0168.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.288] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2960) returned 1 [0168.288] CloseHandle (hObject=0x384) returned 1 [0168.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0168.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0168.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0168.289] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.289] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.289] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb90, lpOverlapped=0x0) returned 1 [0168.319] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xba0, lpOverlapped=0x0) returned 1 [0168.320] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.320] CloseHandle (hObject=0x384) returned 1 [0168.320] CloseHandle (hObject=0x380) returned 1 [0168.320] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0 [0168.321] SetEvent (hEvent=0x2fc) returned 1 [0168.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.321] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2960) returned 1 [0168.321] CloseHandle (hObject=0x380) returned 1 [0168.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0168.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0168.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.322] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.322] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0168.324] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb90, lpOverlapped=0x0) returned 1 [0168.328] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xba0, lpOverlapped=0x0) returned 1 [0168.450] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.450] CloseHandle (hObject=0x380) returned 1 [0168.450] CloseHandle (hObject=0x39c) returned 1 [0168.450] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0 [0168.451] SetEvent (hEvent=0x2fc) returned 1 [0168.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.451] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3588) returned 1 [0168.452] CloseHandle (hObject=0x39c) returned 1 [0168.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0168.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0168.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.452] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.452] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.454] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe04, lpOverlapped=0x0) returned 1 [0168.456] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe10, lpOverlapped=0x0) returned 1 [0168.457] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.457] CloseHandle (hObject=0x39c) returned 1 [0168.457] CloseHandle (hObject=0x380) returned 1 [0168.457] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0 [0168.457] SetEvent (hEvent=0x2fc) returned 1 [0168.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.464] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2228) returned 1 [0168.464] CloseHandle (hObject=0x368) returned 1 [0168.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0168.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0168.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.465] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.465] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0168.468] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8b4, lpOverlapped=0x0) returned 1 [0168.469] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8c0, lpOverlapped=0x0) returned 1 [0168.470] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.471] CloseHandle (hObject=0x368) returned 1 [0168.471] CloseHandle (hObject=0x360) returned 1 [0168.471] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0 [0168.471] SetEvent (hEvent=0x2fc) returned 1 [0168.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.472] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2300) returned 1 [0168.472] CloseHandle (hObject=0x360) returned 1 [0168.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0168.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0168.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.473] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.473] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0168.474] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8fc, lpOverlapped=0x0) returned 1 [0168.486] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x900, lpOverlapped=0x0) returned 1 [0168.487] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.487] CloseHandle (hObject=0x360) returned 1 [0168.487] CloseHandle (hObject=0x368) returned 1 [0168.488] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0 [0168.488] SetEvent (hEvent=0x2fc) returned 1 [0168.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.488] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2080) returned 1 [0168.492] CloseHandle (hObject=0x368) returned 1 [0168.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0168.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0168.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.492] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.493] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0168.493] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x820, lpOverlapped=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x830, lpOverlapped=0x0) returned 1 [0168.509] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.509] CloseHandle (hObject=0x368) returned 1 [0168.509] CloseHandle (hObject=0x360) returned 1 [0168.509] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0 [0168.510] SetEvent (hEvent=0x2fc) returned 1 [0168.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.511] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2080) returned 1 [0168.511] CloseHandle (hObject=0x360) returned 1 [0168.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0168.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0168.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.511] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.512] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0168.512] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x820, lpOverlapped=0x0) returned 1 [0168.516] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x830, lpOverlapped=0x0) returned 1 [0168.517] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.518] CloseHandle (hObject=0x360) returned 1 [0168.518] CloseHandle (hObject=0x368) returned 1 [0168.518] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0 [0168.518] SetEvent (hEvent=0x2fc) returned 1 [0168.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.526] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2004) returned 1 [0168.526] CloseHandle (hObject=0x368) returned 1 [0168.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0168.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0168.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.638] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.638] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.638] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7d4, lpOverlapped=0x0) returned 1 [0168.640] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7e0, lpOverlapped=0x0) returned 1 [0168.641] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.641] CloseHandle (hObject=0x368) returned 1 [0168.642] CloseHandle (hObject=0x380) returned 1 [0168.642] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0 [0168.642] SetEvent (hEvent=0x2fc) returned 1 [0168.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.645] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2232) returned 1 [0168.645] CloseHandle (hObject=0x380) returned 1 [0168.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0168.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0168.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.646] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.646] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0168.647] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8b8, lpOverlapped=0x0) returned 1 [0168.648] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8c0, lpOverlapped=0x0) returned 1 [0168.649] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.649] CloseHandle (hObject=0x380) returned 1 [0168.650] CloseHandle (hObject=0x368) returned 1 [0168.650] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0 [0168.650] SetEvent (hEvent=0x2fc) returned 1 [0168.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.652] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1804) returned 1 [0168.652] CloseHandle (hObject=0x368) returned 1 [0168.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0168.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0168.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.652] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.653] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.654] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x70c, lpOverlapped=0x0) returned 1 [0168.656] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x710, lpOverlapped=0x0) returned 1 [0168.657] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.657] CloseHandle (hObject=0x368) returned 1 [0168.657] CloseHandle (hObject=0x380) returned 1 [0168.657] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0 [0168.658] SetEvent (hEvent=0x2fc) returned 1 [0168.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.658] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1888) returned 1 [0168.658] CloseHandle (hObject=0x380) returned 1 [0168.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0168.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0168.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.659] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.659] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0168.660] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x760, lpOverlapped=0x0) returned 1 [0168.662] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x770, lpOverlapped=0x0) returned 1 [0168.663] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.663] CloseHandle (hObject=0x380) returned 1 [0168.663] CloseHandle (hObject=0x368) returned 1 [0168.664] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0 [0168.664] SetEvent (hEvent=0x2fc) returned 1 [0168.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.664] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3796) returned 1 [0168.664] CloseHandle (hObject=0x368) returned 1 [0168.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0168.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0168.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.665] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.665] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.666] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xed4, lpOverlapped=0x0) returned 1 [0168.668] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xee0, lpOverlapped=0x0) returned 1 [0168.669] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.669] CloseHandle (hObject=0x368) returned 1 [0168.669] CloseHandle (hObject=0x380) returned 1 [0168.669] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0 [0168.669] SetEvent (hEvent=0x2fc) returned 1 [0168.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.670] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2024) returned 1 [0168.670] CloseHandle (hObject=0x380) returned 1 [0168.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0168.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0168.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.671] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.671] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0168.672] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7e8, lpOverlapped=0x0) returned 1 [0168.674] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7f0, lpOverlapped=0x0) returned 1 [0168.675] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0168.675] CloseHandle (hObject=0x380) returned 1 [0168.675] CloseHandle (hObject=0x368) returned 1 [0168.675] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0 [0168.675] SetEvent (hEvent=0x2fc) returned 1 [0168.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0168.676] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2084) returned 1 [0168.677] CloseHandle (hObject=0x368) returned 1 [0168.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0168.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0168.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0168.888] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.888] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0168.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0169.097] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x824, lpOverlapped=0x0) returned 1 [0169.101] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x830, lpOverlapped=0x0) returned 1 [0169.102] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.102] CloseHandle (hObject=0x344) returned 1 [0169.112] CloseHandle (hObject=0x36c) returned 1 [0169.112] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0 [0169.113] SetEvent (hEvent=0x2fc) returned 1 [0169.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0169.113] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2996) returned 1 [0169.113] CloseHandle (hObject=0x36c) returned 1 [0169.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0169.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0169.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0169.114] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.114] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.115] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xbb4, lpOverlapped=0x0) returned 1 [0169.122] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xbc0, lpOverlapped=0x0) returned 1 [0169.126] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.126] CloseHandle (hObject=0x36c) returned 1 [0169.126] CloseHandle (hObject=0x344) returned 1 [0169.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0 [0169.127] SetEvent (hEvent=0x2fc) returned 1 [0169.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.296] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8564) returned 1 [0169.296] CloseHandle (hObject=0x368) returned 1 [0169.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0169.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0169.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.297] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.297] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.299] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2174, lpOverlapped=0x0) returned 1 [0169.301] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2180, lpOverlapped=0x0) returned 1 [0169.306] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.306] CloseHandle (hObject=0x368) returned 1 [0169.306] CloseHandle (hObject=0x338) returned 1 [0169.307] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0 [0169.307] SetEvent (hEvent=0x2fc) returned 1 [0169.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.308] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19068) returned 1 [0169.308] CloseHandle (hObject=0x338) returned 1 [0169.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0169.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0169.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.309] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.309] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.309] ReadFile (in: hFile=0x338, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4a7c, lpOverlapped=0x0) returned 1 [0169.311] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4a80, lpOverlapped=0x0) returned 1 [0169.313] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.313] CloseHandle (hObject=0x338) returned 1 [0169.313] CloseHandle (hObject=0x368) returned 1 [0169.313] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0 [0169.314] SetEvent (hEvent=0x2fc) returned 1 [0169.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.315] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=580) returned 1 [0169.315] CloseHandle (hObject=0x368) returned 1 [0169.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0169.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0169.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.317] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x244, lpOverlapped=0x0) returned 1 [0169.318] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x250, lpOverlapped=0x0) returned 1 [0169.319] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.319] CloseHandle (hObject=0x368) returned 1 [0169.319] CloseHandle (hObject=0x338) returned 1 [0169.320] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0 [0169.475] SetEvent (hEvent=0x2fc) returned 1 [0169.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.477] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13042) returned 1 [0169.477] CloseHandle (hObject=0x338) returned 1 [0169.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0169.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0169.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.477] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.478] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.481] ReadFile (in: hFile=0x338, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x32f2, lpOverlapped=0x0) returned 1 [0169.483] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3300, lpOverlapped=0x0) returned 1 [0169.484] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.484] CloseHandle (hObject=0x338) returned 1 [0169.484] CloseHandle (hObject=0x368) returned 1 [0169.484] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0 [0169.485] SetEvent (hEvent=0x2fc) returned 1 [0169.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.485] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2700) returned 1 [0169.485] CloseHandle (hObject=0x368) returned 1 [0169.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0169.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0169.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.486] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.486] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.487] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa8c, lpOverlapped=0x0) returned 1 [0169.488] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa90, lpOverlapped=0x0) returned 1 [0169.489] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.489] CloseHandle (hObject=0x368) returned 1 [0169.490] CloseHandle (hObject=0x338) returned 1 [0169.490] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0 [0169.490] SetEvent (hEvent=0x2fc) returned 1 [0169.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.491] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6958) returned 1 [0169.491] CloseHandle (hObject=0x338) returned 1 [0169.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0169.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0169.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.491] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.491] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.492] ReadFile (in: hFile=0x338, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b2e, lpOverlapped=0x0) returned 1 [0169.494] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b30, lpOverlapped=0x0) returned 1 [0169.495] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.495] CloseHandle (hObject=0x338) returned 1 [0169.495] CloseHandle (hObject=0x368) returned 1 [0169.495] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0 [0169.495] SetEvent (hEvent=0x2fc) returned 1 [0169.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.496] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13936) returned 1 [0169.497] CloseHandle (hObject=0x368) returned 1 [0169.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0169.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0169.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.497] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.497] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.498] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3670, lpOverlapped=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3680, lpOverlapped=0x0) returned 1 [0169.501] WriteFile (in: hFile=0x338, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.501] CloseHandle (hObject=0x368) returned 1 [0169.502] CloseHandle (hObject=0x338) returned 1 [0169.502] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0 [0169.502] SetEvent (hEvent=0x2fc) returned 1 [0169.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.503] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6938) returned 1 [0169.503] CloseHandle (hObject=0x338) returned 1 [0169.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0169.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0169.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.503] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.504] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.506] ReadFile (in: hFile=0x338, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b1a, lpOverlapped=0x0) returned 1 [0169.508] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b20, lpOverlapped=0x0) returned 1 [0169.509] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.509] CloseHandle (hObject=0x338) returned 1 [0169.509] CloseHandle (hObject=0x368) returned 1 [0169.509] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0 [0169.510] SetEvent (hEvent=0x2fc) returned 1 [0169.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.510] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12356) returned 1 [0169.510] CloseHandle (hObject=0x368) returned 1 [0169.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0169.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0169.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.511] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.511] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0169.665] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3044, lpOverlapped=0x0) returned 1 [0169.670] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3050, lpOverlapped=0x0) returned 1 [0169.671] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.671] CloseHandle (hObject=0x368) returned 1 [0169.671] CloseHandle (hObject=0x358) returned 1 [0169.671] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0 [0169.672] SetEvent (hEvent=0x2fc) returned 1 [0169.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0169.672] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6780) returned 1 [0169.672] CloseHandle (hObject=0x358) returned 1 [0169.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0169.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0169.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0169.673] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.673] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0169.679] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1a7c, lpOverlapped=0x0) returned 1 [0169.681] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1a80, lpOverlapped=0x0) returned 1 [0169.682] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.682] CloseHandle (hObject=0x358) returned 1 [0169.682] CloseHandle (hObject=0x394) returned 1 [0169.682] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0 [0169.683] SetEvent (hEvent=0x2fc) returned 1 [0169.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.684] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=736) returned 1 [0169.684] CloseHandle (hObject=0x394) returned 1 [0169.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0169.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0169.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.685] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.685] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0169.685] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2e0, lpOverlapped=0x0) returned 1 [0169.687] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2f0, lpOverlapped=0x0) returned 1 [0169.688] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.688] CloseHandle (hObject=0x394) returned 1 [0169.688] CloseHandle (hObject=0x358) returned 1 [0169.688] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0 [0169.688] SetEvent (hEvent=0x2fc) returned 1 [0169.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0169.689] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17308) returned 1 [0169.689] CloseHandle (hObject=0x358) returned 1 [0169.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0169.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0169.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0169.690] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.690] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0169.691] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x439c, lpOverlapped=0x0) returned 1 [0169.693] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x43a0, lpOverlapped=0x0) returned 1 [0169.694] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.695] CloseHandle (hObject=0x358) returned 1 [0169.695] CloseHandle (hObject=0x394) returned 1 [0169.695] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0 [0169.695] SetEvent (hEvent=0x2fc) returned 1 [0169.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.696] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7944) returned 1 [0169.696] CloseHandle (hObject=0x394) returned 1 [0169.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0169.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0169.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.697] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.697] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0169.697] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f08, lpOverlapped=0x0) returned 1 [0169.699] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f10, lpOverlapped=0x0) returned 1 [0169.700] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.700] CloseHandle (hObject=0x394) returned 1 [0169.701] CloseHandle (hObject=0x358) returned 1 [0169.701] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0 [0169.701] SetEvent (hEvent=0x2fc) returned 1 [0169.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0169.702] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10562) returned 1 [0169.702] CloseHandle (hObject=0x358) returned 1 [0169.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0169.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0169.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0169.702] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.703] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0169.703] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2942, lpOverlapped=0x0) returned 1 [0169.705] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2950, lpOverlapped=0x0) returned 1 [0169.706] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.706] CloseHandle (hObject=0x358) returned 1 [0169.706] CloseHandle (hObject=0x394) returned 1 [0169.706] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0 [0169.707] SetEvent (hEvent=0x2fc) returned 1 [0169.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0169.707] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4846) returned 1 [0169.707] CloseHandle (hObject=0x394) returned 1 [0169.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0169.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0169.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.964] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.964] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0169.966] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x12ee, lpOverlapped=0x0) returned 1 [0169.968] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x12f0, lpOverlapped=0x0) returned 1 [0169.969] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.969] CloseHandle (hObject=0x344) returned 1 [0169.969] CloseHandle (hObject=0x380) returned 1 [0169.969] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0 [0169.969] SetEvent (hEvent=0x2fc) returned 1 [0169.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.970] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14194) returned 1 [0169.970] CloseHandle (hObject=0x380) returned 1 [0169.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0169.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0169.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.971] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.971] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.972] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3772, lpOverlapped=0x0) returned 1 [0169.974] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3780, lpOverlapped=0x0) returned 1 [0169.975] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.975] CloseHandle (hObject=0x380) returned 1 [0169.975] CloseHandle (hObject=0x344) returned 1 [0169.975] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0 [0169.976] SetEvent (hEvent=0x2fc) returned 1 [0169.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.977] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=37390) returned 1 [0169.977] CloseHandle (hObject=0x344) returned 1 [0169.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0169.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0169.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.977] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.977] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0169.978] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x920e, lpOverlapped=0x0) returned 1 [0169.980] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9210, lpOverlapped=0x0) returned 1 [0169.983] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.983] CloseHandle (hObject=0x344) returned 1 [0169.983] CloseHandle (hObject=0x380) returned 1 [0169.983] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0 [0169.983] SetEvent (hEvent=0x2fc) returned 1 [0169.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.984] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15856) returned 1 [0169.984] CloseHandle (hObject=0x380) returned 1 [0169.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0169.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0169.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.985] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.985] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.986] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3df0, lpOverlapped=0x0) returned 1 [0169.988] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3e00, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.989] CloseHandle (hObject=0x380) returned 1 [0169.989] CloseHandle (hObject=0x344) returned 1 [0169.989] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0 [0169.990] SetEvent (hEvent=0x2fc) returned 1 [0169.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.990] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=46814) returned 1 [0169.990] CloseHandle (hObject=0x344) returned 1 [0169.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0169.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0169.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.991] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.991] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0169.992] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb6de, lpOverlapped=0x0) returned 1 [0169.994] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb6e0, lpOverlapped=0x0) returned 1 [0169.996] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0169.996] CloseHandle (hObject=0x344) returned 1 [0169.997] CloseHandle (hObject=0x380) returned 1 [0169.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0 [0169.997] SetEvent (hEvent=0x2fc) returned 1 [0169.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.998] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6068) returned 1 [0169.998] CloseHandle (hObject=0x380) returned 1 [0169.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0169.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0169.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.999] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.999] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0169.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.999] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x17b4, lpOverlapped=0x0) returned 1 [0170.004] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x17c0, lpOverlapped=0x0) returned 1 [0170.005] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.164] CloseHandle (hObject=0x380) returned 1 [0170.165] CloseHandle (hObject=0x344) returned 1 [0170.165] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0 [0170.165] SetEvent (hEvent=0x2fc) returned 1 [0170.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.166] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16396) returned 1 [0170.166] CloseHandle (hObject=0x344) returned 1 [0170.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0170.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0170.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.167] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.167] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.168] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x400c, lpOverlapped=0x0) returned 1 [0170.183] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4010, lpOverlapped=0x0) returned 1 [0170.184] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.184] CloseHandle (hObject=0x344) returned 1 [0170.184] CloseHandle (hObject=0x380) returned 1 [0170.184] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0 [0170.185] SetEvent (hEvent=0x2fc) returned 1 [0170.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.186] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4796) returned 1 [0170.186] CloseHandle (hObject=0x380) returned 1 [0170.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0170.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0170.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.187] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.187] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0170.188] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x12bc, lpOverlapped=0x0) returned 1 [0170.209] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x12c0, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.211] CloseHandle (hObject=0x380) returned 1 [0170.211] CloseHandle (hObject=0x344) returned 1 [0170.212] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0 [0170.212] SetEvent (hEvent=0x2fc) returned 1 [0170.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.364] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5098) returned 1 [0170.364] CloseHandle (hObject=0x394) returned 1 [0170.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0170.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0170.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.365] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.365] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0170.366] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x13ea, lpOverlapped=0x0) returned 1 [0170.374] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x13f0, lpOverlapped=0x0) returned 1 [0170.375] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.375] CloseHandle (hObject=0x394) returned 1 [0170.376] CloseHandle (hObject=0x358) returned 1 [0170.376] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0 [0170.376] SetEvent (hEvent=0x2fc) returned 1 [0170.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0170.376] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=896) returned 1 [0170.376] CloseHandle (hObject=0x358) returned 1 [0170.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0170.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0170.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0170.377] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.377] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.378] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x380, lpOverlapped=0x0) returned 1 [0170.383] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x390, lpOverlapped=0x0) returned 1 [0170.384] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.384] CloseHandle (hObject=0x358) returned 1 [0170.384] CloseHandle (hObject=0x394) returned 1 [0170.385] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0 [0170.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.519] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11152) returned 1 [0170.519] CloseHandle (hObject=0x344) returned 1 [0170.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0170.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0170.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.520] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.520] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0170.521] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2b90, lpOverlapped=0x0) returned 1 [0170.574] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2ba0, lpOverlapped=0x0) returned 1 [0170.575] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.576] CloseHandle (hObject=0x344) returned 1 [0170.576] CloseHandle (hObject=0x360) returned 1 [0170.687] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0 [0170.687] SetEvent (hEvent=0x2fc) returned 1 [0170.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.688] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4634) returned 1 [0170.688] CloseHandle (hObject=0x394) returned 1 [0170.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0170.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0170.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.689] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.689] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.690] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x121a, lpOverlapped=0x0) returned 1 [0170.730] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1220, lpOverlapped=0x0) returned 1 [0170.731] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.731] CloseHandle (hObject=0x394) returned 1 [0170.731] CloseHandle (hObject=0x36c) returned 1 [0170.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0 [0170.731] SetEvent (hEvent=0x2fc) returned 1 [0170.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.732] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30414) returned 1 [0170.732] CloseHandle (hObject=0x36c) returned 1 [0170.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0170.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0170.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.733] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.733] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.734] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x76ce, lpOverlapped=0x0) returned 1 [0170.749] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x76d0, lpOverlapped=0x0) returned 1 [0170.750] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.750] CloseHandle (hObject=0x36c) returned 1 [0170.751] CloseHandle (hObject=0x394) returned 1 [0170.751] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0 [0170.751] SetEvent (hEvent=0x2fc) returned 1 [0170.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.752] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17924) returned 1 [0170.752] CloseHandle (hObject=0x394) returned 1 [0170.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0170.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0170.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.752] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.752] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.753] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4604, lpOverlapped=0x0) returned 1 [0170.756] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4610, lpOverlapped=0x0) returned 1 [0170.757] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.758] CloseHandle (hObject=0x394) returned 1 [0170.758] CloseHandle (hObject=0x36c) returned 1 [0170.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0 [0170.758] SetEvent (hEvent=0x2fc) returned 1 [0170.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.760] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31180) returned 1 [0170.760] CloseHandle (hObject=0x36c) returned 1 [0170.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0170.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0170.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.761] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.761] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.762] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x79cc, lpOverlapped=0x0) returned 1 [0170.776] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x79d0, lpOverlapped=0x0) returned 1 [0170.778] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.778] CloseHandle (hObject=0x36c) returned 1 [0170.778] CloseHandle (hObject=0x394) returned 1 [0170.778] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0 [0170.778] SetEvent (hEvent=0x2fc) returned 1 [0170.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.779] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12958) returned 1 [0170.779] CloseHandle (hObject=0x394) returned 1 [0170.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0170.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0170.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.780] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.780] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.783] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x329e, lpOverlapped=0x0) returned 1 [0170.807] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x32a0, lpOverlapped=0x0) returned 1 [0170.808] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.808] CloseHandle (hObject=0x394) returned 1 [0170.808] CloseHandle (hObject=0x36c) returned 1 [0170.808] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0 [0170.809] SetEvent (hEvent=0x2fc) returned 1 [0170.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.809] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2488) returned 1 [0170.809] CloseHandle (hObject=0x36c) returned 1 [0170.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0170.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0170.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.810] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.810] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.811] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9b8, lpOverlapped=0x0) returned 1 [0170.813] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9c0, lpOverlapped=0x0) returned 1 [0170.814] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.815] CloseHandle (hObject=0x36c) returned 1 [0170.815] CloseHandle (hObject=0x394) returned 1 [0170.815] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0 [0170.815] SetEvent (hEvent=0x2fc) returned 1 [0170.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.816] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2188) returned 1 [0170.816] CloseHandle (hObject=0x394) returned 1 [0170.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0170.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0170.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.817] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.817] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.818] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x88c, lpOverlapped=0x0) returned 1 [0170.827] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x890, lpOverlapped=0x0) returned 1 [0170.828] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.828] CloseHandle (hObject=0x394) returned 1 [0170.828] CloseHandle (hObject=0x36c) returned 1 [0170.829] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0 [0170.829] SetEvent (hEvent=0x2fc) returned 1 [0170.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.829] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4396) returned 1 [0170.829] CloseHandle (hObject=0x36c) returned 1 [0170.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0170.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0170.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.830] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.830] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.831] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x112c, lpOverlapped=0x0) returned 1 [0170.832] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1130, lpOverlapped=0x0) returned 1 [0170.833] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.834] CloseHandle (hObject=0x36c) returned 1 [0170.834] CloseHandle (hObject=0x394) returned 1 [0170.834] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0 [0170.834] SetEvent (hEvent=0x2fc) returned 1 [0170.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.835] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3696) returned 1 [0170.835] CloseHandle (hObject=0x394) returned 1 [0170.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0170.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0170.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.836] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.836] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.837] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe70, lpOverlapped=0x0) returned 1 [0170.838] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe80, lpOverlapped=0x0) returned 1 [0170.839] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.840] CloseHandle (hObject=0x394) returned 1 [0170.840] CloseHandle (hObject=0x36c) returned 1 [0170.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0 [0170.840] SetEvent (hEvent=0x2fc) returned 1 [0170.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.841] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1564) returned 1 [0170.841] CloseHandle (hObject=0x36c) returned 1 [0170.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0170.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0170.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.841] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.841] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.843] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x61c, lpOverlapped=0x0) returned 1 [0170.844] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x620, lpOverlapped=0x0) returned 1 [0170.846] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.846] CloseHandle (hObject=0x36c) returned 1 [0170.848] CloseHandle (hObject=0x394) returned 1 [0170.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0 [0170.849] SetEvent (hEvent=0x2fc) returned 1 [0170.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.849] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4660) returned 1 [0170.849] CloseHandle (hObject=0x394) returned 1 [0170.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0170.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0170.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.850] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.850] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.851] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1234, lpOverlapped=0x0) returned 1 [0170.852] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1240, lpOverlapped=0x0) returned 1 [0170.978] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0170.978] CloseHandle (hObject=0x394) returned 1 [0170.981] CloseHandle (hObject=0x36c) returned 1 [0170.981] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0 [0170.981] SetEvent (hEvent=0x2fc) returned 1 [0170.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.983] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2636) returned 1 [0170.983] CloseHandle (hObject=0x36c) returned 1 [0170.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0170.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0170.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.984] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.984] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0170.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.984] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa4c, lpOverlapped=0x0) returned 1 [0171.009] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa50, lpOverlapped=0x0) returned 1 [0171.010] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.010] CloseHandle (hObject=0x36c) returned 1 [0171.010] CloseHandle (hObject=0x394) returned 1 [0171.010] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0 [0171.010] SetEvent (hEvent=0x2fc) returned 1 [0171.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.011] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5392) returned 1 [0171.011] CloseHandle (hObject=0x394) returned 1 [0171.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0171.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0171.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.012] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.012] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0171.017] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1510, lpOverlapped=0x0) returned 1 [0171.026] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1520, lpOverlapped=0x0) returned 1 [0171.027] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.027] CloseHandle (hObject=0x394) returned 1 [0171.027] CloseHandle (hObject=0x380) returned 1 [0171.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0 [0171.027] SetEvent (hEvent=0x2fc) returned 1 [0171.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.028] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3128) returned 1 [0171.028] CloseHandle (hObject=0x380) returned 1 [0171.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0171.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0171.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.029] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.029] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0171.030] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc38, lpOverlapped=0x0) returned 1 [0171.031] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc40, lpOverlapped=0x0) returned 1 [0171.032] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.032] CloseHandle (hObject=0x380) returned 1 [0171.032] CloseHandle (hObject=0x394) returned 1 [0171.032] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0 [0171.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.034] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12981) returned 1 [0171.034] CloseHandle (hObject=0x394) returned 1 [0171.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0171.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0171.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.034] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.034] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0171.035] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x32b5, lpOverlapped=0x0) returned 1 [0171.038] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x32c0, lpOverlapped=0x0) returned 1 [0171.039] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.039] CloseHandle (hObject=0x394) returned 1 [0171.039] CloseHandle (hObject=0x380) returned 1 [0171.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0 [0171.040] SetEvent (hEvent=0x2fc) returned 1 [0171.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.040] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9318) returned 1 [0171.040] CloseHandle (hObject=0x380) returned 1 [0171.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0171.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0171.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.041] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.041] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0171.042] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2466, lpOverlapped=0x0) returned 1 [0171.047] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2470, lpOverlapped=0x0) returned 1 [0171.048] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.048] CloseHandle (hObject=0x380) returned 1 [0171.048] CloseHandle (hObject=0x394) returned 1 [0171.048] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0 [0171.048] SetEvent (hEvent=0x2fc) returned 1 [0171.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.050] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2070) returned 1 [0171.050] CloseHandle (hObject=0x394) returned 1 [0171.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0171.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0171.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.051] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.051] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0171.052] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x816, lpOverlapped=0x0) returned 1 [0171.054] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x820, lpOverlapped=0x0) returned 1 [0171.055] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.055] CloseHandle (hObject=0x394) returned 1 [0171.055] CloseHandle (hObject=0x380) returned 1 [0171.055] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0 [0171.056] SetEvent (hEvent=0x2fc) returned 1 [0171.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.057] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7567) returned 1 [0171.057] CloseHandle (hObject=0x380) returned 1 [0171.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0171.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0171.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.057] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.058] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0171.058] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1d8f, lpOverlapped=0x0) returned 1 [0171.060] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1d90, lpOverlapped=0x0) returned 1 [0171.061] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.061] CloseHandle (hObject=0x380) returned 1 [0171.062] CloseHandle (hObject=0x394) returned 1 [0171.062] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0 [0171.062] SetEvent (hEvent=0x2fc) returned 1 [0171.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.062] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6331) returned 1 [0171.185] CloseHandle (hObject=0x394) returned 1 [0171.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0171.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0171.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0171.186] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.186] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.187] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x18bb, lpOverlapped=0x0) returned 1 [0171.198] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x18c0, lpOverlapped=0x0) returned 1 [0171.199] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.199] CloseHandle (hObject=0x394) returned 1 [0171.199] CloseHandle (hObject=0x36c) returned 1 [0171.199] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0 [0171.200] SetEvent (hEvent=0x2fc) returned 1 [0171.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.200] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3764) returned 1 [0171.200] CloseHandle (hObject=0x36c) returned 1 [0171.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0171.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0171.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.201] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.201] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0171.208] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xeb4, lpOverlapped=0x0) returned 1 [0171.210] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xec0, lpOverlapped=0x0) returned 1 [0171.218] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.218] CloseHandle (hObject=0x36c) returned 1 [0171.218] CloseHandle (hObject=0x364) returned 1 [0171.218] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0 [0171.219] SetEvent (hEvent=0x2fc) returned 1 [0171.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.220] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2232) returned 1 [0171.220] CloseHandle (hObject=0x364) returned 1 [0171.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0171.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0171.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.221] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.221] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.240] ReadFile (in: hFile=0x364, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8b8, lpOverlapped=0x0) returned 1 [0171.244] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8c0, lpOverlapped=0x0) returned 1 [0171.245] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.245] CloseHandle (hObject=0x364) returned 1 [0171.246] CloseHandle (hObject=0x36c) returned 1 [0171.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0 [0171.246] SetEvent (hEvent=0x2fc) returned 1 [0171.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.248] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1026) returned 1 [0171.248] CloseHandle (hObject=0x36c) returned 1 [0171.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0171.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0171.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.255] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.255] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0171.256] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x402, lpOverlapped=0x0) returned 1 [0171.258] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x410, lpOverlapped=0x0) returned 1 [0171.259] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.259] CloseHandle (hObject=0x36c) returned 1 [0171.259] CloseHandle (hObject=0x364) returned 1 [0171.259] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0 [0171.259] SetEvent (hEvent=0x2fc) returned 1 [0171.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.260] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3286) returned 1 [0171.260] CloseHandle (hObject=0x364) returned 1 [0171.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0171.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0171.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.261] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.261] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.261] ReadFile (in: hFile=0x364, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xcd6, lpOverlapped=0x0) returned 1 [0171.263] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xce0, lpOverlapped=0x0) returned 1 [0171.265] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.265] CloseHandle (hObject=0x364) returned 1 [0171.265] CloseHandle (hObject=0x36c) returned 1 [0171.265] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0 [0171.265] SetEvent (hEvent=0x2fc) returned 1 [0171.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.435] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1960) returned 1 [0171.435] CloseHandle (hObject=0x36c) returned 1 [0171.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0171.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0171.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.436] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.436] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0171.437] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7a8, lpOverlapped=0x0) returned 1 [0171.439] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7b0, lpOverlapped=0x0) returned 1 [0171.440] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.440] CloseHandle (hObject=0x36c) returned 1 [0171.440] CloseHandle (hObject=0x364) returned 1 [0171.440] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0 [0171.440] SetEvent (hEvent=0x2fc) returned 1 [0171.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.441] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=818) returned 1 [0171.441] CloseHandle (hObject=0x364) returned 1 [0171.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0171.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0171.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.442] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.442] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.443] ReadFile (in: hFile=0x364, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x332, lpOverlapped=0x0) returned 1 [0171.445] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x340, lpOverlapped=0x0) returned 1 [0171.446] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.446] CloseHandle (hObject=0x364) returned 1 [0171.446] CloseHandle (hObject=0x36c) returned 1 [0171.446] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0 [0171.446] SetEvent (hEvent=0x2fc) returned 1 [0171.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.447] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14688) returned 1 [0171.447] CloseHandle (hObject=0x36c) returned 1 [0171.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0171.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0171.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.448] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.448] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0171.449] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3960, lpOverlapped=0x0) returned 1 [0171.450] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3970, lpOverlapped=0x0) returned 1 [0171.452] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.452] CloseHandle (hObject=0x36c) returned 1 [0171.452] CloseHandle (hObject=0x364) returned 1 [0171.452] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0 [0171.453] SetEvent (hEvent=0x2fc) returned 1 [0171.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.454] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13538) returned 1 [0171.454] CloseHandle (hObject=0x364) returned 1 [0171.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0171.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0171.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.454] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.454] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.455] ReadFile (in: hFile=0x364, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x34e2, lpOverlapped=0x0) returned 1 [0171.457] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x34f0, lpOverlapped=0x0) returned 1 [0171.458] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.458] CloseHandle (hObject=0x364) returned 1 [0171.458] CloseHandle (hObject=0x36c) returned 1 [0171.458] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0 [0171.459] SetEvent (hEvent=0x2fc) returned 1 [0171.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.459] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5798) returned 1 [0171.459] CloseHandle (hObject=0x36c) returned 1 [0171.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0171.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0171.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.460] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.460] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0171.461] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16a6, lpOverlapped=0x0) returned 1 [0171.463] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16b0, lpOverlapped=0x0) returned 1 [0171.464] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.464] CloseHandle (hObject=0x36c) returned 1 [0171.464] CloseHandle (hObject=0x364) returned 1 [0171.464] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0 [0171.465] SetEvent (hEvent=0x2fc) returned 1 [0171.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.465] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3718) returned 1 [0171.465] CloseHandle (hObject=0x364) returned 1 [0171.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0171.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0171.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0171.466] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.466] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.467] ReadFile (in: hFile=0x364, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe86, lpOverlapped=0x0) returned 1 [0171.469] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe90, lpOverlapped=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.470] CloseHandle (hObject=0x364) returned 1 [0171.630] CloseHandle (hObject=0x36c) returned 1 [0171.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0 [0171.779] SetEvent (hEvent=0x2fc) returned 1 [0171.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.924] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9300) returned 1 [0171.924] CloseHandle (hObject=0x36c) returned 1 [0171.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0171.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0171.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.925] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.925] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0171.926] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2454, lpOverlapped=0x0) returned 1 [0171.928] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2460, lpOverlapped=0x0) returned 1 [0171.929] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.929] CloseHandle (hObject=0x36c) returned 1 [0171.929] CloseHandle (hObject=0x344) returned 1 [0171.930] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0 [0171.930] SetEvent (hEvent=0x2fc) returned 1 [0171.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.931] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1148) returned 1 [0171.931] CloseHandle (hObject=0x344) returned 1 [0171.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0171.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0171.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.931] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.931] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.932] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x47c, lpOverlapped=0x0) returned 1 [0171.934] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x480, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.935] CloseHandle (hObject=0x344) returned 1 [0171.935] CloseHandle (hObject=0x36c) returned 1 [0171.935] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0 [0171.936] SetEvent (hEvent=0x2fc) returned 1 [0171.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.937] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2756) returned 1 [0171.937] CloseHandle (hObject=0x36c) returned 1 [0171.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0171.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0171.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.938] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.938] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0171.939] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xac4, lpOverlapped=0x0) returned 1 [0171.941] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xad0, lpOverlapped=0x0) returned 1 [0171.942] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.942] CloseHandle (hObject=0x36c) returned 1 [0171.943] CloseHandle (hObject=0x344) returned 1 [0171.943] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0 [0171.943] SetEvent (hEvent=0x2fc) returned 1 [0171.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.944] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1268) returned 1 [0171.944] CloseHandle (hObject=0x344) returned 1 [0171.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0171.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0171.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.945] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.945] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.946] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4f4, lpOverlapped=0x0) returned 1 [0171.947] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x500, lpOverlapped=0x0) returned 1 [0171.948] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.949] CloseHandle (hObject=0x344) returned 1 [0171.949] CloseHandle (hObject=0x36c) returned 1 [0171.949] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0 [0171.949] SetEvent (hEvent=0x2fc) returned 1 [0171.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.950] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5000) returned 1 [0171.950] CloseHandle (hObject=0x36c) returned 1 [0171.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0171.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0171.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.951] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0171.952] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1388, lpOverlapped=0x0) returned 1 [0171.957] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1390, lpOverlapped=0x0) returned 1 [0171.958] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0171.958] CloseHandle (hObject=0x36c) returned 1 [0171.958] CloseHandle (hObject=0x344) returned 1 [0171.958] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0 [0171.959] SetEvent (hEvent=0x2fc) returned 1 [0171.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.960] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7340) returned 1 [0171.960] CloseHandle (hObject=0x344) returned 1 [0171.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0171.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0171.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.961] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.961] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0171.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.962] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1cac, lpOverlapped=0x0) returned 1 [0171.963] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1cb0, lpOverlapped=0x0) returned 1 [0172.002] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.002] CloseHandle (hObject=0x344) returned 1 [0172.002] CloseHandle (hObject=0x36c) returned 1 [0172.002] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0 [0172.002] SetEvent (hEvent=0x2fc) returned 1 [0172.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.003] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26706) returned 1 [0172.003] CloseHandle (hObject=0x36c) returned 1 [0172.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0172.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0172.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.004] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.004] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0172.005] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6852, lpOverlapped=0x0) returned 1 [0172.007] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6860, lpOverlapped=0x0) returned 1 [0172.009] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.009] CloseHandle (hObject=0x36c) returned 1 [0172.009] CloseHandle (hObject=0x344) returned 1 [0172.009] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0 [0172.009] SetEvent (hEvent=0x2fc) returned 1 [0172.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.010] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2704) returned 1 [0172.010] CloseHandle (hObject=0x344) returned 1 [0172.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0172.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0172.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.011] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.011] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0172.011] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa90, lpOverlapped=0x0) returned 1 [0172.013] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xaa0, lpOverlapped=0x0) returned 1 [0172.014] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.014] CloseHandle (hObject=0x344) returned 1 [0172.014] CloseHandle (hObject=0x36c) returned 1 [0172.015] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0 [0172.015] SetEvent (hEvent=0x2fc) returned 1 [0172.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.016] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1324) returned 1 [0172.016] CloseHandle (hObject=0x36c) returned 1 [0172.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0172.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0172.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.017] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.017] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0172.026] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x52c, lpOverlapped=0x0) returned 1 [0172.028] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x530, lpOverlapped=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.030] CloseHandle (hObject=0x36c) returned 1 [0172.030] CloseHandle (hObject=0x344) returned 1 [0172.030] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0 [0172.030] SetEvent (hEvent=0x2fc) returned 1 [0172.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.031] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7932) returned 1 [0172.031] CloseHandle (hObject=0x344) returned 1 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0172.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.032] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0172.032] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1efc, lpOverlapped=0x0) returned 1 [0172.034] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f00, lpOverlapped=0x0) returned 1 [0172.036] WriteFile (in: hFile=0x36c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.036] CloseHandle (hObject=0x344) returned 1 [0172.036] CloseHandle (hObject=0x36c) returned 1 [0172.041] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0 [0172.782] SetEvent (hEvent=0x2fc) returned 1 [0172.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.783] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2832) returned 1 [0172.783] CloseHandle (hObject=0x344) returned 1 [0172.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0172.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0172.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.784] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.784] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0172.786] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb10, lpOverlapped=0x0) returned 1 [0172.789] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb20, lpOverlapped=0x0) returned 1 [0172.790] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.790] CloseHandle (hObject=0x344) returned 1 [0172.790] CloseHandle (hObject=0x39c) returned 1 [0172.790] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0 [0172.791] SetEvent (hEvent=0x2fc) returned 1 [0172.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.791] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=68776) returned 1 [0172.791] CloseHandle (hObject=0x39c) returned 1 [0172.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0172.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0172.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.792] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.792] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0172.793] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x10ca8, lpOverlapped=0x0) returned 1 [0172.803] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x10cb0, lpOverlapped=0x0) returned 1 [0172.805] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.805] CloseHandle (hObject=0x39c) returned 1 [0172.805] CloseHandle (hObject=0x344) returned 1 [0172.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0 [0172.806] SetEvent (hEvent=0x2fc) returned 1 [0172.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.809] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1158) returned 1 [0172.809] CloseHandle (hObject=0x360) returned 1 [0172.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0172.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0172.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.810] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.810] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0172.812] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x486, lpOverlapped=0x0) returned 1 [0172.815] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x490, lpOverlapped=0x0) returned 1 [0172.816] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.816] CloseHandle (hObject=0x360) returned 1 [0172.817] CloseHandle (hObject=0x358) returned 1 [0172.817] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0 [0172.817] SetEvent (hEvent=0x2fc) returned 1 [0172.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0172.818] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1074) returned 1 [0172.818] CloseHandle (hObject=0x358) returned 1 [0172.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0172.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0172.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0172.819] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.819] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0172.820] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x432, lpOverlapped=0x0) returned 1 [0172.822] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x440, lpOverlapped=0x0) returned 1 [0172.823] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.823] CloseHandle (hObject=0x358) returned 1 [0172.823] CloseHandle (hObject=0x360) returned 1 [0172.824] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0 [0172.824] SetEvent (hEvent=0x2fc) returned 1 [0172.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.825] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1848) returned 1 [0172.825] CloseHandle (hObject=0x360) returned 1 [0172.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0172.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0172.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.826] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.826] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0172.827] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x738, lpOverlapped=0x0) returned 1 [0172.830] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x740, lpOverlapped=0x0) returned 1 [0172.831] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0172.831] CloseHandle (hObject=0x360) returned 1 [0172.831] CloseHandle (hObject=0x358) returned 1 [0172.831] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0 [0172.832] SetEvent (hEvent=0x2fc) returned 1 [0172.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0172.833] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11190) returned 1 [0172.833] CloseHandle (hObject=0x358) returned 1 [0172.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0172.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0172.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0172.834] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.834] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0172.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0172.836] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2bb6, lpOverlapped=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2bc0, lpOverlapped=0x0) returned 1 [0173.015] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.015] CloseHandle (hObject=0x358) returned 1 [0173.021] CloseHandle (hObject=0x360) returned 1 [0173.022] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0 [0173.022] SetEvent (hEvent=0x2fc) returned 1 [0173.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.023] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1256) returned 1 [0173.023] CloseHandle (hObject=0x360) returned 1 [0173.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0173.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0173.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.024] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.024] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0173.024] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4e8, lpOverlapped=0x0) returned 1 [0173.032] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f0, lpOverlapped=0x0) returned 1 [0173.033] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.033] CloseHandle (hObject=0x360) returned 1 [0173.034] CloseHandle (hObject=0x358) returned 1 [0173.034] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0 [0173.034] SetEvent (hEvent=0x2fc) returned 1 [0173.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0173.035] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2944) returned 1 [0173.035] CloseHandle (hObject=0x358) returned 1 [0173.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0173.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0173.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0173.036] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.036] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.038] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb80, lpOverlapped=0x0) returned 1 [0173.042] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb90, lpOverlapped=0x0) returned 1 [0173.043] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.043] CloseHandle (hObject=0x358) returned 1 [0173.044] CloseHandle (hObject=0x394) returned 1 [0173.044] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0 [0173.044] SetEvent (hEvent=0x2fc) returned 1 [0173.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.045] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8568) returned 1 [0173.045] CloseHandle (hObject=0x394) returned 1 [0173.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0173.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0173.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.046] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.046] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0173.047] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2178, lpOverlapped=0x0) returned 1 [0173.049] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2180, lpOverlapped=0x0) returned 1 [0173.051] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.051] CloseHandle (hObject=0x394) returned 1 [0173.051] CloseHandle (hObject=0x358) returned 1 [0173.051] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0 [0173.051] SetEvent (hEvent=0x2fc) returned 1 [0173.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0173.052] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1220) returned 1 [0173.052] CloseHandle (hObject=0x358) returned 1 [0173.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0173.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0173.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0173.053] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.053] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.054] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4c4, lpOverlapped=0x0) returned 1 [0173.056] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4d0, lpOverlapped=0x0) returned 1 [0173.058] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.058] CloseHandle (hObject=0x358) returned 1 [0173.058] CloseHandle (hObject=0x394) returned 1 [0173.058] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0 [0173.059] SetEvent (hEvent=0x2fc) returned 1 [0173.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.063] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9734) returned 1 [0173.063] CloseHandle (hObject=0x394) returned 1 [0173.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0173.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0173.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.064] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.064] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0173.065] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2606, lpOverlapped=0x0) returned 1 [0173.067] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2610, lpOverlapped=0x0) returned 1 [0173.068] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.068] CloseHandle (hObject=0x394) returned 1 [0173.069] CloseHandle (hObject=0x358) returned 1 [0173.069] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0 [0173.069] SetEvent (hEvent=0x2fc) returned 1 [0173.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0173.070] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9596) returned 1 [0173.070] CloseHandle (hObject=0x358) returned 1 [0173.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0173.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0173.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0173.072] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.072] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.074] ReadFile (in: hFile=0x358, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x257c, lpOverlapped=0x0) returned 1 [0173.076] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2580, lpOverlapped=0x0) returned 1 [0173.199] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.199] CloseHandle (hObject=0x358) returned 1 [0173.200] CloseHandle (hObject=0x394) returned 1 [0173.293] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0 [0173.473] SetEvent (hEvent=0x2fc) returned 1 [0173.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0173.475] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15680) returned 1 [0173.475] CloseHandle (hObject=0x39c) returned 1 [0173.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0173.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0173.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0173.476] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.476] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0173.476] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3d40, lpOverlapped=0x0) returned 1 [0173.479] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3d50, lpOverlapped=0x0) returned 1 [0173.480] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.480] CloseHandle (hObject=0x39c) returned 1 [0173.480] CloseHandle (hObject=0x360) returned 1 [0173.480] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0 [0173.481] SetEvent (hEvent=0x2fc) returned 1 [0173.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.481] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21268) returned 1 [0173.481] CloseHandle (hObject=0x360) returned 1 [0173.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0173.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0173.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.482] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.482] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0173.483] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5314, lpOverlapped=0x0) returned 1 [0173.486] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5320, lpOverlapped=0x0) returned 1 [0173.487] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.487] CloseHandle (hObject=0x360) returned 1 [0173.487] CloseHandle (hObject=0x39c) returned 1 [0173.487] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0 [0173.522] SetEvent (hEvent=0x2fc) returned 1 [0173.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0173.524] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=46936) returned 1 [0173.524] CloseHandle (hObject=0x39c) returned 1 [0173.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0173.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0173.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0173.525] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.525] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0173.526] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb758, lpOverlapped=0x0) returned 1 [0173.530] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb760, lpOverlapped=0x0) returned 1 [0173.532] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.532] CloseHandle (hObject=0x39c) returned 1 [0173.532] CloseHandle (hObject=0x360) returned 1 [0173.532] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0 [0173.533] SetEvent (hEvent=0x2fc) returned 1 [0173.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.533] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15760) returned 1 [0173.533] CloseHandle (hObject=0x360) returned 1 [0173.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0173.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0173.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.534] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.534] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0173.535] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3d90, lpOverlapped=0x0) returned 1 [0173.537] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3da0, lpOverlapped=0x0) returned 1 [0173.538] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.539] CloseHandle (hObject=0x360) returned 1 [0173.539] CloseHandle (hObject=0x39c) returned 1 [0173.539] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0 [0173.539] SetEvent (hEvent=0x2fc) returned 1 [0173.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0173.540] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=28212) returned 1 [0173.540] CloseHandle (hObject=0x39c) returned 1 [0173.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0173.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0173.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0173.541] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.541] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0173.542] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6e34, lpOverlapped=0x0) returned 1 [0173.543] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6e40, lpOverlapped=0x0) returned 1 [0173.545] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.545] CloseHandle (hObject=0x39c) returned 1 [0173.545] CloseHandle (hObject=0x360) returned 1 [0173.545] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0 [0173.545] SetEvent (hEvent=0x2fc) returned 1 [0173.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.546] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17638) returned 1 [0173.546] CloseHandle (hObject=0x360) returned 1 [0173.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0173.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0173.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.741] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.741] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0173.742] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x44e6, lpOverlapped=0x0) returned 1 [0173.744] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x44f0, lpOverlapped=0x0) returned 1 [0173.746] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.747] CloseHandle (hObject=0x360) returned 1 [0173.747] CloseHandle (hObject=0x25c) returned 1 [0173.747] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0 [0173.747] SetEvent (hEvent=0x2fc) returned 1 [0173.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.748] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4970) returned 1 [0173.749] CloseHandle (hObject=0x25c) returned 1 [0173.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0173.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0173.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.749] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.749] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0173.750] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x136a, lpOverlapped=0x0) returned 1 [0173.752] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1370, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.753] CloseHandle (hObject=0x25c) returned 1 [0173.754] CloseHandle (hObject=0x360) returned 1 [0173.754] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0 [0173.754] SetEvent (hEvent=0x2fc) returned 1 [0173.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.755] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=24759) returned 1 [0173.755] CloseHandle (hObject=0x360) returned 1 [0173.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0173.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0173.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.756] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.756] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0173.757] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x60b7, lpOverlapped=0x0) returned 1 [0173.759] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x60c0, lpOverlapped=0x0) returned 1 [0173.760] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.760] CloseHandle (hObject=0x360) returned 1 [0173.761] CloseHandle (hObject=0x25c) returned 1 [0173.761] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0 [0173.761] SetEvent (hEvent=0x2fc) returned 1 [0173.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.762] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16596) returned 1 [0173.762] CloseHandle (hObject=0x25c) returned 1 [0173.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0173.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0173.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.762] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.762] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0173.764] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x40d4, lpOverlapped=0x0) returned 1 [0173.766] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x40e0, lpOverlapped=0x0) returned 1 [0173.767] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.767] CloseHandle (hObject=0x25c) returned 1 [0173.767] CloseHandle (hObject=0x360) returned 1 [0173.768] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0 [0173.768] SetEvent (hEvent=0x2fc) returned 1 [0173.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.769] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=24377) returned 1 [0173.769] CloseHandle (hObject=0x360) returned 1 [0173.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0173.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0173.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0173.770] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.770] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0173.771] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5f39, lpOverlapped=0x0) returned 1 [0173.773] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5f40, lpOverlapped=0x0) returned 1 [0173.775] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0173.775] CloseHandle (hObject=0x360) returned 1 [0173.775] CloseHandle (hObject=0x25c) returned 1 [0173.775] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0 [0173.776] SetEvent (hEvent=0x2fc) returned 1 [0173.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.776] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18258) returned 1 [0173.776] CloseHandle (hObject=0x25c) returned 1 [0173.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0173.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0173.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.777] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0173.778] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4752, lpOverlapped=0x0) returned 1 [0174.021] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4760, lpOverlapped=0x0) returned 1 [0174.022] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.022] CloseHandle (hObject=0x25c) returned 1 [0174.022] CloseHandle (hObject=0x360) returned 1 [0174.023] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0 [0174.023] SetEvent (hEvent=0x2fc) returned 1 [0174.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.024] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6929) returned 1 [0174.024] CloseHandle (hObject=0x360) returned 1 [0174.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0174.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0174.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.025] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.025] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.033] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b11, lpOverlapped=0x0) returned 1 [0174.132] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b20, lpOverlapped=0x0) returned 1 [0174.133] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.133] CloseHandle (hObject=0x360) returned 1 [0174.133] CloseHandle (hObject=0x394) returned 1 [0174.133] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0 [0174.133] SetEvent (hEvent=0x2fc) returned 1 [0174.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.134] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13954) returned 1 [0174.134] CloseHandle (hObject=0x394) returned 1 [0174.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0174.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0174.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.135] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.135] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0174.136] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3682, lpOverlapped=0x0) returned 1 [0174.180] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3690, lpOverlapped=0x0) returned 1 [0174.181] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.181] CloseHandle (hObject=0x394) returned 1 [0174.181] CloseHandle (hObject=0x360) returned 1 [0174.187] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0 [0174.187] SetEvent (hEvent=0x2fc) returned 1 [0174.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.338] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=27546) returned 1 [0174.339] CloseHandle (hObject=0x368) returned 1 [0174.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0174.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0174.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.340] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.340] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0174.341] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6b9a, lpOverlapped=0x0) returned 1 [0174.343] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6ba0, lpOverlapped=0x0) returned 1 [0174.345] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.345] CloseHandle (hObject=0x368) returned 1 [0174.345] CloseHandle (hObject=0x360) returned 1 [0174.345] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0 [0174.345] SetEvent (hEvent=0x2fc) returned 1 [0174.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.347] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=50490) returned 1 [0174.347] CloseHandle (hObject=0x360) returned 1 [0174.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0174.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0174.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.347] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.348] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.348] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc53a, lpOverlapped=0x0) returned 1 [0174.351] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc540, lpOverlapped=0x0) returned 1 [0174.353] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.353] CloseHandle (hObject=0x360) returned 1 [0174.353] CloseHandle (hObject=0x368) returned 1 [0174.353] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0 [0174.354] SetEvent (hEvent=0x2fc) returned 1 [0174.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.354] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=64767) returned 1 [0174.354] CloseHandle (hObject=0x368) returned 1 [0174.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0174.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0174.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.355] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.355] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0174.357] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xfcff, lpOverlapped=0x0) returned 1 [0174.360] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xfd00, lpOverlapped=0x0) returned 1 [0174.362] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.362] CloseHandle (hObject=0x368) returned 1 [0174.363] CloseHandle (hObject=0x360) returned 1 [0174.363] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0 [0174.363] SetEvent (hEvent=0x2fc) returned 1 [0174.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.364] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=43949) returned 1 [0174.364] CloseHandle (hObject=0x360) returned 1 [0174.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0174.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0174.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.365] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.365] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.366] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xabad, lpOverlapped=0x0) returned 1 [0174.368] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xabb0, lpOverlapped=0x0) returned 1 [0174.370] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.370] CloseHandle (hObject=0x360) returned 1 [0174.370] CloseHandle (hObject=0x368) returned 1 [0174.370] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0 [0174.371] SetEvent (hEvent=0x2fc) returned 1 [0174.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.371] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20179) returned 1 [0174.372] CloseHandle (hObject=0x368) returned 1 [0174.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0174.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0174.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.372] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.569] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.572] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4ed3, lpOverlapped=0x0) returned 1 [0174.577] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4ee0, lpOverlapped=0x0) returned 1 [0174.578] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.579] CloseHandle (hObject=0x368) returned 1 [0174.579] CloseHandle (hObject=0x394) returned 1 [0174.579] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0 [0174.579] SetEvent (hEvent=0x2fc) returned 1 [0174.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.581] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9744) returned 1 [0174.581] CloseHandle (hObject=0x394) returned 1 [0174.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0174.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0174.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.582] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.582] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.583] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2610, lpOverlapped=0x0) returned 1 [0174.585] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2620, lpOverlapped=0x0) returned 1 [0174.586] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.586] CloseHandle (hObject=0x394) returned 1 [0174.587] CloseHandle (hObject=0x368) returned 1 [0174.587] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0 [0174.587] SetEvent (hEvent=0x2fc) returned 1 [0174.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.588] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2488) returned 1 [0174.588] CloseHandle (hObject=0x368) returned 1 [0174.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0174.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0174.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.590] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9b8, lpOverlapped=0x0) returned 1 [0174.591] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9c0, lpOverlapped=0x0) returned 1 [0174.593] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.593] CloseHandle (hObject=0x368) returned 1 [0174.593] CloseHandle (hObject=0x394) returned 1 [0174.593] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0 [0174.593] SetEvent (hEvent=0x2fc) returned 1 [0174.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.594] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5386) returned 1 [0174.594] CloseHandle (hObject=0x394) returned 1 [0174.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0174.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0174.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.595] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.595] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.596] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x150a, lpOverlapped=0x0) returned 1 [0174.628] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1510, lpOverlapped=0x0) returned 1 [0174.630] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.630] CloseHandle (hObject=0x394) returned 1 [0174.630] CloseHandle (hObject=0x368) returned 1 [0174.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0 [0174.630] SetEvent (hEvent=0x2fc) returned 1 [0174.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.631] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3606) returned 1 [0174.631] CloseHandle (hObject=0x368) returned 1 [0174.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0174.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0174.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.632] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.632] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.634] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe16, lpOverlapped=0x0) returned 1 [0174.635] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe20, lpOverlapped=0x0) returned 1 [0174.636] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.636] CloseHandle (hObject=0x368) returned 1 [0174.636] CloseHandle (hObject=0x394) returned 1 [0174.636] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0 [0174.637] SetEvent (hEvent=0x2fc) returned 1 [0174.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.638] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9154) returned 1 [0174.638] CloseHandle (hObject=0x394) returned 1 [0174.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0174.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0174.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.639] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.639] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.640] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x23c2, lpOverlapped=0x0) returned 1 [0174.641] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x23d0, lpOverlapped=0x0) returned 1 [0174.862] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.862] CloseHandle (hObject=0x394) returned 1 [0174.862] CloseHandle (hObject=0x368) returned 1 [0174.863] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0 [0174.863] SetEvent (hEvent=0x2fc) returned 1 [0174.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.865] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3282) returned 1 [0174.865] CloseHandle (hObject=0x368) returned 1 [0174.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0174.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0174.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.868] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.868] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.869] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xcd2, lpOverlapped=0x0) returned 1 [0174.871] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xce0, lpOverlapped=0x0) returned 1 [0174.872] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.872] CloseHandle (hObject=0x368) returned 1 [0174.873] CloseHandle (hObject=0x394) returned 1 [0174.873] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0 [0174.873] SetEvent (hEvent=0x2fc) returned 1 [0174.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.874] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16738) returned 1 [0174.874] CloseHandle (hObject=0x394) returned 1 [0174.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0174.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0174.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.875] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.875] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.876] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4162, lpOverlapped=0x0) returned 1 [0174.878] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4170, lpOverlapped=0x0) returned 1 [0174.879] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.879] CloseHandle (hObject=0x394) returned 1 [0174.879] CloseHandle (hObject=0x368) returned 1 [0174.879] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0 [0174.880] SetEvent (hEvent=0x2fc) returned 1 [0174.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.881] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=24528) returned 1 [0174.881] CloseHandle (hObject=0x368) returned 1 [0174.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0174.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0174.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.882] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.882] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.883] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5fd0, lpOverlapped=0x0) returned 1 [0174.885] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5fe0, lpOverlapped=0x0) returned 1 [0174.886] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0174.887] CloseHandle (hObject=0x368) returned 1 [0174.887] CloseHandle (hObject=0x394) returned 1 [0174.887] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0 [0174.887] SetEvent (hEvent=0x2fc) returned 1 [0174.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.888] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9080) returned 1 [0174.888] CloseHandle (hObject=0x394) returned 1 [0174.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0174.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0174.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.889] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.889] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0174.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.900] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2378, lpOverlapped=0x0) returned 1 [0175.093] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2380, lpOverlapped=0x0) returned 1 [0175.095] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.095] CloseHandle (hObject=0x394) returned 1 [0175.095] CloseHandle (hObject=0x368) returned 1 [0175.095] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0 [0175.096] SetEvent (hEvent=0x2fc) returned 1 [0175.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.097] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=25265) returned 1 [0175.097] CloseHandle (hObject=0x368) returned 1 [0175.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0175.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0175.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.098] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.098] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0175.099] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x62b1, lpOverlapped=0x0) returned 1 [0175.101] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x62c0, lpOverlapped=0x0) returned 1 [0175.103] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.103] CloseHandle (hObject=0x368) returned 1 [0175.111] CloseHandle (hObject=0x394) returned 1 [0175.111] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0 [0175.111] SetEvent (hEvent=0x2fc) returned 1 [0175.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.113] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19923) returned 1 [0175.113] CloseHandle (hObject=0x394) returned 1 [0175.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0175.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0175.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.114] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.114] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0175.115] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4dd3, lpOverlapped=0x0) returned 1 [0175.117] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4de0, lpOverlapped=0x0) returned 1 [0175.118] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.118] CloseHandle (hObject=0x394) returned 1 [0175.118] CloseHandle (hObject=0x368) returned 1 [0175.118] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0 [0175.119] SetEvent (hEvent=0x2fc) returned 1 [0175.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.120] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14337) returned 1 [0175.120] CloseHandle (hObject=0x368) returned 1 [0175.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0175.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0175.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.120] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.120] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0175.122] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3801, lpOverlapped=0x0) returned 1 [0175.124] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3810, lpOverlapped=0x0) returned 1 [0175.125] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.125] CloseHandle (hObject=0x368) returned 1 [0175.125] CloseHandle (hObject=0x394) returned 1 [0175.125] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0 [0175.126] SetEvent (hEvent=0x2fc) returned 1 [0175.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.127] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10898) returned 1 [0175.127] CloseHandle (hObject=0x394) returned 1 [0175.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0175.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0175.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.127] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.128] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0175.128] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2a92, lpOverlapped=0x0) returned 1 [0175.336] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2aa0, lpOverlapped=0x0) returned 1 [0175.337] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.338] CloseHandle (hObject=0x394) returned 1 [0175.338] CloseHandle (hObject=0x368) returned 1 [0175.338] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0 [0175.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.341] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33975) returned 1 [0175.341] CloseHandle (hObject=0x368) returned 1 [0175.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0175.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0175.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.342] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.342] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0175.343] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x84b7, lpOverlapped=0x0) returned 1 [0175.346] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x84c0, lpOverlapped=0x0) returned 1 [0175.347] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.347] CloseHandle (hObject=0x368) returned 1 [0175.347] CloseHandle (hObject=0x394) returned 1 [0175.347] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0 [0175.348] SetEvent (hEvent=0x2fc) returned 1 [0175.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.349] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16543) returned 1 [0175.349] CloseHandle (hObject=0x394) returned 1 [0175.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0175.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0175.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.350] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.350] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0175.350] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x409f, lpOverlapped=0x0) returned 1 [0175.353] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x40a0, lpOverlapped=0x0) returned 1 [0175.354] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.354] CloseHandle (hObject=0x394) returned 1 [0175.354] CloseHandle (hObject=0x368) returned 1 [0175.355] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0 [0175.355] SetEvent (hEvent=0x2fc) returned 1 [0175.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.355] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=51401) returned 1 [0175.355] CloseHandle (hObject=0x368) returned 1 [0175.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0175.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0175.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.356] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.356] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0175.358] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc8c9, lpOverlapped=0x0) returned 1 [0175.360] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc8d0, lpOverlapped=0x0) returned 1 [0175.362] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.362] CloseHandle (hObject=0x368) returned 1 [0175.362] CloseHandle (hObject=0x394) returned 1 [0175.362] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0 [0175.363] SetEvent (hEvent=0x2fc) returned 1 [0175.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.363] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4967) returned 1 [0175.363] CloseHandle (hObject=0x394) returned 1 [0175.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0175.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0175.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.364] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.364] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0175.365] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1367, lpOverlapped=0x0) returned 1 [0175.367] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1370, lpOverlapped=0x0) returned 1 [0175.368] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.368] CloseHandle (hObject=0x394) returned 1 [0175.368] CloseHandle (hObject=0x368) returned 1 [0175.368] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0 [0175.369] SetEvent (hEvent=0x2fc) returned 1 [0175.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.369] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3904) returned 1 [0175.369] CloseHandle (hObject=0x368) returned 1 [0175.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0175.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0175.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0175.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0175.370] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.370] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0175.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0175.371] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf40, lpOverlapped=0x0) returned 1 [0175.373] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf50, lpOverlapped=0x0) returned 1 [0175.374] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0175.374] CloseHandle (hObject=0x368) returned 1 [0175.374] CloseHandle (hObject=0x394) returned 1 [0175.375] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0 [0175.375] SetEvent (hEvent=0x2fc) returned 1 [0175.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.522] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17854) returned 1 [0175.522] CloseHandle (hObject=0x394) returned 1 [0175.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0175.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0176.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0176.590] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x45be, lpOverlapped=0x0) returned 1 [0176.599] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x45c0, lpOverlapped=0x0) returned 1 [0176.600] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.600] CloseHandle (hObject=0x37c) returned 1 [0176.601] CloseHandle (hObject=0x398) returned 1 [0176.601] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0 [0176.601] SetEvent (hEvent=0x2fc) returned 1 [0176.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.602] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=32184) returned 1 [0176.602] CloseHandle (hObject=0x398) returned 1 [0176.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0176.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0176.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.603] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.603] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0176.604] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7db8, lpOverlapped=0x0) returned 1 [0176.606] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.608] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.608] CloseHandle (hObject=0x398) returned 1 [0176.608] CloseHandle (hObject=0x37c) returned 1 [0176.608] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0 [0176.608] SetEvent (hEvent=0x2fc) returned 1 [0176.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.609] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=32184) returned 1 [0176.609] CloseHandle (hObject=0x37c) returned 1 [0176.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0176.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0176.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.610] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.610] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0176.611] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7db8, lpOverlapped=0x0) returned 1 [0176.614] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.615] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.615] CloseHandle (hObject=0x37c) returned 1 [0176.615] CloseHandle (hObject=0x398) returned 1 [0176.615] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0 [0176.616] SetEvent (hEvent=0x2fc) returned 1 [0176.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.616] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=32184) returned 1 [0176.617] CloseHandle (hObject=0x398) returned 1 [0176.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0176.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0176.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.617] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.617] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0176.618] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7db8, lpOverlapped=0x0) returned 1 [0176.620] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.622] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.622] CloseHandle (hObject=0x398) returned 1 [0176.622] CloseHandle (hObject=0x37c) returned 1 [0176.622] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0 [0176.623] SetEvent (hEvent=0x2fc) returned 1 [0176.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.623] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=32184) returned 1 [0176.623] CloseHandle (hObject=0x37c) returned 1 [0176.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0176.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0176.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.624] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.624] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0176.624] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7db8, lpOverlapped=0x0) returned 1 [0176.626] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.628] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.629] CloseHandle (hObject=0x37c) returned 1 [0176.629] CloseHandle (hObject=0x398) returned 1 [0176.629] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0 [0176.629] SetEvent (hEvent=0x2fc) returned 1 [0176.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.630] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31968) returned 1 [0176.630] CloseHandle (hObject=0x398) returned 1 [0176.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0176.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0176.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.630] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.631] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0176.631] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7ce0, lpOverlapped=0x0) returned 1 [0176.633] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7cf0, lpOverlapped=0x0) returned 1 [0176.795] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.795] CloseHandle (hObject=0x398) returned 1 [0176.795] CloseHandle (hObject=0x37c) returned 1 [0176.795] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0 [0176.795] SetEvent (hEvent=0x2fc) returned 1 [0176.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.796] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=32184) returned 1 [0176.796] CloseHandle (hObject=0x37c) returned 1 [0176.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0176.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0176.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.797] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0176.798] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7db8, lpOverlapped=0x0) returned 1 [0176.812] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.815] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.815] CloseHandle (hObject=0x37c) returned 1 [0176.815] CloseHandle (hObject=0x398) returned 1 [0176.816] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0 [0176.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.817] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16104) returned 1 [0176.817] CloseHandle (hObject=0x398) returned 1 [0176.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0176.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0176.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0176.818] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.818] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0176.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0176.820] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3ee8, lpOverlapped=0x0) returned 1 [0176.845] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ef0, lpOverlapped=0x0) returned 1 [0176.851] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0176.851] CloseHandle (hObject=0x398) returned 1 [0176.851] CloseHandle (hObject=0x37c) returned 1 [0176.859] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0 [0176.859] SetEvent (hEvent=0x2fc) returned 1 [0176.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0177.013] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11216) returned 1 [0177.013] CloseHandle (hObject=0x398) returned 1 [0177.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0177.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0177.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0177.014] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.014] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.015] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2bd0, lpOverlapped=0x0) returned 1 [0177.037] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2be0, lpOverlapped=0x0) returned 1 [0177.038] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.038] CloseHandle (hObject=0x398) returned 1 [0177.038] CloseHandle (hObject=0x394) returned 1 [0177.038] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0 [0177.038] SetEvent (hEvent=0x2fc) returned 1 [0177.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.039] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12900) returned 1 [0177.039] CloseHandle (hObject=0x394) returned 1 [0177.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0177.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0177.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.040] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.040] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.079] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3264, lpOverlapped=0x0) returned 1 [0177.089] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3270, lpOverlapped=0x0) returned 1 [0177.090] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.090] CloseHandle (hObject=0x394) returned 1 [0177.090] CloseHandle (hObject=0x368) returned 1 [0177.091] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0 [0177.091] SetEvent (hEvent=0x2fc) returned 1 [0177.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.097] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5908) returned 1 [0177.097] CloseHandle (hObject=0x394) returned 1 [0177.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0177.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0177.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.098] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.098] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.099] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1714, lpOverlapped=0x0) returned 1 [0177.126] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1720, lpOverlapped=0x0) returned 1 [0177.127] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.128] CloseHandle (hObject=0x394) returned 1 [0177.128] CloseHandle (hObject=0x370) returned 1 [0177.128] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0 [0177.128] SetEvent (hEvent=0x2fc) returned 1 [0177.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.130] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=23596) returned 1 [0177.130] CloseHandle (hObject=0x370) returned 1 [0177.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0177.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0177.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.131] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.131] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.132] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5c2c, lpOverlapped=0x0) returned 1 [0177.134] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5c30, lpOverlapped=0x0) returned 1 [0177.136] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.136] CloseHandle (hObject=0x370) returned 1 [0177.136] CloseHandle (hObject=0x394) returned 1 [0177.136] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0 [0177.136] SetEvent (hEvent=0x2fc) returned 1 [0177.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.138] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5172) returned 1 [0177.138] CloseHandle (hObject=0x394) returned 1 [0177.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0177.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0177.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.139] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.139] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.139] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1434, lpOverlapped=0x0) returned 1 [0177.143] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1440, lpOverlapped=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.152] CloseHandle (hObject=0x394) returned 1 [0177.152] CloseHandle (hObject=0x370) returned 1 [0177.158] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0 [0177.158] SetEvent (hEvent=0x2fc) returned 1 [0177.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.159] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5632) returned 1 [0177.159] CloseHandle (hObject=0x370) returned 1 [0177.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0177.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0177.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.161] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.161] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.162] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1600, lpOverlapped=0x0) returned 1 [0177.170] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1610, lpOverlapped=0x0) returned 1 [0177.171] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.171] CloseHandle (hObject=0x370) returned 1 [0177.171] CloseHandle (hObject=0x394) returned 1 [0177.171] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0 [0177.172] SetEvent (hEvent=0x2fc) returned 1 [0177.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.173] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3444) returned 1 [0177.173] CloseHandle (hObject=0x394) returned 1 [0177.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0177.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0177.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.174] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.174] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.175] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd74, lpOverlapped=0x0) returned 1 [0177.176] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xd80, lpOverlapped=0x0) returned 1 [0177.177] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.178] CloseHandle (hObject=0x394) returned 1 [0177.178] CloseHandle (hObject=0x370) returned 1 [0177.178] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0 [0177.178] SetEvent (hEvent=0x2fc) returned 1 [0177.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.179] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17172) returned 1 [0177.179] CloseHandle (hObject=0x370) returned 1 [0177.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0177.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0177.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.180] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.180] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.181] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4314, lpOverlapped=0x0) returned 1 [0177.184] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4320, lpOverlapped=0x0) returned 1 [0177.299] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.299] CloseHandle (hObject=0x370) returned 1 [0177.299] CloseHandle (hObject=0x394) returned 1 [0177.300] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0 [0177.300] SetEvent (hEvent=0x2fc) returned 1 [0177.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.302] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11228) returned 1 [0177.302] CloseHandle (hObject=0x394) returned 1 [0177.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0177.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0177.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.303] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.303] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.458] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2bdc, lpOverlapped=0x0) returned 1 [0177.463] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2be0, lpOverlapped=0x0) returned 1 [0177.464] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.464] CloseHandle (hObject=0x394) returned 1 [0177.464] CloseHandle (hObject=0x370) returned 1 [0177.464] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0 [0177.465] SetEvent (hEvent=0x2fc) returned 1 [0177.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.465] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19328) returned 1 [0177.465] CloseHandle (hObject=0x370) returned 1 [0177.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0177.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0177.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.466] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.466] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.467] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4b80, lpOverlapped=0x0) returned 1 [0177.471] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4b90, lpOverlapped=0x0) returned 1 [0177.473] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.473] CloseHandle (hObject=0x370) returned 1 [0177.473] CloseHandle (hObject=0x394) returned 1 [0177.473] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0 [0177.473] SetEvent (hEvent=0x2fc) returned 1 [0177.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.585] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5908) returned 1 [0177.585] CloseHandle (hObject=0x37c) returned 1 [0177.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0177.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0177.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.586] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.586] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.589] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1714, lpOverlapped=0x0) returned 1 [0177.591] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1720, lpOverlapped=0x0) returned 1 [0177.594] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.594] CloseHandle (hObject=0x37c) returned 1 [0177.594] CloseHandle (hObject=0x370) returned 1 [0177.595] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0 [0177.595] SetEvent (hEvent=0x2fc) returned 1 [0177.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.596] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6568) returned 1 [0177.596] CloseHandle (hObject=0x370) returned 1 [0177.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0177.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0177.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.596] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.596] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0177.597] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x19a8, lpOverlapped=0x0) returned 1 [0177.599] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x19b0, lpOverlapped=0x0) returned 1 [0177.600] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.600] CloseHandle (hObject=0x370) returned 1 [0177.600] CloseHandle (hObject=0x37c) returned 1 [0177.600] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0 [0177.601] SetEvent (hEvent=0x2fc) returned 1 [0177.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.601] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15832) returned 1 [0177.601] CloseHandle (hObject=0x37c) returned 1 [0177.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0177.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0177.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.602] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.602] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.603] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3dd8, lpOverlapped=0x0) returned 1 [0177.605] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3de0, lpOverlapped=0x0) returned 1 [0177.606] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.606] CloseHandle (hObject=0x37c) returned 1 [0177.606] CloseHandle (hObject=0x370) returned 1 [0177.606] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0 [0177.607] SetEvent (hEvent=0x2fc) returned 1 [0177.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.608] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14868) returned 1 [0177.608] CloseHandle (hObject=0x370) returned 1 [0177.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0177.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0177.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.608] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.609] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0177.609] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3a14, lpOverlapped=0x0) returned 1 [0177.743] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3a20, lpOverlapped=0x0) returned 1 [0177.745] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.745] CloseHandle (hObject=0x370) returned 1 [0177.747] CloseHandle (hObject=0x37c) returned 1 [0177.752] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0 [0177.752] SetEvent (hEvent=0x2fc) returned 1 [0177.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.754] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2900) returned 1 [0177.754] CloseHandle (hObject=0x37c) returned 1 [0177.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0177.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0177.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.755] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.755] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.755] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb54, lpOverlapped=0x0) returned 1 [0177.757] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb60, lpOverlapped=0x0) returned 1 [0177.758] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.758] CloseHandle (hObject=0x37c) returned 1 [0177.758] CloseHandle (hObject=0x370) returned 1 [0177.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0 [0177.759] SetEvent (hEvent=0x2fc) returned 1 [0177.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.759] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11584) returned 1 [0177.760] CloseHandle (hObject=0x370) returned 1 [0177.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0177.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0177.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.760] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.760] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0177.761] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2d40, lpOverlapped=0x0) returned 1 [0177.763] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2d50, lpOverlapped=0x0) returned 1 [0177.765] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.765] CloseHandle (hObject=0x370) returned 1 [0177.765] CloseHandle (hObject=0x37c) returned 1 [0177.765] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0 [0177.765] SetEvent (hEvent=0x2fc) returned 1 [0177.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.766] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17060) returned 1 [0177.766] CloseHandle (hObject=0x37c) returned 1 [0177.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0177.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0177.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.767] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.767] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.768] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x42a4, lpOverlapped=0x0) returned 1 [0177.770] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x42b0, lpOverlapped=0x0) returned 1 [0177.772] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.772] CloseHandle (hObject=0x37c) returned 1 [0177.773] CloseHandle (hObject=0x370) returned 1 [0177.773] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0 [0177.773] SetEvent (hEvent=0x2fc) returned 1 [0177.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.774] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8860) returned 1 [0177.774] CloseHandle (hObject=0x370) returned 1 [0177.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0177.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0177.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.774] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.774] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0177.775] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x229c, lpOverlapped=0x0) returned 1 [0177.777] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x22a0, lpOverlapped=0x0) returned 1 [0177.778] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.778] CloseHandle (hObject=0x370) returned 1 [0177.778] CloseHandle (hObject=0x37c) returned 1 [0177.779] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0 [0177.779] SetEvent (hEvent=0x2fc) returned 1 [0177.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.780] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12380) returned 1 [0177.780] CloseHandle (hObject=0x37c) returned 1 [0177.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0177.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0177.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.782] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x305c, lpOverlapped=0x0) returned 1 [0177.786] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3060, lpOverlapped=0x0) returned 1 [0177.866] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.870] CloseHandle (hObject=0x37c) returned 1 [0177.876] CloseHandle (hObject=0x370) returned 1 [0177.882] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0 [0177.884] SetEvent (hEvent=0x2fc) returned 1 [0177.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.926] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4944) returned 1 [0177.926] CloseHandle (hObject=0x37c) returned 1 [0177.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0177.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0177.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.929] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.929] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0177.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.930] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1350, lpOverlapped=0x0) returned 1 [0177.936] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1360, lpOverlapped=0x0) returned 1 [0177.937] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0177.937] CloseHandle (hObject=0x37c) returned 1 [0177.937] CloseHandle (hObject=0x370) returned 1 [0177.938] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0 [0177.938] SetEvent (hEvent=0x2fc) returned 1 [0177.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.010] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9400) returned 1 [0178.010] CloseHandle (hObject=0x37c) returned 1 [0178.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0178.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0178.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.011] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.011] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.013] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x24b8, lpOverlapped=0x0) returned 1 [0178.015] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x24c0, lpOverlapped=0x0) returned 1 [0178.016] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.016] CloseHandle (hObject=0x37c) returned 1 [0178.016] CloseHandle (hObject=0x368) returned 1 [0178.017] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0 [0178.017] SetEvent (hEvent=0x2fc) returned 1 [0178.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.018] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5156) returned 1 [0178.018] CloseHandle (hObject=0x368) returned 1 [0178.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0178.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0178.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.021] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.021] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.022] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1424, lpOverlapped=0x0) returned 1 [0178.024] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1430, lpOverlapped=0x0) returned 1 [0178.025] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.025] CloseHandle (hObject=0x368) returned 1 [0178.025] CloseHandle (hObject=0x37c) returned 1 [0178.026] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0 [0178.026] SetEvent (hEvent=0x2fc) returned 1 [0178.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.026] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5472) returned 1 [0178.027] CloseHandle (hObject=0x37c) returned 1 [0178.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0178.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0178.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.027] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.028] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1560, lpOverlapped=0x0) returned 1 [0178.030] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1570, lpOverlapped=0x0) returned 1 [0178.034] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.034] CloseHandle (hObject=0x37c) returned 1 [0178.034] CloseHandle (hObject=0x368) returned 1 [0178.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0 [0178.035] SetEvent (hEvent=0x2fc) returned 1 [0178.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.035] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4148) returned 1 [0178.035] CloseHandle (hObject=0x368) returned 1 [0178.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0178.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0178.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.036] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.036] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.037] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1034, lpOverlapped=0x0) returned 1 [0178.039] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1040, lpOverlapped=0x0) returned 1 [0178.040] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.040] CloseHandle (hObject=0x368) returned 1 [0178.040] CloseHandle (hObject=0x37c) returned 1 [0178.040] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0 [0178.040] SetEvent (hEvent=0x2fc) returned 1 [0178.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.041] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2912) returned 1 [0178.041] CloseHandle (hObject=0x37c) returned 1 [0178.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0178.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0178.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.042] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.042] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.043] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb60, lpOverlapped=0x0) returned 1 [0178.045] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb70, lpOverlapped=0x0) returned 1 [0178.180] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.180] CloseHandle (hObject=0x37c) returned 1 [0178.180] CloseHandle (hObject=0x368) returned 1 [0178.180] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0 [0178.181] SetEvent (hEvent=0x2fc) returned 1 [0178.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.182] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13808) returned 1 [0178.182] CloseHandle (hObject=0x368) returned 1 [0178.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0178.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0178.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.183] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.184] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x35f0, lpOverlapped=0x0) returned 1 [0178.185] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3600, lpOverlapped=0x0) returned 1 [0178.188] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.188] CloseHandle (hObject=0x368) returned 1 [0178.188] CloseHandle (hObject=0x37c) returned 1 [0178.188] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0 [0178.189] SetEvent (hEvent=0x2fc) returned 1 [0178.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.190] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8240) returned 1 [0178.190] CloseHandle (hObject=0x37c) returned 1 [0178.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0178.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0178.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.191] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.191] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.192] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2030, lpOverlapped=0x0) returned 1 [0178.194] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2040, lpOverlapped=0x0) returned 1 [0178.196] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.196] CloseHandle (hObject=0x37c) returned 1 [0178.196] CloseHandle (hObject=0x368) returned 1 [0178.196] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0 [0178.197] SetEvent (hEvent=0x2fc) returned 1 [0178.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.198] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11720) returned 1 [0178.198] CloseHandle (hObject=0x368) returned 1 [0178.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0178.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0178.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.198] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.198] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.199] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2dc8, lpOverlapped=0x0) returned 1 [0178.201] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2dd0, lpOverlapped=0x0) returned 1 [0178.202] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.202] CloseHandle (hObject=0x368) returned 1 [0178.202] CloseHandle (hObject=0x37c) returned 1 [0178.203] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0 [0178.203] SetEvent (hEvent=0x2fc) returned 1 [0178.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.204] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4612) returned 1 [0178.204] CloseHandle (hObject=0x37c) returned 1 [0178.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0178.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0178.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.204] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.205] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.205] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1204, lpOverlapped=0x0) returned 1 [0178.207] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1210, lpOverlapped=0x0) returned 1 [0178.208] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.208] CloseHandle (hObject=0x37c) returned 1 [0178.209] CloseHandle (hObject=0x368) returned 1 [0178.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0 [0178.209] SetEvent (hEvent=0x2fc) returned 1 [0178.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.210] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10060) returned 1 [0178.210] CloseHandle (hObject=0x368) returned 1 [0178.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0178.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0178.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.210] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.210] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.211] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x274c, lpOverlapped=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2750, lpOverlapped=0x0) returned 1 [0178.215] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.215] CloseHandle (hObject=0x368) returned 1 [0178.215] CloseHandle (hObject=0x37c) returned 1 [0178.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0 [0178.215] SetEvent (hEvent=0x2fc) returned 1 [0178.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.216] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5812) returned 1 [0178.216] CloseHandle (hObject=0x37c) returned 1 [0178.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0178.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0178.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.217] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.217] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.218] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16b4, lpOverlapped=0x0) returned 1 [0178.220] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16c0, lpOverlapped=0x0) returned 1 [0178.354] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.354] CloseHandle (hObject=0x37c) returned 1 [0178.354] CloseHandle (hObject=0x368) returned 1 [0178.354] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0 [0178.354] SetEvent (hEvent=0x2fc) returned 1 [0178.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.355] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13784) returned 1 [0178.356] CloseHandle (hObject=0x368) returned 1 [0178.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0178.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0178.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.356] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.357] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.357] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x35d8, lpOverlapped=0x0) returned 1 [0178.360] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x35e0, lpOverlapped=0x0) returned 1 [0178.361] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.362] CloseHandle (hObject=0x368) returned 1 [0178.362] CloseHandle (hObject=0x37c) returned 1 [0178.362] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0 [0178.362] SetEvent (hEvent=0x2fc) returned 1 [0178.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.363] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3020) returned 1 [0178.364] CloseHandle (hObject=0x37c) returned 1 [0178.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0178.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0178.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.364] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.364] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.365] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xbcc, lpOverlapped=0x0) returned 1 [0178.367] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xbd0, lpOverlapped=0x0) returned 1 [0178.368] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.368] CloseHandle (hObject=0x37c) returned 1 [0178.368] CloseHandle (hObject=0x368) returned 1 [0178.369] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0 [0178.369] SetEvent (hEvent=0x2fc) returned 1 [0178.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.370] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7632) returned 1 [0178.370] CloseHandle (hObject=0x368) returned 1 [0178.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0178.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0178.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.370] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.372] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1dd0, lpOverlapped=0x0) returned 1 [0178.374] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1de0, lpOverlapped=0x0) returned 1 [0178.375] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.375] CloseHandle (hObject=0x368) returned 1 [0178.375] CloseHandle (hObject=0x37c) returned 1 [0178.375] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0 [0178.376] SetEvent (hEvent=0x2fc) returned 1 [0178.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.376] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9048) returned 1 [0178.377] CloseHandle (hObject=0x37c) returned 1 [0178.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0178.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0178.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.377] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.377] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.379] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2358, lpOverlapped=0x0) returned 1 [0178.381] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2360, lpOverlapped=0x0) returned 1 [0178.382] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.382] CloseHandle (hObject=0x37c) returned 1 [0178.382] CloseHandle (hObject=0x368) returned 1 [0178.382] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0 [0178.383] SetEvent (hEvent=0x2fc) returned 1 [0178.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.385] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14132) returned 1 [0178.385] CloseHandle (hObject=0x368) returned 1 [0178.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0178.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0178.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.386] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.386] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.387] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3734, lpOverlapped=0x0) returned 1 [0178.389] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3740, lpOverlapped=0x0) returned 1 [0178.390] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.390] CloseHandle (hObject=0x368) returned 1 [0178.391] CloseHandle (hObject=0x37c) returned 1 [0178.391] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0 [0178.391] SetEvent (hEvent=0x2fc) returned 1 [0178.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.392] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=27084) returned 1 [0178.392] CloseHandle (hObject=0x37c) returned 1 [0178.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0178.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0178.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.393] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.393] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.485] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x69cc, lpOverlapped=0x0) returned 1 [0178.488] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x69d0, lpOverlapped=0x0) returned 1 [0178.489] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.490] CloseHandle (hObject=0x37c) returned 1 [0178.490] CloseHandle (hObject=0x394) returned 1 [0178.490] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0 [0178.491] SetEvent (hEvent=0x2fc) returned 1 [0178.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.492] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13456) returned 1 [0178.492] CloseHandle (hObject=0x394) returned 1 [0178.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0178.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0178.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.492] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.493] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.494] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3490, lpOverlapped=0x0) returned 1 [0178.495] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x34a0, lpOverlapped=0x0) returned 1 [0178.496] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.497] CloseHandle (hObject=0x394) returned 1 [0178.498] CloseHandle (hObject=0x37c) returned 1 [0178.498] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0 [0178.499] SetEvent (hEvent=0x2fc) returned 1 [0178.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.500] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=22532) returned 1 [0178.500] CloseHandle (hObject=0x37c) returned 1 [0178.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0178.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0178.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.501] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.501] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.502] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5804, lpOverlapped=0x0) returned 1 [0178.504] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5810, lpOverlapped=0x0) returned 1 [0178.506] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.506] CloseHandle (hObject=0x37c) returned 1 [0178.506] CloseHandle (hObject=0x394) returned 1 [0178.506] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0 [0178.506] SetEvent (hEvent=0x2fc) returned 1 [0178.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.507] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=22300) returned 1 [0178.507] CloseHandle (hObject=0x394) returned 1 [0178.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0178.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0178.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.508] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.508] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.509] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x571c, lpOverlapped=0x0) returned 1 [0178.511] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5720, lpOverlapped=0x0) returned 1 [0178.514] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.515] CloseHandle (hObject=0x394) returned 1 [0178.515] CloseHandle (hObject=0x37c) returned 1 [0178.515] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0 [0178.515] SetEvent (hEvent=0x2fc) returned 1 [0178.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.516] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=24908) returned 1 [0178.516] CloseHandle (hObject=0x37c) returned 1 [0178.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0178.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0178.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.518] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x614c, lpOverlapped=0x0) returned 1 [0178.521] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6150, lpOverlapped=0x0) returned 1 [0178.523] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.523] CloseHandle (hObject=0x37c) returned 1 [0178.523] CloseHandle (hObject=0x394) returned 1 [0178.523] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0 [0178.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.525] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4536) returned 1 [0178.525] CloseHandle (hObject=0x394) returned 1 [0178.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0178.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0178.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.618] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.618] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0178.619] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11b8, lpOverlapped=0x0) returned 1 [0178.621] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11c0, lpOverlapped=0x0) returned 1 [0178.623] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.623] CloseHandle (hObject=0x370) returned 1 [0178.623] CloseHandle (hObject=0x384) returned 1 [0178.623] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0 [0178.623] SetEvent (hEvent=0x2fc) returned 1 [0178.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.624] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5868) returned 1 [0178.624] CloseHandle (hObject=0x384) returned 1 [0178.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0178.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0178.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.625] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.625] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.627] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16ec, lpOverlapped=0x0) returned 1 [0178.630] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16f0, lpOverlapped=0x0) returned 1 [0178.632] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.633] CloseHandle (hObject=0x384) returned 1 [0178.633] CloseHandle (hObject=0x370) returned 1 [0178.633] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0 [0178.633] SetEvent (hEvent=0x2fc) returned 1 [0178.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.634] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11108) returned 1 [0178.634] CloseHandle (hObject=0x370) returned 1 [0178.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0178.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0178.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.636] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.636] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0178.636] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2b64, lpOverlapped=0x0) returned 1 [0178.638] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2b70, lpOverlapped=0x0) returned 1 [0178.639] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.640] CloseHandle (hObject=0x370) returned 1 [0178.640] CloseHandle (hObject=0x384) returned 1 [0178.640] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0 [0178.640] SetEvent (hEvent=0x2fc) returned 1 [0178.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.641] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14132) returned 1 [0178.641] CloseHandle (hObject=0x384) returned 1 [0178.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0178.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0178.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.642] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.642] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.643] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3734, lpOverlapped=0x0) returned 1 [0178.645] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3740, lpOverlapped=0x0) returned 1 [0178.647] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.647] CloseHandle (hObject=0x384) returned 1 [0178.647] CloseHandle (hObject=0x370) returned 1 [0178.647] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0 [0178.647] SetEvent (hEvent=0x2fc) returned 1 [0178.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.648] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13436) returned 1 [0178.648] CloseHandle (hObject=0x370) returned 1 [0178.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0178.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0178.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.649] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.649] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0178.650] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x347c, lpOverlapped=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3480, lpOverlapped=0x0) returned 1 [0178.654] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.654] CloseHandle (hObject=0x370) returned 1 [0178.654] CloseHandle (hObject=0x384) returned 1 [0178.654] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0 [0178.654] SetEvent (hEvent=0x2fc) returned 1 [0178.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.656] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12308) returned 1 [0178.656] CloseHandle (hObject=0x384) returned 1 [0178.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0178.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0178.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.656] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.657] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.658] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3014, lpOverlapped=0x0) returned 1 [0178.659] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3020, lpOverlapped=0x0) returned 1 [0178.661] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.661] CloseHandle (hObject=0x384) returned 1 [0178.661] CloseHandle (hObject=0x370) returned 1 [0178.662] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0 [0178.827] SetEvent (hEvent=0x2fc) returned 1 [0178.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.880] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4244) returned 1 [0178.880] CloseHandle (hObject=0x394) returned 1 [0178.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0178.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0178.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.965] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.965] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0178.967] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1094, lpOverlapped=0x0) returned 1 [0178.969] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x10a0, lpOverlapped=0x0) returned 1 [0178.971] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.971] CloseHandle (hObject=0x384) returned 1 [0178.971] CloseHandle (hObject=0x368) returned 1 [0178.971] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0 [0178.971] SetEvent (hEvent=0x2fc) returned 1 [0178.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.977] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30336) returned 1 [0178.977] CloseHandle (hObject=0x37c) returned 1 [0178.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0178.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0178.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.978] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.978] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.984] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7680, lpOverlapped=0x0) returned 1 [0178.990] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7690, lpOverlapped=0x0) returned 1 [0178.995] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0178.995] CloseHandle (hObject=0x37c) returned 1 [0178.995] CloseHandle (hObject=0x394) returned 1 [0178.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0 [0178.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.997] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21216) returned 1 [0178.997] CloseHandle (hObject=0x394) returned 1 [0178.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0178.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0178.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.997] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.997] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0178.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.002] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x52e0, lpOverlapped=0x0) returned 1 [0179.004] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x52f0, lpOverlapped=0x0) returned 1 [0179.006] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.006] CloseHandle (hObject=0x394) returned 1 [0179.006] CloseHandle (hObject=0x384) returned 1 [0179.006] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0 [0179.007] SetEvent (hEvent=0x2fc) returned 1 [0179.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.007] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3568) returned 1 [0179.008] CloseHandle (hObject=0x384) returned 1 [0179.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0179.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0179.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.009] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.009] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0179.010] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xdf0, lpOverlapped=0x0) returned 1 [0179.012] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe00, lpOverlapped=0x0) returned 1 [0179.013] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.013] CloseHandle (hObject=0x384) returned 1 [0179.013] CloseHandle (hObject=0x394) returned 1 [0179.014] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0 [0179.014] SetEvent (hEvent=0x2fc) returned 1 [0179.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0179.014] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9612) returned 1 [0179.015] CloseHandle (hObject=0x394) returned 1 [0179.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0179.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0179.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0179.015] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.015] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.067] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x258c, lpOverlapped=0x0) returned 1 [0179.242] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2590, lpOverlapped=0x0) returned 1 [0179.243] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.243] CloseHandle (hObject=0x394) returned 1 [0179.243] CloseHandle (hObject=0x384) returned 1 [0179.243] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0 [0179.244] SetEvent (hEvent=0x2fc) returned 1 [0179.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.245] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6024) returned 1 [0179.245] CloseHandle (hObject=0x384) returned 1 [0179.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0179.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0179.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.246] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.246] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0179.261] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1788, lpOverlapped=0x0) returned 1 [0179.266] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1790, lpOverlapped=0x0) returned 1 [0179.267] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.267] CloseHandle (hObject=0x384) returned 1 [0179.267] CloseHandle (hObject=0x370) returned 1 [0179.267] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0 [0179.267] SetEvent (hEvent=0x2fc) returned 1 [0179.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.269] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3040) returned 1 [0179.269] CloseHandle (hObject=0x370) returned 1 [0179.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0179.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0179.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.269] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.269] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.270] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xbe0, lpOverlapped=0x0) returned 1 [0179.281] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xbf0, lpOverlapped=0x0) returned 1 [0179.283] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.283] CloseHandle (hObject=0x370) returned 1 [0179.283] CloseHandle (hObject=0x384) returned 1 [0179.284] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0 [0179.284] SetEvent (hEvent=0x2fc) returned 1 [0179.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.285] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8000) returned 1 [0179.285] CloseHandle (hObject=0x384) returned 1 [0179.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0179.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0179.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.286] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.286] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0179.286] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f40, lpOverlapped=0x0) returned 1 [0179.296] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f50, lpOverlapped=0x0) returned 1 [0179.298] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.298] CloseHandle (hObject=0x384) returned 1 [0179.298] CloseHandle (hObject=0x370) returned 1 [0179.298] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0 [0179.298] SetEvent (hEvent=0x2fc) returned 1 [0179.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.299] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16468) returned 1 [0179.299] CloseHandle (hObject=0x370) returned 1 [0179.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0179.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0179.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.300] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.300] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.301] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4054, lpOverlapped=0x0) returned 1 [0179.311] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4060, lpOverlapped=0x0) returned 1 [0179.312] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.312] CloseHandle (hObject=0x370) returned 1 [0179.312] CloseHandle (hObject=0x384) returned 1 [0179.312] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0 [0179.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.586] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6424) returned 1 [0179.586] CloseHandle (hObject=0x37c) returned 1 [0179.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0179.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0179.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.587] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.587] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.588] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1918, lpOverlapped=0x0) returned 1 [0179.590] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1920, lpOverlapped=0x0) returned 1 [0179.591] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.591] CloseHandle (hObject=0x37c) returned 1 [0179.592] CloseHandle (hObject=0x384) returned 1 [0179.592] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0 [0179.592] SetEvent (hEvent=0x2fc) returned 1 [0179.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.599] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11404) returned 1 [0179.599] CloseHandle (hObject=0x370) returned 1 [0179.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0179.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0179.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.601] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.601] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0179.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0179.602] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2c8c, lpOverlapped=0x0) returned 1 [0179.606] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2c90, lpOverlapped=0x0) returned 1 [0179.608] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0179.608] CloseHandle (hObject=0x370) returned 1 [0179.608] CloseHandle (hObject=0x390) returned 1 [0179.609] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0 [0179.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.350] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7948) returned 1 [0180.350] CloseHandle (hObject=0x370) returned 1 [0180.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0180.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0180.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.351] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.352] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f0c, lpOverlapped=0x0) returned 1 [0180.353] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f10, lpOverlapped=0x0) returned 1 [0180.355] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.355] CloseHandle (hObject=0x370) returned 1 [0180.355] CloseHandle (hObject=0x37c) returned 1 [0180.355] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0 [0180.355] SetEvent (hEvent=0x2fc) returned 1 [0180.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.356] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7072) returned 1 [0180.357] CloseHandle (hObject=0x37c) returned 1 [0180.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0180.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0180.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.357] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.357] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0180.358] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ba0, lpOverlapped=0x0) returned 1 [0180.363] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1bb0, lpOverlapped=0x0) returned 1 [0180.365] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.365] CloseHandle (hObject=0x37c) returned 1 [0180.365] CloseHandle (hObject=0x370) returned 1 [0180.365] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0 [0180.366] SetEvent (hEvent=0x2fc) returned 1 [0180.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.366] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4808) returned 1 [0180.366] CloseHandle (hObject=0x370) returned 1 [0180.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0180.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0180.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.367] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.367] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.368] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x12c8, lpOverlapped=0x0) returned 1 [0180.369] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x12d0, lpOverlapped=0x0) returned 1 [0180.371] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.371] CloseHandle (hObject=0x370) returned 1 [0180.371] CloseHandle (hObject=0x37c) returned 1 [0180.371] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0 [0180.372] SetEvent (hEvent=0x2fc) returned 1 [0180.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.372] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4636) returned 1 [0180.372] CloseHandle (hObject=0x37c) returned 1 [0180.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0180.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0180.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.373] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.373] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0180.374] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x121c, lpOverlapped=0x0) returned 1 [0180.376] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1220, lpOverlapped=0x0) returned 1 [0180.377] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.377] CloseHandle (hObject=0x37c) returned 1 [0180.377] CloseHandle (hObject=0x370) returned 1 [0180.378] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0 [0180.378] SetEvent (hEvent=0x2fc) returned 1 [0180.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.703] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3800) returned 1 [0180.703] CloseHandle (hObject=0x368) returned 1 [0180.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0180.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0180.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.704] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.704] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0180.706] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xed8, lpOverlapped=0x0) returned 1 [0180.708] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xee0, lpOverlapped=0x0) returned 1 [0180.709] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.709] CloseHandle (hObject=0x368) returned 1 [0180.710] CloseHandle (hObject=0x398) returned 1 [0180.710] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0 [0180.711] SetEvent (hEvent=0x2fc) returned 1 [0180.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.712] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4788) returned 1 [0180.712] CloseHandle (hObject=0x398) returned 1 [0180.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0180.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0180.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.713] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.713] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.714] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x12b4, lpOverlapped=0x0) returned 1 [0180.716] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x12c0, lpOverlapped=0x0) returned 1 [0180.717] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.718] CloseHandle (hObject=0x398) returned 1 [0180.718] CloseHandle (hObject=0x368) returned 1 [0180.718] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0 [0180.718] SetEvent (hEvent=0x2fc) returned 1 [0180.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.719] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8224) returned 1 [0180.719] CloseHandle (hObject=0x368) returned 1 [0180.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0180.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0180.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.720] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.720] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0180.721] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2020, lpOverlapped=0x0) returned 1 [0180.723] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2030, lpOverlapped=0x0) returned 1 [0180.724] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.724] CloseHandle (hObject=0x368) returned 1 [0180.724] CloseHandle (hObject=0x398) returned 1 [0180.724] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0 [0180.724] SetEvent (hEvent=0x2fc) returned 1 [0180.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.726] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4716) returned 1 [0180.726] CloseHandle (hObject=0x398) returned 1 [0180.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0180.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0180.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.727] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.727] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.728] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x126c, lpOverlapped=0x0) returned 1 [0180.733] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1270, lpOverlapped=0x0) returned 1 [0180.734] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.734] CloseHandle (hObject=0x398) returned 1 [0180.735] CloseHandle (hObject=0x368) returned 1 [0180.735] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0 [0180.736] SetEvent (hEvent=0x2fc) returned 1 [0180.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.739] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16710) returned 1 [0180.739] CloseHandle (hObject=0x37c) returned 1 [0180.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0180.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0180.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.740] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.740] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0180.742] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4146, lpOverlapped=0x0) returned 1 [0180.744] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4150, lpOverlapped=0x0) returned 1 [0180.745] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.745] CloseHandle (hObject=0x37c) returned 1 [0180.746] CloseHandle (hObject=0x370) returned 1 [0180.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0 [0180.746] SetEvent (hEvent=0x2fc) returned 1 [0180.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.748] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33657) returned 1 [0180.748] CloseHandle (hObject=0x370) returned 1 [0180.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0180.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0180.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.749] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.749] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.771] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8379, lpOverlapped=0x0) returned 1 [0180.778] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8380, lpOverlapped=0x0) returned 1 [0180.779] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.779] CloseHandle (hObject=0x370) returned 1 [0180.780] CloseHandle (hObject=0x368) returned 1 [0180.780] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0 [0180.780] SetEvent (hEvent=0x2fc) returned 1 [0180.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.781] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=61633) returned 1 [0180.781] CloseHandle (hObject=0x368) returned 1 [0180.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0180.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0180.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.781] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.782] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0180.782] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf0c1, lpOverlapped=0x0) returned 1 [0180.794] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf0d0, lpOverlapped=0x0) returned 1 [0180.797] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.797] CloseHandle (hObject=0x368) returned 1 [0180.797] CloseHandle (hObject=0x370) returned 1 [0180.804] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0 [0180.805] SetEvent (hEvent=0x2fc) returned 1 [0180.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.854] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21125) returned 1 [0180.854] CloseHandle (hObject=0x390) returned 1 [0180.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0180.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0180.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.855] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.855] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.856] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5285, lpOverlapped=0x0) returned 1 [0180.858] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5290, lpOverlapped=0x0) returned 1 [0180.859] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.860] CloseHandle (hObject=0x390) returned 1 [0180.860] CloseHandle (hObject=0x37c) returned 1 [0180.860] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0 [0180.860] SetEvent (hEvent=0x2fc) returned 1 [0180.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.861] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=36792) returned 1 [0180.861] CloseHandle (hObject=0x37c) returned 1 [0180.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0180.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0180.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.862] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.862] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0180.862] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8fb8, lpOverlapped=0x0) returned 1 [0180.865] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8fc0, lpOverlapped=0x0) returned 1 [0180.866] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.866] CloseHandle (hObject=0x37c) returned 1 [0180.866] CloseHandle (hObject=0x390) returned 1 [0180.866] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0 [0180.867] SetEvent (hEvent=0x2fc) returned 1 [0180.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.867] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=35419) returned 1 [0180.867] CloseHandle (hObject=0x390) returned 1 [0180.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0180.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0180.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.868] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.868] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.869] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8a5b, lpOverlapped=0x0) returned 1 [0180.871] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8a60, lpOverlapped=0x0) returned 1 [0180.872] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.872] CloseHandle (hObject=0x390) returned 1 [0180.873] CloseHandle (hObject=0x37c) returned 1 [0180.873] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0 [0180.873] SetEvent (hEvent=0x2fc) returned 1 [0180.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.874] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33958) returned 1 [0180.874] CloseHandle (hObject=0x37c) returned 1 [0180.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0180.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0180.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0180.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0180.877] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x84a6, lpOverlapped=0x0) returned 1 [0180.880] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x84b0, lpOverlapped=0x0) returned 1 [0180.991] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0180.991] CloseHandle (hObject=0x37c) returned 1 [0180.991] CloseHandle (hObject=0x390) returned 1 [0180.992] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0 [0181.082] SetEvent (hEvent=0x2fc) returned 1 [0181.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.119] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=38237) returned 1 [0181.119] CloseHandle (hObject=0x370) returned 1 [0181.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0181.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0181.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.120] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.120] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.121] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x955d, lpOverlapped=0x0) returned 1 [0181.127] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9560, lpOverlapped=0x0) returned 1 [0181.129] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.129] CloseHandle (hObject=0x370) returned 1 [0181.129] CloseHandle (hObject=0x344) returned 1 [0181.129] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0 [0181.130] SetEvent (hEvent=0x2fc) returned 1 [0181.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.130] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8494) returned 1 [0181.130] CloseHandle (hObject=0x344) returned 1 [0181.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0181.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0181.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0181.133] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x212e, lpOverlapped=0x0) returned 1 [0181.135] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2130, lpOverlapped=0x0) returned 1 [0181.136] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.136] CloseHandle (hObject=0x344) returned 1 [0181.137] CloseHandle (hObject=0x370) returned 1 [0181.137] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0 [0181.137] SetEvent (hEvent=0x2fc) returned 1 [0181.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.138] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4356) returned 1 [0181.138] CloseHandle (hObject=0x370) returned 1 [0181.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0181.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0181.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.140] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1104, lpOverlapped=0x0) returned 1 [0181.146] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1110, lpOverlapped=0x0) returned 1 [0181.147] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.147] CloseHandle (hObject=0x370) returned 1 [0181.147] CloseHandle (hObject=0x344) returned 1 [0181.148] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0 [0181.148] SetEvent (hEvent=0x2fc) returned 1 [0181.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.149] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15464) returned 1 [0181.149] CloseHandle (hObject=0x344) returned 1 [0181.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0181.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0181.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.150] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.150] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0181.151] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3c68, lpOverlapped=0x0) returned 1 [0181.153] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3c70, lpOverlapped=0x0) returned 1 [0181.154] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.154] CloseHandle (hObject=0x344) returned 1 [0181.154] CloseHandle (hObject=0x370) returned 1 [0181.154] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0 [0181.155] SetEvent (hEvent=0x2fc) returned 1 [0181.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.155] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18500) returned 1 [0181.155] CloseHandle (hObject=0x370) returned 1 [0181.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0181.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0181.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.156] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.156] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.157] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4844, lpOverlapped=0x0) returned 1 [0181.159] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4850, lpOverlapped=0x0) returned 1 [0181.160] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.161] CloseHandle (hObject=0x370) returned 1 [0181.470] CloseHandle (hObject=0x344) returned 1 [0181.541] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0 [0181.583] SetEvent (hEvent=0x2fc) returned 1 [0181.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.584] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16432) returned 1 [0181.584] CloseHandle (hObject=0x37c) returned 1 [0181.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0181.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0181.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.585] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.585] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0181.586] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4030, lpOverlapped=0x0) returned 1 [0181.590] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4040, lpOverlapped=0x0) returned 1 [0181.591] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.591] CloseHandle (hObject=0x37c) returned 1 [0181.592] CloseHandle (hObject=0x370) returned 1 [0181.592] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0 [0181.592] SetEvent (hEvent=0x2fc) returned 1 [0181.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.599] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16052) returned 1 [0181.599] CloseHandle (hObject=0x368) returned 1 [0181.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0181.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0181.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.601] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.601] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.601] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3eb4, lpOverlapped=0x0) returned 1 [0181.604] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ec0, lpOverlapped=0x0) returned 1 [0181.605] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.605] CloseHandle (hObject=0x368) returned 1 [0181.605] CloseHandle (hObject=0x344) returned 1 [0181.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0 [0181.606] SetEvent (hEvent=0x2fc) returned 1 [0181.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.606] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3696) returned 1 [0181.606] CloseHandle (hObject=0x344) returned 1 [0181.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0181.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0181.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.607] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.607] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.608] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe70, lpOverlapped=0x0) returned 1 [0181.610] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe80, lpOverlapped=0x0) returned 1 [0181.611] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.611] CloseHandle (hObject=0x344) returned 1 [0181.611] CloseHandle (hObject=0x368) returned 1 [0181.611] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0 [0181.612] SetEvent (hEvent=0x2fc) returned 1 [0181.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.613] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3368) returned 1 [0181.613] CloseHandle (hObject=0x368) returned 1 [0181.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0181.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0181.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.613] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.614] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.615] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd28, lpOverlapped=0x0) returned 1 [0181.616] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xd30, lpOverlapped=0x0) returned 1 [0181.617] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.617] CloseHandle (hObject=0x368) returned 1 [0181.618] CloseHandle (hObject=0x344) returned 1 [0181.618] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0 [0181.618] SetEvent (hEvent=0x2fc) returned 1 [0181.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.619] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10932) returned 1 [0181.619] CloseHandle (hObject=0x344) returned 1 [0181.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0181.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0181.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.620] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.620] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.621] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2ab4, lpOverlapped=0x0) returned 1 [0181.623] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2ac0, lpOverlapped=0x0) returned 1 [0181.624] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.624] CloseHandle (hObject=0x344) returned 1 [0181.625] CloseHandle (hObject=0x368) returned 1 [0181.625] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0 [0181.625] SetEvent (hEvent=0x2fc) returned 1 [0181.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.626] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6340) returned 1 [0181.626] CloseHandle (hObject=0x368) returned 1 [0181.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0181.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0181.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.627] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.627] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.628] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x18c4, lpOverlapped=0x0) returned 1 [0181.629] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x18d0, lpOverlapped=0x0) returned 1 [0181.715] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.715] CloseHandle (hObject=0x368) returned 1 [0181.715] CloseHandle (hObject=0x344) returned 1 [0181.715] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0 [0181.715] SetEvent (hEvent=0x2fc) returned 1 [0181.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.717] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5960) returned 1 [0181.717] CloseHandle (hObject=0x344) returned 1 [0181.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0181.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0181.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.718] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.718] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.719] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1748, lpOverlapped=0x0) returned 1 [0181.721] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1750, lpOverlapped=0x0) returned 1 [0181.722] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.723] CloseHandle (hObject=0x344) returned 1 [0181.723] CloseHandle (hObject=0x368) returned 1 [0181.723] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0 [0181.723] SetEvent (hEvent=0x2fc) returned 1 [0181.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.726] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9604) returned 1 [0181.726] CloseHandle (hObject=0x368) returned 1 [0181.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0181.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0181.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.726] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.727] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.729] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2584, lpOverlapped=0x0) returned 1 [0181.730] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2590, lpOverlapped=0x0) returned 1 [0181.732] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.732] CloseHandle (hObject=0x368) returned 1 [0181.732] CloseHandle (hObject=0x344) returned 1 [0181.732] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0 [0181.732] SetEvent (hEvent=0x2fc) returned 1 [0181.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.733] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26248) returned 1 [0181.733] CloseHandle (hObject=0x344) returned 1 [0181.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0181.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0181.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.734] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.734] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.735] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6688, lpOverlapped=0x0) returned 1 [0181.737] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6690, lpOverlapped=0x0) returned 1 [0181.739] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.739] CloseHandle (hObject=0x344) returned 1 [0181.739] CloseHandle (hObject=0x368) returned 1 [0181.739] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0 [0181.739] SetEvent (hEvent=0x2fc) returned 1 [0181.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.741] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30812) returned 1 [0181.741] CloseHandle (hObject=0x368) returned 1 [0181.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0181.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0181.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.741] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.741] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.742] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x785c, lpOverlapped=0x0) returned 1 [0181.745] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7860, lpOverlapped=0x0) returned 1 [0181.746] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.747] CloseHandle (hObject=0x368) returned 1 [0181.747] CloseHandle (hObject=0x344) returned 1 [0181.747] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0 [0181.747] SetEvent (hEvent=0x2fc) returned 1 [0181.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.749] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=34676) returned 1 [0181.749] CloseHandle (hObject=0x344) returned 1 [0181.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0181.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0181.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.749] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.749] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.750] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8774, lpOverlapped=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8780, lpOverlapped=0x0) returned 1 [0181.754] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.848] CloseHandle (hObject=0x344) returned 1 [0181.848] CloseHandle (hObject=0x368) returned 1 [0181.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0 [0181.852] SetEvent (hEvent=0x2fc) returned 1 [0181.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.884] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1208) returned 1 [0181.884] CloseHandle (hObject=0x368) returned 1 [0181.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220 [0181.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220 [0181.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.885] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.885] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.886] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4b8, lpOverlapped=0x0) returned 1 [0181.888] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4c0, lpOverlapped=0x0) returned 1 [0181.889] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.889] CloseHandle (hObject=0x368) returned 1 [0181.889] CloseHandle (hObject=0x344) returned 1 [0181.889] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0 [0181.889] SetEvent (hEvent=0x2fc) returned 1 [0181.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.891] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1652) returned 1 [0181.891] CloseHandle (hObject=0x344) returned 1 [0181.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0181.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0181.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.892] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.892] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.893] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x674, lpOverlapped=0x0) returned 1 [0181.894] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x680, lpOverlapped=0x0) returned 1 [0181.895] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.895] CloseHandle (hObject=0x344) returned 1 [0181.896] CloseHandle (hObject=0x368) returned 1 [0181.896] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0 [0181.896] SetEvent (hEvent=0x2fc) returned 1 [0181.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.897] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4908) returned 1 [0181.897] CloseHandle (hObject=0x368) returned 1 [0181.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0181.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0181.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.898] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.898] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.899] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x132c, lpOverlapped=0x0) returned 1 [0181.900] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1330, lpOverlapped=0x0) returned 1 [0181.902] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.902] CloseHandle (hObject=0x368) returned 1 [0181.902] CloseHandle (hObject=0x344) returned 1 [0181.902] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0 [0181.903] SetEvent (hEvent=0x2fc) returned 1 [0181.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.903] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4580) returned 1 [0181.903] CloseHandle (hObject=0x344) returned 1 [0181.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0181.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0181.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.904] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.904] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.905] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11e4, lpOverlapped=0x0) returned 1 [0181.907] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11f0, lpOverlapped=0x0) returned 1 [0181.908] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.908] CloseHandle (hObject=0x344) returned 1 [0181.908] CloseHandle (hObject=0x368) returned 1 [0181.908] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0 [0181.909] SetEvent (hEvent=0x2fc) returned 1 [0181.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.910] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7020) returned 1 [0181.910] CloseHandle (hObject=0x368) returned 1 [0181.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0181.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0181.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.911] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.911] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0181.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.912] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b6c, lpOverlapped=0x0) returned 1 [0181.914] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b70, lpOverlapped=0x0) returned 1 [0181.915] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0181.915] CloseHandle (hObject=0x368) returned 1 [0181.915] CloseHandle (hObject=0x344) returned 1 [0181.915] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0 [0181.916] SetEvent (hEvent=0x2fc) returned 1 [0181.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.917] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7876) returned 1 [0181.917] CloseHandle (hObject=0x344) returned 1 [0181.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0181.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0181.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.001] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.001] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.002] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ec4, lpOverlapped=0x0) returned 1 [0182.005] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1ed0, lpOverlapped=0x0) returned 1 [0182.006] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.006] CloseHandle (hObject=0x370) returned 1 [0182.006] CloseHandle (hObject=0x398) returned 1 [0182.006] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0 [0182.007] SetEvent (hEvent=0x2fc) returned 1 [0182.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.008] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4496) returned 1 [0182.008] CloseHandle (hObject=0x398) returned 1 [0182.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220 [0182.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220 [0182.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.009] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.009] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0182.010] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1190, lpOverlapped=0x0) returned 1 [0182.014] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11a0, lpOverlapped=0x0) returned 1 [0182.015] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.015] CloseHandle (hObject=0x398) returned 1 [0182.016] CloseHandle (hObject=0x370) returned 1 [0182.016] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0 [0182.016] SetEvent (hEvent=0x2fc) returned 1 [0182.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.017] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33068) returned 1 [0182.017] CloseHandle (hObject=0x370) returned 1 [0182.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220 [0182.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220 [0182.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.021] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.021] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.023] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x812c, lpOverlapped=0x0) returned 1 [0182.028] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8130, lpOverlapped=0x0) returned 1 [0182.030] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.030] CloseHandle (hObject=0x370) returned 1 [0182.030] CloseHandle (hObject=0x398) returned 1 [0182.030] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0 [0182.031] SetEvent (hEvent=0x2fc) returned 1 [0182.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.048] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1912) returned 1 [0182.048] CloseHandle (hObject=0x390) returned 1 [0182.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220 [0182.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220 [0182.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.048] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.049] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.050] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x778, lpOverlapped=0x0) returned 1 [0182.052] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x780, lpOverlapped=0x0) returned 1 [0182.054] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.054] CloseHandle (hObject=0x390) returned 1 [0182.054] CloseHandle (hObject=0x398) returned 1 [0182.054] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0 [0182.054] SetEvent (hEvent=0x2fc) returned 1 [0182.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.055] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7848) returned 1 [0182.055] CloseHandle (hObject=0x398) returned 1 [0182.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220 [0182.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220 [0182.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.056] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.056] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0182.057] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ea8, lpOverlapped=0x0) returned 1 [0182.062] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1eb0, lpOverlapped=0x0) returned 1 [0182.063] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.063] CloseHandle (hObject=0x398) returned 1 [0182.063] CloseHandle (hObject=0x390) returned 1 [0182.064] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0 [0182.064] SetEvent (hEvent=0x2fc) returned 1 [0182.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.065] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8136) returned 1 [0182.065] CloseHandle (hObject=0x390) returned 1 [0182.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220 [0182.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220 [0182.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.066] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.066] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.068] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1fc8, lpOverlapped=0x0) returned 1 [0182.073] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1fd0, lpOverlapped=0x0) returned 1 [0182.139] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.139] CloseHandle (hObject=0x390) returned 1 [0182.139] CloseHandle (hObject=0x398) returned 1 [0182.139] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0 [0182.140] SetEvent (hEvent=0x2fc) returned 1 [0182.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.141] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=36620) returned 1 [0182.141] CloseHandle (hObject=0x398) returned 1 [0182.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220 [0182.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220 [0182.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.142] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.142] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0182.143] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8f0c, lpOverlapped=0x0) returned 1 [0182.147] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8f10, lpOverlapped=0x0) returned 1 [0182.148] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.148] CloseHandle (hObject=0x398) returned 1 [0182.149] CloseHandle (hObject=0x390) returned 1 [0182.149] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0 [0182.149] SetEvent (hEvent=0x2fc) returned 1 [0182.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.150] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30800) returned 1 [0182.150] CloseHandle (hObject=0x390) returned 1 [0182.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220 [0182.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220 [0182.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.151] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.151] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.152] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7850, lpOverlapped=0x0) returned 1 [0182.156] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7860, lpOverlapped=0x0) returned 1 [0182.158] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.158] CloseHandle (hObject=0x390) returned 1 [0182.158] CloseHandle (hObject=0x398) returned 1 [0182.167] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0 [0182.167] SetEvent (hEvent=0x2fc) returned 1 [0182.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.175] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=38488) returned 1 [0182.175] CloseHandle (hObject=0x398) returned 1 [0182.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220 [0182.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220 [0182.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.176] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.176] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0182.177] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9658, lpOverlapped=0x0) returned 1 [0182.180] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9660, lpOverlapped=0x0) returned 1 [0182.181] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.181] CloseHandle (hObject=0x398) returned 1 [0182.182] CloseHandle (hObject=0x390) returned 1 [0182.182] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0 [0182.182] SetEvent (hEvent=0x2fc) returned 1 [0182.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.183] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15448) returned 1 [0182.183] CloseHandle (hObject=0x390) returned 1 [0182.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0x220 [0182.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0x220 [0182.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.184] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.184] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.185] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3c58, lpOverlapped=0x0) returned 1 [0182.187] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3c60, lpOverlapped=0x0) returned 1 [0182.189] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.189] CloseHandle (hObject=0x390) returned 1 [0182.189] CloseHandle (hObject=0x398) returned 1 [0182.189] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0 [0182.189] SetEvent (hEvent=0x2fc) returned 1 [0182.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.191] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16952) returned 1 [0182.191] CloseHandle (hObject=0x398) returned 1 [0182.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220 [0182.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220 [0182.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.191] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.191] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0182.337] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4238, lpOverlapped=0x0) returned 1 [0182.339] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4240, lpOverlapped=0x0) returned 1 [0182.340] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.340] CloseHandle (hObject=0x398) returned 1 [0182.340] CloseHandle (hObject=0x390) returned 1 [0182.341] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0 [0182.341] SetEvent (hEvent=0x2fc) returned 1 [0182.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.343] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=1376) returned 1 [0182.343] CloseHandle (hObject=0x390) returned 1 [0182.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220 [0182.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220 [0182.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.343] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.343] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.344] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x560, lpOverlapped=0x0) returned 1 [0182.346] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x570, lpOverlapped=0x0) returned 1 [0182.347] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.347] CloseHandle (hObject=0x390) returned 1 [0182.348] CloseHandle (hObject=0x398) returned 1 [0182.348] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0 [0182.349] SetEvent (hEvent=0x2fc) returned 1 [0182.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.350] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=46702) returned 1 [0182.350] CloseHandle (hObject=0x398) returned 1 [0182.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0x220 [0182.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0x220 [0182.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.351] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.351] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0182.352] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb66e, lpOverlapped=0x0) returned 1 [0182.355] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb670, lpOverlapped=0x0) returned 1 [0182.361] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.361] CloseHandle (hObject=0x398) returned 1 [0182.361] CloseHandle (hObject=0x390) returned 1 [0182.361] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0 [0182.362] SetEvent (hEvent=0x2fc) returned 1 [0182.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.362] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21716) returned 1 [0182.362] CloseHandle (hObject=0x390) returned 1 [0182.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220 [0182.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220 [0182.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0182.363] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.363] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0182.364] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x54d4, lpOverlapped=0x0) returned 1 [0182.366] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x54e0, lpOverlapped=0x0) returned 1 [0182.368] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.368] CloseHandle (hObject=0x390) returned 1 [0182.368] CloseHandle (hObject=0x398) returned 1 [0182.368] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0 [0182.368] SetEvent (hEvent=0x2fc) returned 1 [0182.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.370] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17912) returned 1 [0182.370] CloseHandle (hObject=0x398) returned 1 [0182.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220 [0182.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220 [0182.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0182.371] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.371] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0182.372] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x45f8, lpOverlapped=0x0) returned 1 [0182.374] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4600, lpOverlapped=0x0) returned 1 [0182.463] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.463] CloseHandle (hObject=0x398) returned 1 [0182.463] CloseHandle (hObject=0x390) returned 1 [0182.463] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0 [0182.464] SetEvent (hEvent=0x2fc) returned 1 [0182.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.513] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14472) returned 1 [0182.513] CloseHandle (hObject=0x344) returned 1 [0182.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0x220 [0182.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0x220 [0182.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.514] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.514] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.515] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3888, lpOverlapped=0x0) returned 1 [0182.519] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3890, lpOverlapped=0x0) returned 1 [0182.520] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.520] CloseHandle (hObject=0x344) returned 1 [0182.520] CloseHandle (hObject=0x368) returned 1 [0182.520] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0 [0182.520] SetEvent (hEvent=0x2fc) returned 1 [0182.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.522] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6888) returned 1 [0182.522] CloseHandle (hObject=0x368) returned 1 [0182.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220 [0182.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220 [0182.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.522] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.523] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.523] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ae8, lpOverlapped=0x0) returned 1 [0182.525] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1af0, lpOverlapped=0x0) returned 1 [0182.526] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.526] CloseHandle (hObject=0x368) returned 1 [0182.526] CloseHandle (hObject=0x344) returned 1 [0182.526] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0 [0182.527] SetEvent (hEvent=0x2fc) returned 1 [0182.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.527] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7448) returned 1 [0182.527] CloseHandle (hObject=0x344) returned 1 [0182.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220 [0182.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220 [0182.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.528] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.528] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.529] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1d18, lpOverlapped=0x0) returned 1 [0182.530] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1d20, lpOverlapped=0x0) returned 1 [0182.531] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.531] CloseHandle (hObject=0x344) returned 1 [0182.532] CloseHandle (hObject=0x368) returned 1 [0182.532] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0 [0182.532] SetEvent (hEvent=0x2fc) returned 1 [0182.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.533] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7028) returned 1 [0182.533] CloseHandle (hObject=0x368) returned 1 [0182.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220 [0182.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220 [0182.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.534] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.534] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.535] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b74, lpOverlapped=0x0) returned 1 [0182.537] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b80, lpOverlapped=0x0) returned 1 [0182.538] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.538] CloseHandle (hObject=0x368) returned 1 [0182.538] CloseHandle (hObject=0x344) returned 1 [0182.538] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0 [0182.538] SetEvent (hEvent=0x2fc) returned 1 [0182.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.539] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=12696) returned 1 [0182.539] CloseHandle (hObject=0x344) returned 1 [0182.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0x220 [0182.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0x220 [0182.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.539] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.540] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.541] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3198, lpOverlapped=0x0) returned 1 [0182.543] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x31a0, lpOverlapped=0x0) returned 1 [0182.544] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.544] CloseHandle (hObject=0x344) returned 1 [0182.544] CloseHandle (hObject=0x368) returned 1 [0182.544] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0 [0182.544] SetEvent (hEvent=0x2fc) returned 1 [0182.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.545] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5864) returned 1 [0182.545] CloseHandle (hObject=0x368) returned 1 [0182.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220 [0182.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220 [0182.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.546] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.546] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.547] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16e8, lpOverlapped=0x0) returned 1 [0182.551] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16f0, lpOverlapped=0x0) returned 1 [0182.552] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.552] CloseHandle (hObject=0x368) returned 1 [0182.552] CloseHandle (hObject=0x344) returned 1 [0182.552] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0 [0182.552] SetEvent (hEvent=0x2fc) returned 1 [0182.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0182.600] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9736) returned 1 [0182.600] CloseHandle (hObject=0x37c) returned 1 [0182.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220 [0182.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220 [0182.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0182.619] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.619] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0182.627] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2608, lpOverlapped=0x0) returned 1 [0182.628] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2610, lpOverlapped=0x0) returned 1 [0182.630] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.630] CloseHandle (hObject=0x37c) returned 1 [0182.630] CloseHandle (hObject=0x384) returned 1 [0182.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0 [0182.630] SetEvent (hEvent=0x2fc) returned 1 [0182.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0182.631] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=55554) returned 1 [0182.631] CloseHandle (hObject=0x384) returned 1 [0182.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0x220 [0182.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0x220 [0182.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0182.631] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.632] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0182.633] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd902, lpOverlapped=0x0) returned 1 [0182.635] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xd910, lpOverlapped=0x0) returned 1 [0182.637] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.637] CloseHandle (hObject=0x384) returned 1 [0182.637] CloseHandle (hObject=0x37c) returned 1 [0182.637] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0 [0182.637] SetEvent (hEvent=0x2fc) returned 1 [0182.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0182.638] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=36989) returned 1 [0182.638] CloseHandle (hObject=0x37c) returned 1 [0182.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220 [0182.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220 [0182.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0182.638] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.639] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0182.639] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x907d, lpOverlapped=0x0) returned 1 [0182.642] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9080, lpOverlapped=0x0) returned 1 [0182.643] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.643] CloseHandle (hObject=0x37c) returned 1 [0182.643] CloseHandle (hObject=0x384) returned 1 [0182.643] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0 [0182.644] SetEvent (hEvent=0x2fc) returned 1 [0182.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0182.645] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=29204) returned 1 [0182.645] CloseHandle (hObject=0x384) returned 1 [0182.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220 [0182.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220 [0182.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0182.646] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0182.647] ReadFile (in: hFile=0x384, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7214, lpOverlapped=0x0) returned 1 [0182.649] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7220, lpOverlapped=0x0) returned 1 [0182.650] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.650] CloseHandle (hObject=0x384) returned 1 [0182.650] CloseHandle (hObject=0x37c) returned 1 [0182.650] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0 [0182.650] SetEvent (hEvent=0x2fc) returned 1 [0182.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0182.651] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26531) returned 1 [0182.651] CloseHandle (hObject=0x37c) returned 1 [0182.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220 [0182.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220 [0182.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0182.652] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0182.653] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x67a3, lpOverlapped=0x0) returned 1 [0182.658] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x67b0, lpOverlapped=0x0) returned 1 [0182.660] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.660] CloseHandle (hObject=0x37c) returned 1 [0182.660] CloseHandle (hObject=0x384) returned 1 [0182.660] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0 [0182.660] SetEvent (hEvent=0x2fc) returned 1 [0182.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.662] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=24034) returned 1 [0182.662] CloseHandle (hObject=0x360) returned 1 [0182.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0x220 [0182.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0x220 [0182.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0182.663] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.663] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0182.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0182.664] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5de2, lpOverlapped=0x0) returned 1 [0182.785] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5df0, lpOverlapped=0x0) returned 1 [0182.826] WriteFile (in: hFile=0x384, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0182.826] CloseHandle (hObject=0x360) returned 1 [0182.826] CloseHandle (hObject=0x384) returned 1 [0183.094] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0 [0183.119] SetEvent (hEvent=0x2fc) returned 1 [0183.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.120] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16615) returned 1 [0183.120] CloseHandle (hObject=0x344) returned 1 [0183.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0x220 [0183.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0x220 [0183.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.124] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.124] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.125] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x40e7, lpOverlapped=0x0) returned 1 [0183.127] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x40f0, lpOverlapped=0x0) returned 1 [0183.128] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.128] CloseHandle (hObject=0x344) returned 1 [0183.128] CloseHandle (hObject=0x368) returned 1 [0183.129] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0 [0183.129] SetEvent (hEvent=0x2fc) returned 1 [0183.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.130] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=24392) returned 1 [0183.130] CloseHandle (hObject=0x368) returned 1 [0183.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220 [0183.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220 [0183.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.130] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.130] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0183.131] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5f48, lpOverlapped=0x0) returned 1 [0183.133] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5f50, lpOverlapped=0x0) returned 1 [0183.134] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.134] CloseHandle (hObject=0x368) returned 1 [0183.136] CloseHandle (hObject=0x344) returned 1 [0183.136] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0 [0183.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.137] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7822) returned 1 [0183.137] CloseHandle (hObject=0x344) returned 1 [0183.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220 [0183.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220 [0183.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.138] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.138] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.139] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1e8e, lpOverlapped=0x0) returned 1 [0183.141] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1e90, lpOverlapped=0x0) returned 1 [0183.141] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.142] CloseHandle (hObject=0x344) returned 1 [0183.142] CloseHandle (hObject=0x368) returned 1 [0183.142] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0 [0183.142] SetEvent (hEvent=0x2fc) returned 1 [0183.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.143] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16082) returned 1 [0183.143] CloseHandle (hObject=0x368) returned 1 [0183.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0x220 [0183.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0x220 [0183.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.143] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.143] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0183.145] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3ed2, lpOverlapped=0x0) returned 1 [0183.147] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ee0, lpOverlapped=0x0) returned 1 [0183.148] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.148] CloseHandle (hObject=0x368) returned 1 [0183.148] CloseHandle (hObject=0x344) returned 1 [0183.148] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0 [0183.148] SetEvent (hEvent=0x2fc) returned 1 [0183.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.150] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=29788) returned 1 [0183.150] CloseHandle (hObject=0x344) returned 1 [0183.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220 [0183.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220 [0183.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.150] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.150] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.151] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x745c, lpOverlapped=0x0) returned 1 [0183.153] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7460, lpOverlapped=0x0) returned 1 [0183.154] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.154] CloseHandle (hObject=0x344) returned 1 [0183.155] CloseHandle (hObject=0x368) returned 1 [0183.155] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0 [0183.155] SetEvent (hEvent=0x2fc) returned 1 [0183.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.156] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=28626) returned 1 [0183.156] CloseHandle (hObject=0x368) returned 1 [0183.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220 [0183.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220 [0183.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.157] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.157] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.226] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6fd2, lpOverlapped=0x0) returned 1 [0183.255] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6fe0, lpOverlapped=0x0) returned 1 [0183.257] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.257] CloseHandle (hObject=0x368) returned 1 [0183.257] CloseHandle (hObject=0x388) returned 1 [0183.257] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0 [0183.257] SetEvent (hEvent=0x2fc) returned 1 [0183.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.258] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20038) returned 1 [0183.258] CloseHandle (hObject=0x388) returned 1 [0183.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220 [0183.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220 [0183.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.260] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4e46, lpOverlapped=0x0) returned 1 [0183.263] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4e50, lpOverlapped=0x0) returned 1 [0183.264] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.264] CloseHandle (hObject=0x388) returned 1 [0183.264] CloseHandle (hObject=0x368) returned 1 [0183.264] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0 [0183.264] SetEvent (hEvent=0x2fc) returned 1 [0183.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.265] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=27096) returned 1 [0183.265] CloseHandle (hObject=0x368) returned 1 [0183.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0x220 [0183.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0x220 [0183.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.266] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.266] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.267] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x69d8, lpOverlapped=0x0) returned 1 [0183.269] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x69e0, lpOverlapped=0x0) returned 1 [0183.270] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.270] CloseHandle (hObject=0x368) returned 1 [0183.270] CloseHandle (hObject=0x388) returned 1 [0183.270] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 0 [0183.271] SetEvent (hEvent=0x2fc) returned 1 [0183.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.271] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=25312) returned 1 [0183.271] CloseHandle (hObject=0x388) returned 1 [0183.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0x220 [0183.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0x220 [0183.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.272] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.272] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.273] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x62e0, lpOverlapped=0x0) returned 1 [0183.285] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x62f0, lpOverlapped=0x0) returned 1 [0183.307] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.307] CloseHandle (hObject=0x388) returned 1 [0183.307] CloseHandle (hObject=0x368) returned 1 [0183.307] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0 [0183.308] SetEvent (hEvent=0x2fc) returned 1 [0183.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.314] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=59734) returned 1 [0183.314] CloseHandle (hObject=0x368) returned 1 [0183.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220 [0183.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220 [0183.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.315] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.315] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.349] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe956, lpOverlapped=0x0) returned 1 [0183.351] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe960, lpOverlapped=0x0) returned 1 [0183.353] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.353] CloseHandle (hObject=0x368) returned 1 [0183.353] CloseHandle (hObject=0x388) returned 1 [0183.354] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0 [0183.354] SetEvent (hEvent=0x2fc) returned 1 [0183.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.355] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=39330) returned 1 [0183.355] CloseHandle (hObject=0x388) returned 1 [0183.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220 [0183.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220 [0183.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.355] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.355] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.356] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x99a2, lpOverlapped=0x0) returned 1 [0183.521] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x99b0, lpOverlapped=0x0) returned 1 [0183.522] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.522] CloseHandle (hObject=0x388) returned 1 [0183.523] CloseHandle (hObject=0x368) returned 1 [0183.523] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0 [0183.523] SetEvent (hEvent=0x2fc) returned 1 [0183.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.525] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7796) returned 1 [0183.525] CloseHandle (hObject=0x368) returned 1 [0183.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220 [0183.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220 [0183.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.526] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.526] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.527] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1e74, lpOverlapped=0x0) returned 1 [0183.529] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1e80, lpOverlapped=0x0) returned 1 [0183.530] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.530] CloseHandle (hObject=0x368) returned 1 [0183.530] CloseHandle (hObject=0x388) returned 1 [0183.530] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0 [0183.530] SetEvent (hEvent=0x2fc) returned 1 [0183.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.532] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8578) returned 1 [0183.532] CloseHandle (hObject=0x388) returned 1 [0183.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220 [0183.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220 [0183.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.533] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.533] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.534] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2182, lpOverlapped=0x0) returned 1 [0183.535] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2190, lpOverlapped=0x0) returned 1 [0183.536] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.536] CloseHandle (hObject=0x388) returned 1 [0183.536] CloseHandle (hObject=0x368) returned 1 [0183.537] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0 [0183.537] SetEvent (hEvent=0x2fc) returned 1 [0183.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.540] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14308) returned 1 [0183.540] CloseHandle (hObject=0x368) returned 1 [0183.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0x220 [0183.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0x220 [0183.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.540] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.541] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.541] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x37e4, lpOverlapped=0x0) returned 1 [0183.543] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x37f0, lpOverlapped=0x0) returned 1 [0183.544] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.544] CloseHandle (hObject=0x368) returned 1 [0183.545] CloseHandle (hObject=0x388) returned 1 [0183.545] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 0 [0183.545] SetEvent (hEvent=0x2fc) returned 1 [0183.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.546] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8666) returned 1 [0183.546] CloseHandle (hObject=0x388) returned 1 [0183.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0x220 [0183.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0x220 [0183.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.546] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.547] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0183.548] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x21da, lpOverlapped=0x0) returned 1 [0183.549] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x21e0, lpOverlapped=0x0) returned 1 [0183.550] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.551] CloseHandle (hObject=0x388) returned 1 [0183.551] CloseHandle (hObject=0x368) returned 1 [0183.551] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0 [0183.551] SetEvent (hEvent=0x2fc) returned 1 [0183.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.552] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33850) returned 1 [0183.552] CloseHandle (hObject=0x368) returned 1 [0183.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220 [0183.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220 [0183.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0183.553] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.553] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.554] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x843a, lpOverlapped=0x0) returned 1 [0183.555] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8440, lpOverlapped=0x0) returned 1 [0183.557] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.557] CloseHandle (hObject=0x368) returned 1 [0183.557] CloseHandle (hObject=0x388) returned 1 [0183.557] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0 [0183.558] SetEvent (hEvent=0x2fc) returned 1 [0183.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.649] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17662) returned 1 [0183.649] CloseHandle (hObject=0x394) returned 1 [0183.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220 [0183.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220 [0183.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.654] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.654] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.655] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x44fe, lpOverlapped=0x0) returned 1 [0183.657] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4500, lpOverlapped=0x0) returned 1 [0183.658] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.658] CloseHandle (hObject=0x394) returned 1 [0183.658] CloseHandle (hObject=0x398) returned 1 [0183.659] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0 [0183.659] SetEvent (hEvent=0x2fc) returned 1 [0183.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.659] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9344) returned 1 [0183.659] CloseHandle (hObject=0x398) returned 1 [0183.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220 [0183.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220 [0183.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.660] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.660] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.661] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2480, lpOverlapped=0x0) returned 1 [0183.663] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2490, lpOverlapped=0x0) returned 1 [0183.664] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.664] CloseHandle (hObject=0x398) returned 1 [0183.664] CloseHandle (hObject=0x394) returned 1 [0183.664] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0 [0183.664] SetEvent (hEvent=0x2fc) returned 1 [0183.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.665] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16354) returned 1 [0183.665] CloseHandle (hObject=0x394) returned 1 [0183.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220 [0183.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220 [0183.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.666] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.666] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.667] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3fe2, lpOverlapped=0x0) returned 1 [0183.669] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ff0, lpOverlapped=0x0) returned 1 [0183.670] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.670] CloseHandle (hObject=0x394) returned 1 [0183.670] CloseHandle (hObject=0x398) returned 1 [0183.670] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0 [0183.671] SetEvent (hEvent=0x2fc) returned 1 [0183.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.671] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5372) returned 1 [0183.671] CloseHandle (hObject=0x398) returned 1 [0183.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0x220 [0183.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0x220 [0183.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.672] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.672] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.673] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x14fc, lpOverlapped=0x0) returned 1 [0183.675] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1500, lpOverlapped=0x0) returned 1 [0183.676] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.676] CloseHandle (hObject=0x398) returned 1 [0183.676] CloseHandle (hObject=0x394) returned 1 [0183.676] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0 [0183.676] SetEvent (hEvent=0x2fc) returned 1 [0183.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.677] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7116) returned 1 [0183.677] CloseHandle (hObject=0x394) returned 1 [0183.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220 [0183.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220 [0183.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.677] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.678] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.678] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1bcc, lpOverlapped=0x0) returned 1 [0183.680] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1bd0, lpOverlapped=0x0) returned 1 [0183.681] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.681] CloseHandle (hObject=0x394) returned 1 [0183.681] CloseHandle (hObject=0x398) returned 1 [0183.681] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0 [0183.681] SetEvent (hEvent=0x2fc) returned 1 [0183.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.682] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7572) returned 1 [0183.682] CloseHandle (hObject=0x398) returned 1 [0183.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220 [0183.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220 [0183.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.686] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.686] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.686] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1d94, lpOverlapped=0x0) returned 1 [0183.693] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1da0, lpOverlapped=0x0) returned 1 [0183.694] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.694] CloseHandle (hObject=0x398) returned 1 [0183.694] CloseHandle (hObject=0x394) returned 1 [0183.695] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0 [0183.695] SetEvent (hEvent=0x2fc) returned 1 [0183.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.695] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2732) returned 1 [0183.695] CloseHandle (hObject=0x394) returned 1 [0183.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0x220 [0183.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0x220 [0183.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.696] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.724] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xaac, lpOverlapped=0x0) returned 1 [0183.726] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xab0, lpOverlapped=0x0) returned 1 [0183.727] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.727] CloseHandle (hObject=0x394) returned 1 [0183.727] CloseHandle (hObject=0x398) returned 1 [0183.727] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0 [0183.728] SetEvent (hEvent=0x2fc) returned 1 [0183.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.728] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2100) returned 1 [0183.728] CloseHandle (hObject=0x398) returned 1 [0183.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0x220 [0183.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0x220 [0183.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.729] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.729] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.731] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x834, lpOverlapped=0x0) returned 1 [0183.732] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x840, lpOverlapped=0x0) returned 1 [0183.733] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.733] CloseHandle (hObject=0x398) returned 1 [0183.734] CloseHandle (hObject=0x394) returned 1 [0183.734] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0 [0183.734] SetEvent (hEvent=0x2fc) returned 1 [0183.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.735] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5620) returned 1 [0183.735] CloseHandle (hObject=0x394) returned 1 [0183.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0x220 [0183.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0x220 [0183.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.736] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.736] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.737] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x15f4, lpOverlapped=0x0) returned 1 [0183.738] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1600, lpOverlapped=0x0) returned 1 [0183.739] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.739] CloseHandle (hObject=0x394) returned 1 [0183.739] CloseHandle (hObject=0x398) returned 1 [0183.740] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0 [0183.740] SetEvent (hEvent=0x2fc) returned 1 [0183.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.740] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3472) returned 1 [0183.740] CloseHandle (hObject=0x398) returned 1 [0183.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220 [0183.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220 [0183.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.741] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.741] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.742] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd90, lpOverlapped=0x0) returned 1 [0183.743] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xda0, lpOverlapped=0x0) returned 1 [0183.748] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.748] CloseHandle (hObject=0x398) returned 1 [0183.749] CloseHandle (hObject=0x394) returned 1 [0183.749] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0 [0183.749] SetEvent (hEvent=0x2fc) returned 1 [0183.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.750] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5000) returned 1 [0183.750] CloseHandle (hObject=0x394) returned 1 [0183.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0x220 [0183.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0x220 [0183.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.751] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.751] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.752] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1388, lpOverlapped=0x0) returned 1 [0183.753] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1390, lpOverlapped=0x0) returned 1 [0183.754] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.755] CloseHandle (hObject=0x394) returned 1 [0183.755] CloseHandle (hObject=0x398) returned 1 [0183.755] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0 [0183.755] SetEvent (hEvent=0x2fc) returned 1 [0183.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.756] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10716) returned 1 [0183.756] CloseHandle (hObject=0x398) returned 1 [0183.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 0x220 [0183.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 0x220 [0183.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.757] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.757] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.758] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x29dc, lpOverlapped=0x0) returned 1 [0183.759] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x29e0, lpOverlapped=0x0) returned 1 [0183.828] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.829] CloseHandle (hObject=0x398) returned 1 [0183.834] CloseHandle (hObject=0x394) returned 1 [0183.841] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 0 [0183.842] SetEvent (hEvent=0x2fc) returned 1 [0183.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.843] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7332) returned 1 [0183.843] CloseHandle (hObject=0x394) returned 1 [0183.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0x220 [0183.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0x220 [0183.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.844] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.844] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.845] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ca4, lpOverlapped=0x0) returned 1 [0183.847] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1cb0, lpOverlapped=0x0) returned 1 [0183.848] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.848] CloseHandle (hObject=0x394) returned 1 [0183.848] CloseHandle (hObject=0x398) returned 1 [0183.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0 [0183.849] SetEvent (hEvent=0x2fc) returned 1 [0183.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.850] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4534) returned 1 [0183.850] CloseHandle (hObject=0x398) returned 1 [0183.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 0x220 [0183.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 0x220 [0183.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.851] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.851] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.852] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11b6, lpOverlapped=0x0) returned 1 [0183.854] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11c0, lpOverlapped=0x0) returned 1 [0183.855] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.855] CloseHandle (hObject=0x398) returned 1 [0183.855] CloseHandle (hObject=0x394) returned 1 [0183.855] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 0 [0183.855] SetEvent (hEvent=0x2fc) returned 1 [0183.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.856] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8314) returned 1 [0183.857] CloseHandle (hObject=0x394) returned 1 [0183.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0x220 [0183.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0x220 [0183.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.857] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.857] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.858] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x207a, lpOverlapped=0x0) returned 1 [0183.860] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2080, lpOverlapped=0x0) returned 1 [0183.861] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.861] CloseHandle (hObject=0x394) returned 1 [0183.861] CloseHandle (hObject=0x398) returned 1 [0183.861] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0 [0183.861] SetEvent (hEvent=0x2fc) returned 1 [0183.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.862] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=29432) returned 1 [0183.862] CloseHandle (hObject=0x398) returned 1 [0183.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0x220 [0183.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0x220 [0183.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.863] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.863] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.863] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x72f8, lpOverlapped=0x0) returned 1 [0183.866] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7300, lpOverlapped=0x0) returned 1 [0183.867] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.867] CloseHandle (hObject=0x398) returned 1 [0183.867] CloseHandle (hObject=0x394) returned 1 [0183.868] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0 [0183.868] SetEvent (hEvent=0x2fc) returned 1 [0183.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.870] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21328) returned 1 [0183.870] CloseHandle (hObject=0x394) returned 1 [0183.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0x220 [0183.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0x220 [0183.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.871] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.871] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.872] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5350, lpOverlapped=0x0) returned 1 [0183.874] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5360, lpOverlapped=0x0) returned 1 [0183.875] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.875] CloseHandle (hObject=0x394) returned 1 [0183.876] CloseHandle (hObject=0x398) returned 1 [0183.876] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0 [0183.876] SetEvent (hEvent=0x2fc) returned 1 [0183.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.877] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=18622) returned 1 [0183.877] CloseHandle (hObject=0x398) returned 1 [0183.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 0x220 [0183.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 0x220 [0183.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.878] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x48be, lpOverlapped=0x0) returned 1 [0183.954] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x48c0, lpOverlapped=0x0) returned 1 [0183.970] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.970] CloseHandle (hObject=0x398) returned 1 [0183.970] CloseHandle (hObject=0x394) returned 1 [0183.970] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 0 [0183.971] SetEvent (hEvent=0x2fc) returned 1 [0183.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.972] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6912) returned 1 [0183.972] CloseHandle (hObject=0x394) returned 1 [0183.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 0x220 [0183.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 0x220 [0183.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.973] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.973] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.974] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b00, lpOverlapped=0x0) returned 1 [0183.976] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b10, lpOverlapped=0x0) returned 1 [0183.977] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.977] CloseHandle (hObject=0x394) returned 1 [0183.977] CloseHandle (hObject=0x398) returned 1 [0183.977] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 0 [0183.978] SetEvent (hEvent=0x2fc) returned 1 [0183.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.978] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5708) returned 1 [0183.979] CloseHandle (hObject=0x398) returned 1 [0183.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 0x220 [0183.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 0x220 [0183.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.979] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.979] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.980] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x164c, lpOverlapped=0x0) returned 1 [0183.981] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1650, lpOverlapped=0x0) returned 1 [0183.982] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.983] CloseHandle (hObject=0x398) returned 1 [0183.983] CloseHandle (hObject=0x394) returned 1 [0183.983] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 0 [0183.983] SetEvent (hEvent=0x2fc) returned 1 [0183.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.984] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=40230) returned 1 [0183.984] CloseHandle (hObject=0x394) returned 1 [0183.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 0x220 [0183.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 0x220 [0183.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.984] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.984] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.985] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9d26, lpOverlapped=0x0) returned 1 [0183.987] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9d30, lpOverlapped=0x0) returned 1 [0183.988] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.989] CloseHandle (hObject=0x394) returned 1 [0183.989] CloseHandle (hObject=0x398) returned 1 [0183.989] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 0 [0183.989] SetEvent (hEvent=0x2fc) returned 1 [0183.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.990] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26252) returned 1 [0183.990] CloseHandle (hObject=0x398) returned 1 [0183.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 0x220 [0183.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 0x220 [0183.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.991] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.991] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.992] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x668c, lpOverlapped=0x0) returned 1 [0183.994] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6690, lpOverlapped=0x0) returned 1 [0183.995] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0183.995] CloseHandle (hObject=0x398) returned 1 [0183.995] CloseHandle (hObject=0x394) returned 1 [0183.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 0 [0183.995] SetEvent (hEvent=0x2fc) returned 1 [0183.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.997] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33948) returned 1 [0183.997] CloseHandle (hObject=0x394) returned 1 [0183.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf")) returned 0x220 [0183.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf")) returned 0x220 [0183.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.997] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.997] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0183.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.999] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x849c, lpOverlapped=0x0) returned 1 [0184.001] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x84a0, lpOverlapped=0x0) returned 1 [0184.002] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.002] CloseHandle (hObject=0x394) returned 1 [0184.002] CloseHandle (hObject=0x398) returned 1 [0184.002] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf")) returned 0 [0184.003] SetEvent (hEvent=0x2fc) returned 1 [0184.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.004] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=23726) returned 1 [0184.004] CloseHandle (hObject=0x398) returned 1 [0184.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 0x220 [0184.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 0x220 [0184.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.004] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.004] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.005] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5cae, lpOverlapped=0x0) returned 1 [0184.071] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5cb0, lpOverlapped=0x0) returned 1 [0184.098] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.098] CloseHandle (hObject=0x398) returned 1 [0184.098] CloseHandle (hObject=0x394) returned 1 [0184.098] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 0 [0184.099] SetEvent (hEvent=0x2fc) returned 1 [0184.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.100] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42654) returned 1 [0184.100] CloseHandle (hObject=0x394) returned 1 [0184.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf")) returned 0x220 [0184.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf")) returned 0x220 [0184.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.100] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.100] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.102] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa69e, lpOverlapped=0x0) returned 1 [0184.113] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa6a0, lpOverlapped=0x0) returned 1 [0184.115] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.115] CloseHandle (hObject=0x394) returned 1 [0184.115] CloseHandle (hObject=0x398) returned 1 [0184.115] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf")) returned 0 [0184.115] SetEvent (hEvent=0x2fc) returned 1 [0184.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.117] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=28572) returned 1 [0184.117] CloseHandle (hObject=0x398) returned 1 [0184.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 0x220 [0184.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 0x220 [0184.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.122] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.122] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.124] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6f9c, lpOverlapped=0x0) returned 1 [0184.126] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6fa0, lpOverlapped=0x0) returned 1 [0184.127] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.127] CloseHandle (hObject=0x398) returned 1 [0184.127] CloseHandle (hObject=0x394) returned 1 [0184.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 0 [0184.128] SetEvent (hEvent=0x2fc) returned 1 [0184.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.129] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=40300) returned 1 [0184.129] CloseHandle (hObject=0x394) returned 1 [0184.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 0x220 [0184.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 0x220 [0184.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.130] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.130] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.131] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9d6c, lpOverlapped=0x0) returned 1 [0184.133] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9d70, lpOverlapped=0x0) returned 1 [0184.134] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.135] CloseHandle (hObject=0x394) returned 1 [0184.135] CloseHandle (hObject=0x398) returned 1 [0184.135] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 0 [0184.135] SetEvent (hEvent=0x2fc) returned 1 [0184.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.136] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=49676) returned 1 [0184.136] CloseHandle (hObject=0x398) returned 1 [0184.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 0x220 [0184.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 0x220 [0184.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.136] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.136] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.137] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xc20c, lpOverlapped=0x0) returned 1 [0184.140] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xc210, lpOverlapped=0x0) returned 1 [0184.142] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.142] CloseHandle (hObject=0x398) returned 1 [0184.142] CloseHandle (hObject=0x394) returned 1 [0184.142] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 0 [0184.142] SetEvent (hEvent=0x2fc) returned 1 [0184.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.143] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=44552) returned 1 [0184.143] CloseHandle (hObject=0x394) returned 1 [0184.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf")) returned 0x220 [0184.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf")) returned 0x220 [0184.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.144] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.144] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.144] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.146] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xae08, lpOverlapped=0x0) returned 1 [0184.358] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xae10, lpOverlapped=0x0) returned 1 [0184.360] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.360] CloseHandle (hObject=0x394) returned 1 [0184.360] CloseHandle (hObject=0x398) returned 1 [0184.360] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf")) returned 0 [0184.361] SetEvent (hEvent=0x2fc) returned 1 [0184.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.363] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=29006) returned 1 [0184.363] CloseHandle (hObject=0x398) returned 1 [0184.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 0x220 [0184.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 0x220 [0184.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.363] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.364] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.365] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x714e, lpOverlapped=0x0) returned 1 [0184.465] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7150, lpOverlapped=0x0) returned 1 [0184.466] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.466] CloseHandle (hObject=0x398) returned 1 [0184.466] CloseHandle (hObject=0x394) returned 1 [0184.466] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 0 [0184.467] SetEvent (hEvent=0x2fc) returned 1 [0184.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.471] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31822) returned 1 [0184.471] CloseHandle (hObject=0x394) returned 1 [0184.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 0x220 [0184.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 0x220 [0184.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.472] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.472] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.473] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7c4e, lpOverlapped=0x0) returned 1 [0184.477] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7c50, lpOverlapped=0x0) returned 1 [0184.479] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.479] CloseHandle (hObject=0x394) returned 1 [0184.479] CloseHandle (hObject=0x398) returned 1 [0184.483] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 0 [0184.483] SetEvent (hEvent=0x2fc) returned 1 [0184.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.484] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26154) returned 1 [0184.484] CloseHandle (hObject=0x398) returned 1 [0184.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 0x220 [0184.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 0x220 [0184.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.485] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.485] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.485] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x662a, lpOverlapped=0x0) returned 1 [0184.488] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6630, lpOverlapped=0x0) returned 1 [0184.489] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.489] CloseHandle (hObject=0x398) returned 1 [0184.489] CloseHandle (hObject=0x394) returned 1 [0184.489] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 0 [0184.490] SetEvent (hEvent=0x2fc) returned 1 [0184.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.491] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16676) returned 1 [0184.491] CloseHandle (hObject=0x394) returned 1 [0184.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf")) returned 0x220 [0184.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf")) returned 0x220 [0184.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.492] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.492] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.493] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4124, lpOverlapped=0x0) returned 1 [0184.495] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4130, lpOverlapped=0x0) returned 1 [0184.496] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.496] CloseHandle (hObject=0x394) returned 1 [0184.496] CloseHandle (hObject=0x398) returned 1 [0184.496] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf")) returned 0 [0184.497] SetEvent (hEvent=0x2fc) returned 1 [0184.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.498] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5060) returned 1 [0184.498] CloseHandle (hObject=0x398) returned 1 [0184.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 0x220 [0184.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 0x220 [0184.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.499] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.499] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.499] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x13c4, lpOverlapped=0x0) returned 1 [0184.501] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x13d0, lpOverlapped=0x0) returned 1 [0184.502] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.502] CloseHandle (hObject=0x398) returned 1 [0184.502] CloseHandle (hObject=0x394) returned 1 [0184.502] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 0 [0184.503] SetEvent (hEvent=0x2fc) returned 1 [0184.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.504] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13756) returned 1 [0184.504] CloseHandle (hObject=0x394) returned 1 [0184.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 0x220 [0184.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 0x220 [0184.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.504] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.505] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.505] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x35bc, lpOverlapped=0x0) returned 1 [0184.596] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x35c0, lpOverlapped=0x0) returned 1 [0184.597] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.597] CloseHandle (hObject=0x394) returned 1 [0184.598] CloseHandle (hObject=0x398) returned 1 [0184.598] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 0 [0184.598] SetEvent (hEvent=0x2fc) returned 1 [0184.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.631] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7180) returned 1 [0184.631] CloseHandle (hObject=0x398) returned 1 [0184.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf")) returned 0x220 [0184.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf")) returned 0x220 [0184.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.632] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.633] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1c0c, lpOverlapped=0x0) returned 1 [0184.636] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1c10, lpOverlapped=0x0) returned 1 [0184.637] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.637] CloseHandle (hObject=0x398) returned 1 [0184.637] CloseHandle (hObject=0x394) returned 1 [0184.637] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf")) returned 0 [0184.638] SetEvent (hEvent=0x2fc) returned 1 [0184.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.638] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5312) returned 1 [0184.638] CloseHandle (hObject=0x394) returned 1 [0184.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 0x220 [0184.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 0x220 [0184.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.639] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.639] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.640] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x14c0, lpOverlapped=0x0) returned 1 [0184.642] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x14d0, lpOverlapped=0x0) returned 1 [0184.643] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.643] CloseHandle (hObject=0x394) returned 1 [0184.644] CloseHandle (hObject=0x398) returned 1 [0184.644] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 0 [0184.644] SetEvent (hEvent=0x2fc) returned 1 [0184.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.644] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8060) returned 1 [0184.645] CloseHandle (hObject=0x398) returned 1 [0184.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 0x220 [0184.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 0x220 [0184.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.645] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.645] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.648] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f7c, lpOverlapped=0x0) returned 1 [0184.652] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f80, lpOverlapped=0x0) returned 1 [0184.653] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.653] CloseHandle (hObject=0x398) returned 1 [0184.653] CloseHandle (hObject=0x394) returned 1 [0184.653] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 0 [0184.654] SetEvent (hEvent=0x2fc) returned 1 [0184.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.655] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31302) returned 1 [0184.655] CloseHandle (hObject=0x394) returned 1 [0184.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 0x220 [0184.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 0x220 [0184.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.656] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.656] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.657] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7a46, lpOverlapped=0x0) returned 1 [0184.659] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7a50, lpOverlapped=0x0) returned 1 [0184.660] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.660] CloseHandle (hObject=0x394) returned 1 [0184.660] CloseHandle (hObject=0x398) returned 1 [0184.661] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 0 [0184.661] SetEvent (hEvent=0x2fc) returned 1 [0184.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.662] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19466) returned 1 [0184.662] CloseHandle (hObject=0x398) returned 1 [0184.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf")) returned 0x220 [0184.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf")) returned 0x220 [0184.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.663] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.663] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.664] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4c0a, lpOverlapped=0x0) returned 1 [0184.666] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4c10, lpOverlapped=0x0) returned 1 [0184.667] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.667] CloseHandle (hObject=0x398) returned 1 [0184.667] CloseHandle (hObject=0x394) returned 1 [0184.668] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf")) returned 0 [0184.668] SetEvent (hEvent=0x2fc) returned 1 [0184.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.669] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=41136) returned 1 [0184.669] CloseHandle (hObject=0x394) returned 1 [0184.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 0x220 [0184.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 0x220 [0184.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.669] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.669] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.670] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa0b0, lpOverlapped=0x0) returned 1 [0184.722] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa0c0, lpOverlapped=0x0) returned 1 [0184.724] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.724] CloseHandle (hObject=0x394) returned 1 [0184.724] CloseHandle (hObject=0x398) returned 1 [0184.724] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 0 [0184.725] SetEvent (hEvent=0x2fc) returned 1 [0184.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.789] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=28276) returned 1 [0184.789] CloseHandle (hObject=0x394) returned 1 [0184.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf")) returned 0x220 [0184.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf")) returned 0x220 [0184.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.790] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.790] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0184.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.791] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6e74, lpOverlapped=0x0) returned 1 [0184.860] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6e80, lpOverlapped=0x0) returned 1 [0184.862] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0184.862] CloseHandle (hObject=0x394) returned 1 [0184.863] CloseHandle (hObject=0x368) returned 1 [0184.863] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf")) returned 0 [0184.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.875] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31926) returned 1 [0184.875] CloseHandle (hObject=0x368) returned 1 [0184.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf")) returned 0x220 [0184.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf")) returned 0x220 [0184.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.145] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.145] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.146] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7cb6, lpOverlapped=0x0) returned 1 [0185.190] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7cc0, lpOverlapped=0x0) returned 1 [0185.191] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.192] CloseHandle (hObject=0x398) returned 1 [0185.192] CloseHandle (hObject=0x368) returned 1 [0185.192] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf")) returned 0 [0185.192] SetEvent (hEvent=0x2fc) returned 1 [0185.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0185.356] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9290) returned 1 [0185.356] CloseHandle (hObject=0x388) returned 1 [0185.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 0x220 [0185.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 0x220 [0185.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0185.360] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.360] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.363] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x244a, lpOverlapped=0x0) returned 1 [0185.365] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2450, lpOverlapped=0x0) returned 1 [0185.367] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.367] CloseHandle (hObject=0x388) returned 1 [0185.367] CloseHandle (hObject=0x394) returned 1 [0185.367] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 0 [0185.368] SetEvent (hEvent=0x2fc) returned 1 [0185.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.370] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5618) returned 1 [0185.370] CloseHandle (hObject=0x394) returned 1 [0185.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 0x220 [0185.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 0x220 [0185.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.370] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.370] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0185.371] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x15f2, lpOverlapped=0x0) returned 1 [0185.436] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1600, lpOverlapped=0x0) returned 1 [0185.441] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.442] CloseHandle (hObject=0x394) returned 1 [0185.442] CloseHandle (hObject=0x388) returned 1 [0185.452] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 0 [0185.452] SetEvent (hEvent=0x2fc) returned 1 [0185.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.542] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42883) returned 1 [0185.542] CloseHandle (hObject=0x394) returned 1 [0185.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 0x220 [0185.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 0x220 [0185.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.543] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.543] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.544] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa783, lpOverlapped=0x0) returned 1 [0185.569] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa790, lpOverlapped=0x0) returned 1 [0185.571] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.571] CloseHandle (hObject=0x394) returned 1 [0185.571] CloseHandle (hObject=0x368) returned 1 [0185.572] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 0 [0185.572] SetEvent (hEvent=0x2fc) returned 1 [0185.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.574] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=39738) returned 1 [0185.574] CloseHandle (hObject=0x368) returned 1 [0185.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 0x220 [0185.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 0x220 [0185.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.575] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.575] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.576] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9b3a, lpOverlapped=0x0) returned 1 [0185.578] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9b40, lpOverlapped=0x0) returned 1 [0185.580] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.580] CloseHandle (hObject=0x368) returned 1 [0185.580] CloseHandle (hObject=0x394) returned 1 [0185.580] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 0 [0185.581] SetEvent (hEvent=0x2fc) returned 1 [0185.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.582] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5252) returned 1 [0185.582] CloseHandle (hObject=0x394) returned 1 [0185.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 0x220 [0185.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 0x220 [0185.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.583] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.583] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.584] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1484, lpOverlapped=0x0) returned 1 [0185.586] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1490, lpOverlapped=0x0) returned 1 [0185.587] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.587] CloseHandle (hObject=0x394) returned 1 [0185.587] CloseHandle (hObject=0x368) returned 1 [0185.588] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 0 [0185.588] SetEvent (hEvent=0x2fc) returned 1 [0185.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.589] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3482) returned 1 [0185.589] CloseHandle (hObject=0x368) returned 1 [0185.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf")) returned 0x220 [0185.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf")) returned 0x220 [0185.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.590] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.591] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xd9a, lpOverlapped=0x0) returned 1 [0185.592] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xda0, lpOverlapped=0x0) returned 1 [0185.594] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.594] CloseHandle (hObject=0x368) returned 1 [0185.594] CloseHandle (hObject=0x394) returned 1 [0185.594] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf")) returned 0 [0185.594] SetEvent (hEvent=0x2fc) returned 1 [0185.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.596] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7336) returned 1 [0185.596] CloseHandle (hObject=0x394) returned 1 [0185.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 0x220 [0185.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 0x220 [0185.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.596] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.596] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.597] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ca8, lpOverlapped=0x0) returned 1 [0185.671] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1cb0, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.672] CloseHandle (hObject=0x394) returned 1 [0185.672] CloseHandle (hObject=0x368) returned 1 [0185.672] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 0 [0185.673] SetEvent (hEvent=0x2fc) returned 1 [0185.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.675] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4198) returned 1 [0185.675] CloseHandle (hObject=0x368) returned 1 [0185.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 0x220 [0185.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 0x220 [0185.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.676] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.676] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.677] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1066, lpOverlapped=0x0) returned 1 [0185.679] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1070, lpOverlapped=0x0) returned 1 [0185.680] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.680] CloseHandle (hObject=0x368) returned 1 [0185.680] CloseHandle (hObject=0x394) returned 1 [0185.680] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 0 [0185.680] SetEvent (hEvent=0x2fc) returned 1 [0185.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.681] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13098) returned 1 [0185.681] CloseHandle (hObject=0x394) returned 1 [0185.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf")) returned 0x220 [0185.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf")) returned 0x220 [0185.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.682] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.682] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.684] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x332a, lpOverlapped=0x0) returned 1 [0185.685] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3330, lpOverlapped=0x0) returned 1 [0185.687] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.687] CloseHandle (hObject=0x394) returned 1 [0185.687] CloseHandle (hObject=0x368) returned 1 [0185.687] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf")) returned 0 [0185.688] SetEvent (hEvent=0x2fc) returned 1 [0185.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.689] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=27586) returned 1 [0185.689] CloseHandle (hObject=0x368) returned 1 [0185.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 0x220 [0185.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 0x220 [0185.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.689] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.690] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.690] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6bc2, lpOverlapped=0x0) returned 1 [0185.693] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6bd0, lpOverlapped=0x0) returned 1 [0185.694] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.694] CloseHandle (hObject=0x368) returned 1 [0185.695] CloseHandle (hObject=0x394) returned 1 [0185.695] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 0 [0185.695] SetEvent (hEvent=0x2fc) returned 1 [0185.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.696] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=41094) returned 1 [0185.696] CloseHandle (hObject=0x394) returned 1 [0185.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 0x220 [0185.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 0x220 [0185.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.697] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.697] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.698] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa086, lpOverlapped=0x0) returned 1 [0185.700] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa090, lpOverlapped=0x0) returned 1 [0185.702] WriteFile (in: hFile=0x368, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0185.702] CloseHandle (hObject=0x394) returned 1 [0185.702] CloseHandle (hObject=0x368) returned 1 [0185.702] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 0 [0185.703] SetEvent (hEvent=0x2fc) returned 1 [0185.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.704] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14346) returned 1 [0185.704] CloseHandle (hObject=0x368) returned 1 [0185.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 0x220 [0185.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 0x220 [0185.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.705] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.705] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0185.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.706] ReadFile (in: hFile=0x368, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x380a, lpOverlapped=0x0) returned 1 [0185.708] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3810, lpOverlapped=0x0) returned 1 [0185.709] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.190] CloseHandle (hObject=0x368) returned 1 [0186.190] CloseHandle (hObject=0x394) returned 1 [0186.190] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 0 [0186.190] SetEvent (hEvent=0x2fc) returned 1 [0186.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.487] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9960) returned 1 [0186.487] CloseHandle (hObject=0x39c) returned 1 [0186.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 0x220 [0186.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 0x220 [0186.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.488] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.488] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.490] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x26e8, lpOverlapped=0x0) returned 1 [0186.492] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x26f0, lpOverlapped=0x0) returned 1 [0186.493] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.494] CloseHandle (hObject=0x39c) returned 1 [0186.494] CloseHandle (hObject=0x394) returned 1 [0186.494] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 0 [0186.495] SetEvent (hEvent=0x2fc) returned 1 [0186.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.497] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=38750) returned 1 [0186.497] CloseHandle (hObject=0x394) returned 1 [0186.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf")) returned 0x220 [0186.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf")) returned 0x220 [0186.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.498] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.498] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.500] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x975e, lpOverlapped=0x0) returned 1 [0186.502] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9760, lpOverlapped=0x0) returned 1 [0186.504] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.504] CloseHandle (hObject=0x394) returned 1 [0186.504] CloseHandle (hObject=0x39c) returned 1 [0186.504] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf")) returned 0 [0186.505] SetEvent (hEvent=0x2fc) returned 1 [0186.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.506] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=52934) returned 1 [0186.506] CloseHandle (hObject=0x39c) returned 1 [0186.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 0x220 [0186.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 0x220 [0186.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.507] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.507] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.508] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xcec6, lpOverlapped=0x0) returned 1 [0186.511] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xced0, lpOverlapped=0x0) returned 1 [0186.513] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.513] CloseHandle (hObject=0x39c) returned 1 [0186.513] CloseHandle (hObject=0x394) returned 1 [0186.513] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 0 [0186.513] SetEvent (hEvent=0x2fc) returned 1 [0186.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.515] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19264) returned 1 [0186.515] CloseHandle (hObject=0x394) returned 1 [0186.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 0x220 [0186.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 0x220 [0186.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.516] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.516] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.517] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4b40, lpOverlapped=0x0) returned 1 [0186.519] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4b50, lpOverlapped=0x0) returned 1 [0186.520] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.520] CloseHandle (hObject=0x394) returned 1 [0186.520] CloseHandle (hObject=0x39c) returned 1 [0186.520] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 0 [0186.521] SetEvent (hEvent=0x2fc) returned 1 [0186.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.521] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=32980) returned 1 [0186.522] CloseHandle (hObject=0x39c) returned 1 [0186.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 0x220 [0186.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 0x220 [0186.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.670] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x80d4, lpOverlapped=0x0) returned 1 [0186.673] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x80e0, lpOverlapped=0x0) returned 1 [0186.683] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.683] CloseHandle (hObject=0x39c) returned 1 [0186.683] CloseHandle (hObject=0x394) returned 1 [0186.684] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 0 [0186.684] SetEvent (hEvent=0x2fc) returned 1 [0186.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.686] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=22944) returned 1 [0186.686] CloseHandle (hObject=0x394) returned 1 [0186.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf")) returned 0x220 [0186.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf")) returned 0x220 [0186.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.686] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.687] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.688] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x59a0, lpOverlapped=0x0) returned 1 [0186.691] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x59b0, lpOverlapped=0x0) returned 1 [0186.692] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.692] CloseHandle (hObject=0x394) returned 1 [0186.692] CloseHandle (hObject=0x39c) returned 1 [0186.692] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf")) returned 0 [0186.693] SetEvent (hEvent=0x2fc) returned 1 [0186.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.694] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4916) returned 1 [0186.694] CloseHandle (hObject=0x39c) returned 1 [0186.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 0x220 [0186.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 0x220 [0186.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.702] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.702] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.703] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1334, lpOverlapped=0x0) returned 1 [0186.705] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1340, lpOverlapped=0x0) returned 1 [0186.706] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.706] CloseHandle (hObject=0x39c) returned 1 [0186.706] CloseHandle (hObject=0x394) returned 1 [0186.706] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 0 [0186.707] SetEvent (hEvent=0x2fc) returned 1 [0186.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.708] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5048) returned 1 [0186.708] CloseHandle (hObject=0x394) returned 1 [0186.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 0x220 [0186.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 0x220 [0186.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.709] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.709] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.710] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x13b8, lpOverlapped=0x0) returned 1 [0186.712] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x13c0, lpOverlapped=0x0) returned 1 [0186.713] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.713] CloseHandle (hObject=0x394) returned 1 [0186.713] CloseHandle (hObject=0x39c) returned 1 [0186.714] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 0 [0186.714] SetEvent (hEvent=0x2fc) returned 1 [0186.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.715] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4740) returned 1 [0186.715] CloseHandle (hObject=0x39c) returned 1 [0186.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf")) returned 0x220 [0186.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf")) returned 0x220 [0186.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.716] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.716] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.717] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1284, lpOverlapped=0x0) returned 1 [0186.719] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1290, lpOverlapped=0x0) returned 1 [0186.720] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.720] CloseHandle (hObject=0x39c) returned 1 [0186.720] CloseHandle (hObject=0x394) returned 1 [0186.720] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf")) returned 0 [0186.720] SetEvent (hEvent=0x2fc) returned 1 [0186.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.722] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5884) returned 1 [0186.722] CloseHandle (hObject=0x394) returned 1 [0186.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 0x220 [0186.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 0x220 [0186.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.723] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.723] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.723] ReadFile (in: hFile=0x394, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16fc, lpOverlapped=0x0) returned 1 [0186.725] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1700, lpOverlapped=0x0) returned 1 [0186.881] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.881] CloseHandle (hObject=0x394) returned 1 [0186.882] CloseHandle (hObject=0x39c) returned 1 [0186.882] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 0 [0186.882] SetEvent (hEvent=0x2fc) returned 1 [0186.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.883] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5144) returned 1 [0186.883] CloseHandle (hObject=0x39c) returned 1 [0186.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 0x220 [0186.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 0x220 [0186.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.884] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.884] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0186.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.885] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1418, lpOverlapped=0x0) returned 1 [0186.898] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1420, lpOverlapped=0x0) returned 1 [0186.900] WriteFile (in: hFile=0x394, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0186.900] CloseHandle (hObject=0x39c) returned 1 [0186.900] CloseHandle (hObject=0x394) returned 1 [0186.900] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 0 [0186.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.087] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7232) returned 1 [0187.087] CloseHandle (hObject=0x390) returned 1 [0187.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf")) returned 0x220 [0187.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf")) returned 0x220 [0187.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.088] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.088] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0187.090] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1c40, lpOverlapped=0x0) returned 1 [0187.091] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1c50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1c50, lpOverlapped=0x0) returned 1 [0187.092] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.093] CloseHandle (hObject=0x390) returned 1 [0187.093] CloseHandle (hObject=0x37c) returned 1 [0187.093] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf")) returned 0 [0187.093] SetEvent (hEvent=0x2fc) returned 1 [0187.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.094] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5096) returned 1 [0187.094] CloseHandle (hObject=0x37c) returned 1 [0187.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 0x220 [0187.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 0x220 [0187.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.095] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.095] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.096] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x13e8, lpOverlapped=0x0) returned 1 [0187.098] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x13f0, lpOverlapped=0x0) returned 1 [0187.099] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.099] CloseHandle (hObject=0x37c) returned 1 [0187.099] CloseHandle (hObject=0x390) returned 1 [0187.100] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 0 [0187.100] SetEvent (hEvent=0x2fc) returned 1 [0187.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.101] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3488) returned 1 [0187.101] CloseHandle (hObject=0x390) returned 1 [0187.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 0x220 [0187.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 0x220 [0187.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.102] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.102] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0187.103] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xda0, lpOverlapped=0x0) returned 1 [0187.111] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xdb0, lpOverlapped=0x0) returned 1 [0187.112] WriteFile (in: hFile=0x37c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.113] CloseHandle (hObject=0x390) returned 1 [0187.113] CloseHandle (hObject=0x37c) returned 1 [0187.113] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 0 [0187.113] SetEvent (hEvent=0x2fc) returned 1 [0187.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.115] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3288) returned 1 [0187.115] CloseHandle (hObject=0x37c) returned 1 [0187.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 0x220 [0187.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 0x220 [0187.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.115] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.115] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.117] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xcd8, lpOverlapped=0x0) returned 1 [0187.118] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xce0, lpOverlapped=0x0) returned 1 [0187.119] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.120] CloseHandle (hObject=0x37c) returned 1 [0187.120] CloseHandle (hObject=0x390) returned 1 [0187.120] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 0 [0187.120] SetEvent (hEvent=0x2fc) returned 1 [0187.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.121] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7672) returned 1 [0187.121] CloseHandle (hObject=0x390) returned 1 [0187.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf")) returned 0x220 [0187.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf")) returned 0x220 [0187.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.122] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0187.396] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1df8, lpOverlapped=0x0) returned 1 [0187.398] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1e00, lpOverlapped=0x0) returned 1 [0187.399] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.399] CloseHandle (hObject=0x390) returned 1 [0187.399] CloseHandle (hObject=0x25c) returned 1 [0187.400] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf")) returned 0 [0187.400] SetEvent (hEvent=0x2fc) returned 1 [0187.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.401] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42000) returned 1 [0187.401] CloseHandle (hObject=0x25c) returned 1 [0187.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 0x220 [0187.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 0x220 [0187.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.403] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.403] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.404] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa410, lpOverlapped=0x0) returned 1 [0187.407] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa420, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa420, lpOverlapped=0x0) returned 1 [0187.409] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.409] CloseHandle (hObject=0x25c) returned 1 [0187.409] CloseHandle (hObject=0x390) returned 1 [0187.409] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 0 [0187.409] SetEvent (hEvent=0x2fc) returned 1 [0187.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.411] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3524) returned 1 [0187.411] CloseHandle (hObject=0x390) returned 1 [0187.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 0x220 [0187.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 0x220 [0187.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.412] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.412] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0187.413] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xdc4, lpOverlapped=0x0) returned 1 [0187.416] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xdd0, lpOverlapped=0x0) returned 1 [0187.418] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.418] CloseHandle (hObject=0x390) returned 1 [0187.418] CloseHandle (hObject=0x25c) returned 1 [0187.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 0 [0187.418] SetEvent (hEvent=0x2fc) returned 1 [0187.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.419] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=5238) returned 1 [0187.419] CloseHandle (hObject=0x25c) returned 1 [0187.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 0x220 [0187.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 0x220 [0187.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.420] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.420] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.421] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1476, lpOverlapped=0x0) returned 1 [0187.423] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1480, lpOverlapped=0x0) returned 1 [0187.424] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.424] CloseHandle (hObject=0x25c) returned 1 [0187.424] CloseHandle (hObject=0x390) returned 1 [0187.424] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 0 [0187.425] SetEvent (hEvent=0x2fc) returned 1 [0187.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.425] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2350) returned 1 [0187.425] CloseHandle (hObject=0x390) returned 1 [0187.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf")) returned 0x220 [0187.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf")) returned 0x220 [0187.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.426] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.426] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0187.427] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x92e, lpOverlapped=0x0) returned 1 [0187.429] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x930, lpOverlapped=0x0) returned 1 [0187.430] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.430] CloseHandle (hObject=0x390) returned 1 [0187.430] CloseHandle (hObject=0x25c) returned 1 [0187.430] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf")) returned 0 [0187.430] SetEvent (hEvent=0x2fc) returned 1 [0187.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.431] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2638) returned 1 [0187.431] CloseHandle (hObject=0x25c) returned 1 [0187.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 0x220 [0187.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 0x220 [0187.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.432] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.432] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.433] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa4e, lpOverlapped=0x0) returned 1 [0187.696] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa50, lpOverlapped=0x0) returned 1 [0187.697] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.697] CloseHandle (hObject=0x25c) returned 1 [0187.698] CloseHandle (hObject=0x390) returned 1 [0187.698] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 0 [0187.698] SetEvent (hEvent=0x2fc) returned 1 [0187.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.699] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=26968) returned 1 [0187.699] CloseHandle (hObject=0x390) returned 1 [0187.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf")) returned 0x220 [0187.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf")) returned 0x220 [0187.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0187.701] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6958, lpOverlapped=0x0) returned 1 [0187.703] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6960, lpOverlapped=0x0) returned 1 [0187.706] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.706] CloseHandle (hObject=0x390) returned 1 [0187.706] CloseHandle (hObject=0x25c) returned 1 [0187.706] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf")) returned 0 [0187.707] SetEvent (hEvent=0x2fc) returned 1 [0187.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.708] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=69644) returned 1 [0187.708] CloseHandle (hObject=0x25c) returned 1 [0187.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 0x220 [0187.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 0x220 [0187.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.709] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.709] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.710] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1100c, lpOverlapped=0x0) returned 1 [0187.712] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11010, lpOverlapped=0x0) returned 1 [0187.715] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.715] CloseHandle (hObject=0x25c) returned 1 [0187.715] CloseHandle (hObject=0x390) returned 1 [0187.715] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 0 [0187.716] SetEvent (hEvent=0x2fc) returned 1 [0187.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.717] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=2786) returned 1 [0187.717] CloseHandle (hObject=0x390) returned 1 [0187.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 0x220 [0187.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 0x220 [0187.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.718] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.718] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0187.719] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xae2, lpOverlapped=0x0) returned 1 [0187.720] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xaf0, lpOverlapped=0x0) returned 1 [0187.721] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.721] CloseHandle (hObject=0x390) returned 1 [0187.722] CloseHandle (hObject=0x25c) returned 1 [0187.722] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 0 [0187.722] SetEvent (hEvent=0x2fc) returned 1 [0187.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.723] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3926) returned 1 [0187.723] CloseHandle (hObject=0x25c) returned 1 [0187.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf")) returned 0x220 [0187.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf")) returned 0x220 [0187.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0187.724] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.724] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0187.725] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf56, lpOverlapped=0x0) returned 1 [0187.727] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf60, lpOverlapped=0x0) returned 1 [0187.728] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.728] CloseHandle (hObject=0x25c) returned 1 [0187.728] CloseHandle (hObject=0x390) returned 1 [0187.728] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf")) returned 0 [0187.728] SetEvent (hEvent=0x2fc) returned 1 [0187.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.730] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3946) returned 1 [0187.730] CloseHandle (hObject=0x390) returned 1 [0187.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 0x220 [0187.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 0x220 [0187.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0187.730] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.730] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0187.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0187.731] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xf6a, lpOverlapped=0x0) returned 1 [0187.733] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf70, lpOverlapped=0x0) returned 1 [0187.734] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0187.734] CloseHandle (hObject=0x390) returned 1 [0187.734] CloseHandle (hObject=0x25c) returned 1 [0187.734] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 0 [0187.734] SetEvent (hEvent=0x2fc) returned 1 [0187.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.020] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17200) returned 1 [0188.020] CloseHandle (hObject=0x398) returned 1 [0188.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 0x220 [0188.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 0x220 [0188.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.277] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.314] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4330, lpOverlapped=0x0) returned 1 [0188.320] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4340, lpOverlapped=0x0) returned 1 [0188.321] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.321] CloseHandle (hObject=0x39c) returned 1 [0188.321] CloseHandle (hObject=0x370) returned 1 [0188.322] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 0 [0188.322] SetEvent (hEvent=0x2fc) returned 1 [0188.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.322] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15518) returned 1 [0188.323] CloseHandle (hObject=0x370) returned 1 [0188.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 0x220 [0188.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 0x220 [0188.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.323] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.323] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.324] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3c9e, lpOverlapped=0x0) returned 1 [0188.326] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ca0, lpOverlapped=0x0) returned 1 [0188.327] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.327] CloseHandle (hObject=0x370) returned 1 [0188.327] CloseHandle (hObject=0x39c) returned 1 [0188.327] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 0 [0188.330] SetEvent (hEvent=0x2fc) returned 1 [0188.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.332] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=33126) returned 1 [0188.332] CloseHandle (hObject=0x39c) returned 1 [0188.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 0x220 [0188.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 0x220 [0188.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.332] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.332] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.334] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8166, lpOverlapped=0x0) returned 1 [0188.336] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8170, lpOverlapped=0x0) returned 1 [0188.338] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.338] CloseHandle (hObject=0x39c) returned 1 [0188.338] CloseHandle (hObject=0x370) returned 1 [0188.338] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 0 [0188.339] SetEvent (hEvent=0x2fc) returned 1 [0188.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.339] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14080) returned 1 [0188.340] CloseHandle (hObject=0x370) returned 1 [0188.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf")) returned 0x220 [0188.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf")) returned 0x220 [0188.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.341] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3700, lpOverlapped=0x0) returned 1 [0188.344] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3710, lpOverlapped=0x0) returned 1 [0188.345] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.345] CloseHandle (hObject=0x370) returned 1 [0188.345] CloseHandle (hObject=0x39c) returned 1 [0188.345] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf")) returned 0 [0188.346] SetEvent (hEvent=0x2fc) returned 1 [0188.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.346] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14474) returned 1 [0188.347] CloseHandle (hObject=0x39c) returned 1 [0188.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 0x220 [0188.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 0x220 [0188.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.347] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.347] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.349] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x388a, lpOverlapped=0x0) returned 1 [0188.351] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3890, lpOverlapped=0x0) returned 1 [0188.352] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.352] CloseHandle (hObject=0x39c) returned 1 [0188.352] CloseHandle (hObject=0x370) returned 1 [0188.352] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 0 [0188.353] SetEvent (hEvent=0x2fc) returned 1 [0188.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.355] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9280) returned 1 [0188.355] CloseHandle (hObject=0x370) returned 1 [0188.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 0x220 [0188.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 0x220 [0188.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.356] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.356] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.357] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2440, lpOverlapped=0x0) returned 1 [0188.494] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2450, lpOverlapped=0x0) returned 1 [0188.496] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.496] CloseHandle (hObject=0x370) returned 1 [0188.496] CloseHandle (hObject=0x39c) returned 1 [0188.496] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 0 [0188.496] SetEvent (hEvent=0x2fc) returned 1 [0188.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.497] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9204) returned 1 [0188.498] CloseHandle (hObject=0x39c) returned 1 [0188.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf")) returned 0x220 [0188.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf")) returned 0x220 [0188.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.499] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.499] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.500] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x23f4, lpOverlapped=0x0) returned 1 [0188.501] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2400, lpOverlapped=0x0) returned 1 [0188.503] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.503] CloseHandle (hObject=0x39c) returned 1 [0188.503] CloseHandle (hObject=0x370) returned 1 [0188.503] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf")) returned 0 [0188.503] SetEvent (hEvent=0x2fc) returned 1 [0188.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.504] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8720) returned 1 [0188.504] CloseHandle (hObject=0x370) returned 1 [0188.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf")) returned 0x220 [0188.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf")) returned 0x220 [0188.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.507] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2210, lpOverlapped=0x0) returned 1 [0188.508] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2220, lpOverlapped=0x0) returned 1 [0188.509] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.510] CloseHandle (hObject=0x370) returned 1 [0188.510] CloseHandle (hObject=0x39c) returned 1 [0188.510] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285820.wmf")) returned 0 [0188.510] SetEvent (hEvent=0x2fc) returned 1 [0188.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.511] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8608) returned 1 [0188.511] CloseHandle (hObject=0x39c) returned 1 [0188.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf")) returned 0x220 [0188.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf")) returned 0x220 [0188.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.512] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.512] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.513] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x21a0, lpOverlapped=0x0) returned 1 [0188.517] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x21b0, lpOverlapped=0x0) returned 1 [0188.518] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.518] CloseHandle (hObject=0x39c) returned 1 [0188.518] CloseHandle (hObject=0x370) returned 1 [0188.519] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285822.wmf")) returned 0 [0188.519] SetEvent (hEvent=0x2fc) returned 1 [0188.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.520] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30872) returned 1 [0188.520] CloseHandle (hObject=0x370) returned 1 [0188.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf")) returned 0x220 [0188.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf")) returned 0x220 [0188.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.520] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.520] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.521] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7898, lpOverlapped=0x0) returned 1 [0188.523] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x78a0, lpOverlapped=0x0) returned 1 [0188.525] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.525] CloseHandle (hObject=0x370) returned 1 [0188.525] CloseHandle (hObject=0x39c) returned 1 [0188.525] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287018.wmf")) returned 0 [0188.526] SetEvent (hEvent=0x2fc) returned 1 [0188.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.527] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=37658) returned 1 [0188.527] CloseHandle (hObject=0x39c) returned 1 [0188.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf")) returned 0x220 [0188.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf")) returned 0x220 [0188.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.528] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.528] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.529] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x931a, lpOverlapped=0x0) returned 1 [0188.531] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9320, lpOverlapped=0x0) returned 1 [0188.532] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.533] CloseHandle (hObject=0x39c) returned 1 [0188.636] CloseHandle (hObject=0x370) returned 1 [0188.636] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287019.wmf")) returned 0 [0188.636] SetEvent (hEvent=0x2fc) returned 1 [0188.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.637] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=35236) returned 1 [0188.637] CloseHandle (hObject=0x370) returned 1 [0188.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg")) returned 0x220 [0188.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg")) returned 0x220 [0188.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.638] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.638] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0188.639] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x89a4, lpOverlapped=0x0) returned 1 [0188.642] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x89b0, lpOverlapped=0x0) returned 1 [0188.644] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.644] CloseHandle (hObject=0x370) returned 1 [0188.644] CloseHandle (hObject=0x390) returned 1 [0188.644] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287641.jpg")) returned 0 [0188.645] SetEvent (hEvent=0x2fc) returned 1 [0188.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.646] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17105) returned 1 [0188.646] CloseHandle (hObject=0x390) returned 1 [0188.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg")) returned 0x220 [0188.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg")) returned 0x220 [0188.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.647] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.647] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.648] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x42d1, lpOverlapped=0x0) returned 1 [0188.650] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x42e0, lpOverlapped=0x0) returned 1 [0188.651] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.651] CloseHandle (hObject=0x390) returned 1 [0188.651] CloseHandle (hObject=0x370) returned 1 [0188.652] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287642.jpg")) returned 0 [0188.652] SetEvent (hEvent=0x2fc) returned 1 [0188.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.653] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16017) returned 1 [0188.653] CloseHandle (hObject=0x370) returned 1 [0188.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg")) returned 0x220 [0188.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg")) returned 0x220 [0188.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.654] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.654] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0188.655] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3e91, lpOverlapped=0x0) returned 1 [0188.657] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ea0, lpOverlapped=0x0) returned 1 [0188.658] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.658] CloseHandle (hObject=0x370) returned 1 [0188.658] CloseHandle (hObject=0x390) returned 1 [0188.659] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287643.jpg")) returned 0 [0188.659] SetEvent (hEvent=0x2fc) returned 1 [0188.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.660] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=17349) returned 1 [0188.660] CloseHandle (hObject=0x390) returned 1 [0188.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg")) returned 0x220 [0188.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg")) returned 0x220 [0188.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.661] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.661] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0188.663] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x43c5, lpOverlapped=0x0) returned 1 [0188.666] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x43d0, lpOverlapped=0x0) returned 1 [0188.668] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.668] CloseHandle (hObject=0x390) returned 1 [0188.668] CloseHandle (hObject=0x370) returned 1 [0188.668] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287644.jpg")) returned 0 [0188.668] SetEvent (hEvent=0x2fc) returned 1 [0188.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.671] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=36230) returned 1 [0188.671] CloseHandle (hObject=0x370) returned 1 [0188.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg")) returned 0x220 [0188.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg")) returned 0x220 [0188.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0188.672] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x8d86, lpOverlapped=0x0) returned 1 [0188.675] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x8d90, lpOverlapped=0x0) returned 1 [0188.676] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.676] CloseHandle (hObject=0x370) returned 1 [0188.677] CloseHandle (hObject=0x390) returned 1 [0188.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287645.jpg")) returned 0 [0188.677] SetEvent (hEvent=0x2fc) returned 1 [0188.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.678] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11553) returned 1 [0188.678] CloseHandle (hObject=0x390) returned 1 [0188.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg")) returned 0x220 [0188.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg")) returned 0x220 [0188.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.760] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.760] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.762] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2d21, lpOverlapped=0x0) returned 1 [0188.766] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2d30, lpOverlapped=0x0) returned 1 [0188.768] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.768] CloseHandle (hObject=0x398) returned 1 [0188.768] CloseHandle (hObject=0x25c) returned 1 [0188.768] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0289430.jpg")) returned 0 [0188.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.786] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9616) returned 1 [0188.787] CloseHandle (hObject=0x344) returned 1 [0188.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf")) returned 0x220 [0188.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf")) returned 0x220 [0188.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.787] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.787] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.788] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2590, lpOverlapped=0x0) returned 1 [0188.818] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x25a0, lpOverlapped=0x0) returned 1 [0188.820] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.820] CloseHandle (hObject=0x344) returned 1 [0188.820] CloseHandle (hObject=0x39c) returned 1 [0188.820] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0291794.wmf")) returned 0 [0188.821] SetEvent (hEvent=0x2fc) returned 1 [0188.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.833] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=31398) returned 1 [0188.833] CloseHandle (hObject=0x25c) returned 1 [0188.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf")) returned 0x220 [0188.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf")) returned 0x220 [0188.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.841] ReadFile (in: hFile=0x390, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7aa6, lpOverlapped=0x0) returned 1 [0188.844] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7ab0, lpOverlapped=0x0) returned 1 [0188.846] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.846] CloseHandle (hObject=0x390) returned 1 [0188.846] CloseHandle (hObject=0x25c) returned 1 [0188.846] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292270.wmf")) returned 0 [0188.846] SetEvent (hEvent=0x2fc) returned 1 [0188.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.847] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=13912) returned 1 [0188.847] CloseHandle (hObject=0x25c) returned 1 [0188.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf")) returned 0x220 [0188.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf")) returned 0x220 [0188.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.848] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.848] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0188.849] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3658, lpOverlapped=0x0) returned 1 [0188.852] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3660, lpOverlapped=0x0) returned 1 [0188.853] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.853] CloseHandle (hObject=0x25c) returned 1 [0188.853] CloseHandle (hObject=0x390) returned 1 [0188.853] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292278.wmf")) returned 0 [0188.854] SetEvent (hEvent=0x2fc) returned 1 [0188.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.863] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19286) returned 1 [0188.863] CloseHandle (hObject=0x398) returned 1 [0188.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf")) returned 0x220 [0188.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf")) returned 0x220 [0188.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.864] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.864] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.872] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4b56, lpOverlapped=0x0) returned 1 [0188.875] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4b60, lpOverlapped=0x0) returned 1 [0188.876] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.876] CloseHandle (hObject=0x398) returned 1 [0188.876] CloseHandle (hObject=0x25c) returned 1 [0188.876] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292286.wmf")) returned 0 [0188.877] SetEvent (hEvent=0x2fc) returned 1 [0188.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.877] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=4774) returned 1 [0188.878] CloseHandle (hObject=0x25c) returned 1 [0188.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf")) returned 0x220 [0188.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf")) returned 0x220 [0188.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.878] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.879] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.880] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x12a6, lpOverlapped=0x0) returned 1 [0188.882] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x12b0, lpOverlapped=0x0) returned 1 [0188.883] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.884] CloseHandle (hObject=0x25c) returned 1 [0188.884] CloseHandle (hObject=0x398) returned 1 [0188.884] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293800.wmf")) returned 0 [0188.884] SetEvent (hEvent=0x2fc) returned 1 [0188.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.885] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=6078) returned 1 [0188.886] CloseHandle (hObject=0x398) returned 1 [0188.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf")) returned 0x220 [0188.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf")) returned 0x220 [0188.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.916] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.923] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0188.976] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x17be, lpOverlapped=0x0) returned 1 [0188.978] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x17c0, lpOverlapped=0x0) returned 1 [0188.979] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.979] CloseHandle (hObject=0x39c) returned 1 [0188.979] CloseHandle (hObject=0x344) returned 1 [0188.979] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0293832.wmf")) returned 0 [0188.980] SetEvent (hEvent=0x2fc) returned 1 [0188.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.981] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=67726) returned 1 [0188.981] CloseHandle (hObject=0x344) returned 1 [0188.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf")) returned 0x220 [0188.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf")) returned 0x220 [0188.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.982] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.982] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.983] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1088e, lpOverlapped=0x0) returned 1 [0188.986] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x10890, lpOverlapped=0x0) returned 1 [0188.988] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.988] CloseHandle (hObject=0x344) returned 1 [0188.988] CloseHandle (hObject=0x39c) returned 1 [0188.988] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296279.wmf")) returned 0 [0188.988] SetEvent (hEvent=0x2fc) returned 1 [0188.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.989] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=67564) returned 1 [0188.989] CloseHandle (hObject=0x39c) returned 1 [0188.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf")) returned 0x220 [0188.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf")) returned 0x220 [0188.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.990] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.990] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0188.991] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x107ec, lpOverlapped=0x0) returned 1 [0188.994] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x107f0, lpOverlapped=0x0) returned 1 [0188.996] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0188.996] CloseHandle (hObject=0x39c) returned 1 [0188.996] CloseHandle (hObject=0x344) returned 1 [0188.996] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296288.wmf")) returned 0 [0188.996] SetEvent (hEvent=0x2fc) returned 1 [0188.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.998] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=22990) returned 1 [0188.998] CloseHandle (hObject=0x344) returned 1 [0188.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf")) returned 0x220 [0188.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf")) returned 0x220 [0188.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.999] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.999] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0188.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.000] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x59ce, lpOverlapped=0x0) returned 1 [0189.002] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x59d0, lpOverlapped=0x0) returned 1 [0189.003] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.003] CloseHandle (hObject=0x344) returned 1 [0189.003] CloseHandle (hObject=0x39c) returned 1 [0189.003] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297229.wmf")) returned 0 [0189.004] SetEvent (hEvent=0x2fc) returned 1 [0189.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.005] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15652) returned 1 [0189.005] CloseHandle (hObject=0x39c) returned 1 [0189.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf")) returned 0x220 [0189.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf")) returned 0x220 [0189.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.006] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.006] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0189.007] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3d24, lpOverlapped=0x0) returned 1 [0189.008] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3d30, lpOverlapped=0x0) returned 1 [0189.010] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.010] CloseHandle (hObject=0x39c) returned 1 [0189.011] CloseHandle (hObject=0x344) returned 1 [0189.012] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297269.wmf")) returned 0 [0189.012] SetEvent (hEvent=0x2fc) returned 1 [0189.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0189.013] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16950) returned 1 [0189.013] CloseHandle (hObject=0x344) returned 1 [0189.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf")) returned 0x220 [0189.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf")) returned 0x220 [0189.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0189.133] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.133] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0189.275] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4236, lpOverlapped=0x0) returned 1 [0189.309] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4240, lpOverlapped=0x0) returned 1 [0189.311] WriteFile (in: hFile=0x390, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.311] CloseHandle (hObject=0x344) returned 1 [0189.311] CloseHandle (hObject=0x390) returned 1 [0189.311] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297725.wmf")) returned 0 [0189.311] SetEvent (hEvent=0x2fc) returned 1 [0189.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.317] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=3616) returned 1 [0189.317] CloseHandle (hObject=0x25c) returned 1 [0189.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf")) returned 0x220 [0189.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf")) returned 0x220 [0189.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.318] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.318] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.320] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xe20, lpOverlapped=0x0) returned 1 [0189.458] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xe30, lpOverlapped=0x0) returned 1 [0189.466] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.466] CloseHandle (hObject=0x25c) returned 1 [0189.466] CloseHandle (hObject=0x398) returned 1 [0189.500] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304371.wmf")) returned 0 [0189.501] SetEvent (hEvent=0x2fc) returned 1 [0189.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.502] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11512) returned 1 [0189.502] CloseHandle (hObject=0x25c) returned 1 [0189.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf")) returned 0x220 [0189.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf")) returned 0x220 [0189.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.503] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.503] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.513] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2cf8, lpOverlapped=0x0) returned 1 [0189.515] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2d00, lpOverlapped=0x0) returned 1 [0189.516] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.516] CloseHandle (hObject=0x25c) returned 1 [0189.517] CloseHandle (hObject=0x398) returned 1 [0189.517] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304861.wmf")) returned 0 [0189.517] SetEvent (hEvent=0x2fc) returned 1 [0189.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.519] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=20366) returned 1 [0189.519] CloseHandle (hObject=0x398) returned 1 [0189.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf")) returned 0x220 [0189.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf")) returned 0x220 [0189.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.520] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.520] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.520] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4f8e, lpOverlapped=0x0) returned 1 [0189.522] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4f90, lpOverlapped=0x0) returned 1 [0189.523] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.524] CloseHandle (hObject=0x398) returned 1 [0189.524] CloseHandle (hObject=0x25c) returned 1 [0189.524] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304875.wmf")) returned 0 [0189.524] SetEvent (hEvent=0x2fc) returned 1 [0189.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.525] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10692) returned 1 [0189.525] CloseHandle (hObject=0x25c) returned 1 [0189.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg")) returned 0x220 [0189.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg")) returned 0x220 [0189.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.526] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.527] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.528] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x29c4, lpOverlapped=0x0) returned 1 [0189.530] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x29d0, lpOverlapped=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.531] CloseHandle (hObject=0x25c) returned 1 [0189.534] CloseHandle (hObject=0x398) returned 1 [0189.534] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309480.jpg")) returned 0 [0189.534] SetEvent (hEvent=0x2fc) returned 1 [0189.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.535] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=21580) returned 1 [0189.535] CloseHandle (hObject=0x398) returned 1 [0189.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg")) returned 0x220 [0189.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg")) returned 0x220 [0189.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.536] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.536] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.537] ReadFile (in: hFile=0x398, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x544c, lpOverlapped=0x0) returned 1 [0189.538] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5450, lpOverlapped=0x0) returned 1 [0189.539] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.540] CloseHandle (hObject=0x398) returned 1 [0189.540] CloseHandle (hObject=0x25c) returned 1 [0189.540] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309567.jpg")) returned 0 [0189.540] SetEvent (hEvent=0x2fc) returned 1 [0189.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.541] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=39563) returned 1 [0189.541] CloseHandle (hObject=0x25c) returned 1 [0189.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg")) returned 0x220 [0189.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg")) returned 0x220 [0189.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.542] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.542] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.543] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x9a8b, lpOverlapped=0x0) returned 1 [0189.677] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x9a90, lpOverlapped=0x0) returned 1 [0189.679] WriteFile (in: hFile=0x398, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.679] CloseHandle (hObject=0x25c) returned 1 [0189.679] CloseHandle (hObject=0x398) returned 1 [0189.718] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309585.jpg")) returned 0 [0189.735] SetEvent (hEvent=0x2fc) returned 1 [0189.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.742] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=42842) returned 1 [0189.742] CloseHandle (hObject=0x38c) returned 1 [0189.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg")) returned 0x220 [0189.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg")) returned 0x220 [0189.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.743] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.763] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa75a, lpOverlapped=0x0) returned 1 [0189.772] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa760, lpOverlapped=0x0) returned 1 [0189.774] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.774] CloseHandle (hObject=0x38c) returned 1 [0189.774] CloseHandle (hObject=0x39c) returned 1 [0189.774] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313965.jpg")) returned 0 [0189.774] SetEvent (hEvent=0x2fc) returned 1 [0189.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.780] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=47569) returned 1 [0189.780] CloseHandle (hObject=0x39c) returned 1 [0189.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg")) returned 0x220 [0189.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg")) returned 0x220 [0189.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.781] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.781] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0189.782] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xb9d1, lpOverlapped=0x0) returned 1 [0189.823] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xb9e0, lpOverlapped=0x0) returned 1 [0189.824] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.824] CloseHandle (hObject=0x39c) returned 1 [0189.824] CloseHandle (hObject=0x38c) returned 1 [0189.825] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313974.jpg")) returned 0 [0189.825] SetEvent (hEvent=0x2fc) returned 1 [0189.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.826] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16626) returned 1 [0189.826] CloseHandle (hObject=0x38c) returned 1 [0189.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg")) returned 0x220 [0189.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg")) returned 0x220 [0189.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.826] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.827] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.827] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x40f2, lpOverlapped=0x0) returned 1 [0189.832] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4100, lpOverlapped=0x0) returned 1 [0189.833] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.833] CloseHandle (hObject=0x38c) returned 1 [0189.834] CloseHandle (hObject=0x39c) returned 1 [0189.834] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0314068.jpg")) returned 0 [0189.834] SetEvent (hEvent=0x2fc) returned 1 [0189.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.841] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=19202) returned 1 [0189.841] CloseHandle (hObject=0x388) returned 1 [0189.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg")) returned 0x220 [0189.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg")) returned 0x220 [0189.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.842] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.842] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.843] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4b02, lpOverlapped=0x0) returned 1 [0189.846] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4b10, lpOverlapped=0x0) returned 1 [0189.847] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.847] CloseHandle (hObject=0x388) returned 1 [0189.847] CloseHandle (hObject=0x39c) returned 1 [0189.847] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315580.jpg")) returned 0 [0189.848] SetEvent (hEvent=0x2fc) returned 1 [0189.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.848] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16768) returned 1 [0189.848] CloseHandle (hObject=0x39c) returned 1 [0189.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf")) returned 0x220 [0189.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf")) returned 0x220 [0189.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.849] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.849] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0189.850] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x4180, lpOverlapped=0x0) returned 1 [0189.864] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x4190, lpOverlapped=0x0) returned 1 [0189.865] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.865] CloseHandle (hObject=0x39c) returned 1 [0189.865] CloseHandle (hObject=0x388) returned 1 [0189.865] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318448.wmf")) returned 0 [0189.865] SetEvent (hEvent=0x2fc) returned 1 [0189.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.867] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=11770) returned 1 [0189.867] CloseHandle (hObject=0x388) returned 1 [0189.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf")) returned 0x220 [0189.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf")) returned 0x220 [0189.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.868] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.868] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.868] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2dfa, lpOverlapped=0x0) returned 1 [0189.871] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2e00, lpOverlapped=0x0) returned 1 [0189.872] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.872] CloseHandle (hObject=0x388) returned 1 [0189.872] CloseHandle (hObject=0x39c) returned 1 [0189.872] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318804.wmf")) returned 0 [0189.872] SetEvent (hEvent=0x2fc) returned 1 [0189.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.873] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10430) returned 1 [0189.873] CloseHandle (hObject=0x39c) returned 1 [0189.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf")) returned 0x220 [0189.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf")) returned 0x220 [0189.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.874] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.874] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0189.875] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x28be, lpOverlapped=0x0) returned 1 [0189.880] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x28c0, lpOverlapped=0x0) returned 1 [0189.881] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.881] CloseHandle (hObject=0x39c) returned 1 [0189.881] CloseHandle (hObject=0x388) returned 1 [0189.881] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0318810.wmf")) returned 0 [0189.882] SetEvent (hEvent=0x2fc) returned 1 [0189.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.882] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=9431) returned 1 [0189.883] CloseHandle (hObject=0x388) returned 1 [0189.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg")) returned 0x220 [0189.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg")) returned 0x220 [0189.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.883] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.883] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0189.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0189.911] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x24d7, lpOverlapped=0x0) returned 1 [0189.946] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x24e0, lpOverlapped=0x0) returned 1 [0189.947] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0189.947] CloseHandle (hObject=0x388) returned 1 [0189.947] CloseHandle (hObject=0x38c) returned 1 [0189.947] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0321179.jpg")) returned 0 [0189.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.009] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=10196) returned 1 [0190.009] CloseHandle (hObject=0x25c) returned 1 [0190.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg")) returned 0x220 [0190.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg")) returned 0x220 [0190.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.010] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.010] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0190.011] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x27d4, lpOverlapped=0x0) returned 1 [0190.197] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x27e0, lpOverlapped=0x0) returned 1 [0190.198] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.198] CloseHandle (hObject=0x25c) returned 1 [0190.198] CloseHandle (hObject=0x39c) returned 1 [0190.198] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341328.jpg")) returned 0 [0190.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.215] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=29783) returned 1 [0190.215] CloseHandle (hObject=0x39c) returned 1 [0190.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg")) returned 0x220 [0190.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg")) returned 0x220 [0190.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.216] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.216] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0190.217] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x7457, lpOverlapped=0x0) returned 1 [0190.224] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7460, lpOverlapped=0x0) returned 1 [0190.225] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.225] CloseHandle (hObject=0x39c) returned 1 [0190.225] CloseHandle (hObject=0x25c) returned 1 [0190.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341455.jpg")) returned 0 [0190.227] SetEvent (hEvent=0x2fc) returned 1 [0190.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.228] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=43490) returned 1 [0190.228] CloseHandle (hObject=0x25c) returned 1 [0190.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg")) returned 0x220 [0190.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg")) returned 0x220 [0190.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.228] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.228] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0190.229] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa9e2, lpOverlapped=0x0) returned 1 [0190.234] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa9f0, lpOverlapped=0x0) returned 1 [0190.236] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.236] CloseHandle (hObject=0x25c) returned 1 [0190.236] CloseHandle (hObject=0x39c) returned 1 [0190.236] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341475.jpg")) returned 0 [0190.237] SetEvent (hEvent=0x2fc) returned 1 [0190.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.237] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=16099) returned 1 [0190.237] CloseHandle (hObject=0x39c) returned 1 [0190.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg")) returned 0x220 [0190.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg")) returned 0x220 [0190.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.238] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.238] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0190.240] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3ee3, lpOverlapped=0x0) returned 1 [0190.242] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3ef0, lpOverlapped=0x0) returned 1 [0190.243] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.243] CloseHandle (hObject=0x39c) returned 1 [0190.243] CloseHandle (hObject=0x25c) returned 1 [0190.243] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341499.jpg")) returned 0 [0190.244] SetEvent (hEvent=0x2fc) returned 1 [0190.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.247] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8074) returned 1 [0190.247] CloseHandle (hObject=0x25c) returned 1 [0190.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg")) returned 0x220 [0190.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg")) returned 0x220 [0190.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.248] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.248] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0190.249] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f8a, lpOverlapped=0x0) returned 1 [0190.251] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f90, lpOverlapped=0x0) returned 1 [0190.252] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.252] CloseHandle (hObject=0x25c) returned 1 [0190.253] CloseHandle (hObject=0x39c) returned 1 [0190.253] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341534.jpg")) returned 0 [0190.253] SetEvent (hEvent=0x2fc) returned 1 [0190.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.254] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=23126) returned 1 [0190.254] CloseHandle (hObject=0x39c) returned 1 [0190.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg")) returned 0x220 [0190.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg")) returned 0x220 [0190.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.254] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.255] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0190.255] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x5a56, lpOverlapped=0x0) returned 1 [0190.366] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x5a60, lpOverlapped=0x0) returned 1 [0190.367] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.368] CloseHandle (hObject=0x39c) returned 1 [0190.368] CloseHandle (hObject=0x25c) returned 1 [0190.368] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341551.jpg")) returned 0 [0190.368] SetEvent (hEvent=0x2fc) returned 1 [0190.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.369] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=28483) returned 1 [0190.369] CloseHandle (hObject=0x25c) returned 1 [0190.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg")) returned 0x220 [0190.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg")) returned 0x220 [0190.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.370] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.370] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0190.371] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6f43, lpOverlapped=0x0) returned 1 [0190.378] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6f50, lpOverlapped=0x0) returned 1 [0190.380] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.380] CloseHandle (hObject=0x25c) returned 1 [0190.380] CloseHandle (hObject=0x39c) returned 1 [0190.380] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341554.jpg")) returned 0 [0190.380] SetEvent (hEvent=0x2fc) returned 1 [0190.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.381] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=27304) returned 1 [0190.381] CloseHandle (hObject=0x39c) returned 1 [0190.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg")) returned 0x220 [0190.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg")) returned 0x220 [0190.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0190.382] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.382] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0190.383] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x6aa8, lpOverlapped=0x0) returned 1 [0190.507] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x6ab0, lpOverlapped=0x0) returned 1 [0190.508] WriteFile (in: hFile=0x25c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.508] CloseHandle (hObject=0x39c) returned 1 [0190.508] CloseHandle (hObject=0x25c) returned 1 [0190.508] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341557.jpg")) returned 0 [0190.509] SetEvent (hEvent=0x2fc) returned 1 [0190.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.510] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=7803) returned 1 [0190.510] CloseHandle (hObject=0x25c) returned 1 [0190.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg")) returned 0x220 [0190.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg")) returned 0x220 [0190.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0190.511] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.511] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0190.511] ReadFile (in: hFile=0x25c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1e7b, lpOverlapped=0x0) returned 1 [0190.540] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1e80, lpOverlapped=0x0) returned 1 [0190.541] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.542] CloseHandle (hObject=0x25c) returned 1 [0190.542] CloseHandle (hObject=0x39c) returned 1 [0190.543] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341634.jpg")) returned 0 [0190.543] SetEvent (hEvent=0x2fc) returned 1 [0190.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.753] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=8230) returned 1 [0190.753] CloseHandle (hObject=0x388) returned 1 [0190.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg")) returned 0x220 [0190.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg")) returned 0x220 [0190.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.754] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.754] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.755] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x2026, lpOverlapped=0x0) returned 1 [0190.756] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x2030, lpOverlapped=0x0) returned 1 [0190.757] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.757] CloseHandle (hObject=0x388) returned 1 [0190.758] CloseHandle (hObject=0x344) returned 1 [0190.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341645.jpg")) returned 0 [0190.758] SetEvent (hEvent=0x2fc) returned 1 [0190.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.759] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=91948) returned 1 [0190.759] CloseHandle (hObject=0x344) returned 1 [0190.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg")) returned 0x220 [0190.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg")) returned 0x220 [0190.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.759] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.759] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.761] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1672c, lpOverlapped=0x0) returned 1 [0190.772] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16730, lpOverlapped=0x0) returned 1 [0190.775] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.775] CloseHandle (hObject=0x344) returned 1 [0190.775] CloseHandle (hObject=0x388) returned 1 [0190.775] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382926.jpg")) returned 0 [0190.775] SetEvent (hEvent=0x2fc) returned 1 [0190.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.777] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=129132) returned 1 [0190.777] CloseHandle (hObject=0x388) returned 1 [0190.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg")) returned 0x220 [0190.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg")) returned 0x220 [0190.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.778] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.778] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.779] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1f86c, lpOverlapped=0x0) returned 1 [0190.798] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1f870, lpOverlapped=0x0) returned 1 [0190.801] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.801] CloseHandle (hObject=0x388) returned 1 [0190.802] CloseHandle (hObject=0x344) returned 1 [0190.802] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382927.jpg")) returned 0 [0190.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.914] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=122691) returned 1 [0190.915] CloseHandle (hObject=0x344) returned 1 [0190.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg")) returned 0x220 [0190.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg")) returned 0x220 [0190.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.915] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.915] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.917] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1df43, lpOverlapped=0x0) returned 1 [0190.924] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1df50, lpOverlapped=0x0) returned 1 [0190.963] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.963] CloseHandle (hObject=0x344) returned 1 [0190.964] CloseHandle (hObject=0x388) returned 1 [0190.964] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382931.jpg")) returned 0 [0190.964] SetEvent (hEvent=0x2fc) returned 1 [0190.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.965] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=86812) returned 1 [0190.965] CloseHandle (hObject=0x388) returned 1 [0190.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg")) returned 0x220 [0190.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg")) returned 0x220 [0190.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.966] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.966] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.970] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1531c, lpOverlapped=0x0) returned 1 [0190.974] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x15320, lpOverlapped=0x0) returned 1 [0190.976] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.976] CloseHandle (hObject=0x388) returned 1 [0190.976] CloseHandle (hObject=0x344) returned 1 [0190.976] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382947.jpg")) returned 0 [0190.977] SetEvent (hEvent=0x2fc) returned 1 [0190.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.978] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=109879) returned 1 [0190.978] CloseHandle (hObject=0x344) returned 1 [0190.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg")) returned 0x220 [0190.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg")) returned 0x220 [0190.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.978] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.978] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.979] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1ad37, lpOverlapped=0x0) returned 1 [0190.983] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1ad40, lpOverlapped=0x0) returned 1 [0190.986] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.986] CloseHandle (hObject=0x344) returned 1 [0190.986] CloseHandle (hObject=0x388) returned 1 [0190.986] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382948.jpg")) returned 0 [0190.986] SetEvent (hEvent=0x2fc) returned 1 [0190.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.988] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=96466) returned 1 [0190.988] CloseHandle (hObject=0x388) returned 1 [0190.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg")) returned 0x220 [0190.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg")) returned 0x220 [0190.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.989] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.989] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.991] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x178d2, lpOverlapped=0x0) returned 1 [0190.994] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x178e0, lpOverlapped=0x0) returned 1 [0190.996] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0190.996] CloseHandle (hObject=0x388) returned 1 [0190.996] CloseHandle (hObject=0x344) returned 1 [0190.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382950.jpg")) returned 0 [0190.997] SetEvent (hEvent=0x2fc) returned 1 [0190.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.998] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=96073) returned 1 [0190.998] CloseHandle (hObject=0x344) returned 1 [0190.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg")) returned 0x220 [0190.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg")) returned 0x220 [0190.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.998] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.998] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0190.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.999] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x17749, lpOverlapped=0x0) returned 1 [0191.232] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x17750, lpOverlapped=0x0) returned 1 [0191.234] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.234] CloseHandle (hObject=0x344) returned 1 [0191.234] CloseHandle (hObject=0x388) returned 1 [0191.234] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382952.jpg")) returned 0 [0191.235] SetEvent (hEvent=0x2fc) returned 1 [0191.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.236] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=85898) returned 1 [0191.236] CloseHandle (hObject=0x388) returned 1 [0191.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg")) returned 0x220 [0191.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg")) returned 0x220 [0191.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.236] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.236] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0191.238] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x14f8a, lpOverlapped=0x0) returned 1 [0191.243] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x14f90, lpOverlapped=0x0) returned 1 [0191.245] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.245] CloseHandle (hObject=0x388) returned 1 [0191.246] CloseHandle (hObject=0x344) returned 1 [0191.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382959.jpg")) returned 0 [0191.246] SetEvent (hEvent=0x2fc) returned 1 [0191.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.247] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=107508) returned 1 [0191.247] CloseHandle (hObject=0x344) returned 1 [0191.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg")) returned 0x220 [0191.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg")) returned 0x220 [0191.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.248] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.248] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0191.250] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1a3f4, lpOverlapped=0x0) returned 1 [0191.255] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1a400, lpOverlapped=0x0) returned 1 [0191.258] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.258] CloseHandle (hObject=0x344) returned 1 [0191.259] CloseHandle (hObject=0x388) returned 1 [0191.259] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382960.jpg")) returned 0 [0191.259] SetEvent (hEvent=0x2fc) returned 1 [0191.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.260] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=101060) returned 1 [0191.260] CloseHandle (hObject=0x388) returned 1 [0191.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg")) returned 0x220 [0191.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg")) returned 0x220 [0191.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.261] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.261] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0191.263] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x18ac4, lpOverlapped=0x0) returned 1 [0191.534] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x18ad0, lpOverlapped=0x0) returned 1 [0191.545] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.545] CloseHandle (hObject=0x388) returned 1 [0191.545] CloseHandle (hObject=0x344) returned 1 [0191.545] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382961.jpg")) returned 0 [0191.545] SetEvent (hEvent=0x2fc) returned 1 [0191.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.547] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=93448) returned 1 [0191.547] CloseHandle (hObject=0x344) returned 1 [0191.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg")) returned 0x220 [0191.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg")) returned 0x220 [0191.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.552] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.552] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0191.553] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x16d08, lpOverlapped=0x0) returned 1 [0191.556] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x16d10, lpOverlapped=0x0) returned 1 [0191.558] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.558] CloseHandle (hObject=0x344) returned 1 [0191.558] CloseHandle (hObject=0x388) returned 1 [0191.558] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382967.jpg")) returned 0 [0191.559] SetEvent (hEvent=0x2fc) returned 1 [0191.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.560] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=112479) returned 1 [0191.560] CloseHandle (hObject=0x388) returned 1 [0191.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg")) returned 0x220 [0191.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg")) returned 0x220 [0191.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.560] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.560] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0191.562] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1b75f, lpOverlapped=0x0) returned 1 [0191.600] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x1b760, lpOverlapped=0x0) returned 1 [0191.602] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.603] CloseHandle (hObject=0x388) returned 1 [0191.603] CloseHandle (hObject=0x344) returned 1 [0191.603] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382968.jpg")) returned 0 [0191.603] SetEvent (hEvent=0x2fc) returned 1 [0191.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.604] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=96159) returned 1 [0191.604] CloseHandle (hObject=0x344) returned 1 [0191.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg")) returned 0x220 [0191.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg")) returned 0x220 [0191.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.605] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.605] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0191.606] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x1779f, lpOverlapped=0x0) returned 1 [0191.610] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x177a0, lpOverlapped=0x0) returned 1 [0191.612] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.612] CloseHandle (hObject=0x344) returned 1 [0191.613] CloseHandle (hObject=0x388) returned 1 [0191.613] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382969.jpg")) returned 0 [0191.613] SetEvent (hEvent=0x2fc) returned 1 [0191.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.614] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=88980) returned 1 [0191.614] CloseHandle (hObject=0x388) returned 1 [0191.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg")) returned 0x220 [0191.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg")) returned 0x220 [0191.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.615] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.615] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0191.616] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x15b94, lpOverlapped=0x0) returned 1 [0191.912] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x15ba0, lpOverlapped=0x0) returned 1 [0191.914] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.914] CloseHandle (hObject=0x388) returned 1 [0191.915] CloseHandle (hObject=0x344) returned 1 [0191.915] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382970.jpg")) returned 0 [0191.916] SetEvent (hEvent=0x2fc) returned 1 [0191.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.917] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=71552) returned 1 [0191.917] CloseHandle (hObject=0x344) returned 1 [0191.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg")) returned 0x220 [0191.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg")) returned 0x220 [0191.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.918] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.918] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0191.918] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x11780, lpOverlapped=0x0) returned 1 [0191.921] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11790, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x11790, lpOverlapped=0x0) returned 1 [0191.923] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.923] CloseHandle (hObject=0x344) returned 1 [0191.923] CloseHandle (hObject=0x388) returned 1 [0191.924] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384900.jpg")) returned 0 [0191.924] SetEvent (hEvent=0x2fc) returned 1 [0191.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.925] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=30842) returned 1 [0191.925] CloseHandle (hObject=0x388) returned 1 [0191.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg")) returned 0x220 [0191.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg")) returned 0x220 [0191.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.925] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.925] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0191.927] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x787a, lpOverlapped=0x0) returned 1 [0191.933] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x7880, lpOverlapped=0x0) returned 1 [0191.934] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.935] CloseHandle (hObject=0x388) returned 1 [0191.935] CloseHandle (hObject=0x344) returned 1 [0191.935] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386120.jpg")) returned 0 [0191.935] SetEvent (hEvent=0x2fc) returned 1 [0191.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.936] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=43294) returned 1 [0191.936] CloseHandle (hObject=0x344) returned 1 [0191.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg")) returned 0x220 [0191.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg")) returned 0x220 [0191.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.936] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.936] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0191.937] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0xa91e, lpOverlapped=0x0) returned 1 [0191.939] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xa920, lpOverlapped=0x0) returned 1 [0191.941] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.941] CloseHandle (hObject=0x344) returned 1 [0191.941] CloseHandle (hObject=0x388) returned 1 [0191.941] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386267.jpg")) returned 0 [0191.942] SetEvent (hEvent=0x2fc) returned 1 [0191.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.943] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=15171) returned 1 [0191.943] CloseHandle (hObject=0x388) returned 1 [0191.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg")) returned 0x220 [0191.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg")) returned 0x220 [0191.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.944] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.944] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0191.944] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x3b43, lpOverlapped=0x0) returned 1 [0191.946] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3b50, lpOverlapped=0x0) returned 1 [0191.947] WriteFile (in: hFile=0x344, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0191.947] CloseHandle (hObject=0x388) returned 1 [0191.947] CloseHandle (hObject=0x344) returned 1 [0191.947] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386270.jpg")) returned 0 [0191.948] SetEvent (hEvent=0x2fc) returned 1 [0191.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.948] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385fdd8 | out: lpFileSize=0x385fdd8*=14698) returned 1 [0191.948] CloseHandle (hObject=0x344) returned 1 [0191.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg")) returned 0x220 [0191.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg")) returned 0x220 [0191.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0191.949] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.949] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fda0 | out: lpNewFilePointer=0x0) returned 1 [0191.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0191.950] ReadFile (in: hFile=0x344, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x385fdac, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x385fdac*=0x396a, lpOverlapped=0x0) returned 1 [0192.373] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0x3970, lpOverlapped=0x0) returned 1 [0192.375] WriteFile (in: hFile=0x388, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fd90, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x385fd90*=0xf2, lpOverlapped=0x0) returned 1 [0192.375] CloseHandle (hObject=0x344) returned 1 [0192.375] CloseHandle (hObject=0x388) returned 1 [0192.774] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386485.jpg")) returned 0 [0192.775] SetEvent (hEvent=0x2fc) returned 1 [0192.780] SetEvent (hEvent=0x300) returned 1 [0192.780] SetEvent (hEvent=0x2fc) returned 1 [0192.780] SetEvent (hEvent=0x304) returned 1 [0192.780] GetProcessHeap () returned 0xfd0000 [0192.780] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0x4029538 [0192.780] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0192.781] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0192.781] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0192.781] GetProcessHeap () returned 0xfd0000 [0192.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x4029538 | out: hHeap=0xfd0000) returned 1 [0192.781] SetEvent (hEvent=0x300) returned 1 [0192.781] SetEvent (hEvent=0x2fc) returned 1 [0192.781] SetEvent (hEvent=0x304) returned 1 [0192.781] GetProcessHeap () returned 0xfd0000 [0192.781] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3ce5020 | out: hHeap=0xfd0000) returned 1 [0192.786] GetProcessHeap () returned 0xfd0000 [0192.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100ca10 | out: hHeap=0xfd0000) returned 1 [0192.786] GetProcessHeap () returned 0xfd0000 [0192.786] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x39e0068 | out: hHeap=0xfd0000) returned 1 [0192.787] GetProcessHeap () returned 0xfd0000 [0192.787] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x39f0070 | out: hHeap=0xfd0000) returned 1 Thread: id = 91 os_tid = 0xe08 [0143.075] GetProcessHeap () returned 0xfd0000 [0143.075] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a00078 [0143.076] GetProcessHeap () returned 0xfd0000 [0143.076] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x10000) returned 0x3a10080 [0143.076] GetProcessHeap () returned 0xfd0000 [0143.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x28) returned 0x100ca40 [0143.077] GetProcessHeap () returned 0xfd0000 [0143.077] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x110102) returned 0x3e04020 [0143.080] GetProcessHeap () returned 0xfd0000 [0143.080] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0xfe0490 [0143.080] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0143.080] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0143.080] Wow64DisableWow64FsRedirection (in: OldValue=0x399f8fc | out: OldValue=0x399f8fc*=0x0) returned 1 [0143.080] GetProcessHeap () returned 0xfd0000 [0143.080] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0xfe0490 | out: hHeap=0xfd0000) returned 1 [0143.080] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.448] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.448] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.449] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.450] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=0) returned 1 [0143.450] CloseHandle (hObject=0x334) returned 1 [0143.450] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.450] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77664) returned 1 [0143.450] CloseHandle (hObject=0x334) returned 1 [0143.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0143.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0143.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.451] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.451] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.455] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=95648) returned 1 [0143.455] CloseHandle (hObject=0x334) returned 1 [0143.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0143.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0143.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.457] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.460] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45472) returned 1 [0143.460] CloseHandle (hObject=0x334) returned 1 [0143.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0143.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0143.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.461] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.461] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.462] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=79200) returned 1 [0143.462] CloseHandle (hObject=0x334) returned 1 [0143.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0143.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0143.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.462] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.463] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.464] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80224) returned 1 [0143.464] CloseHandle (hObject=0x334) returned 1 [0143.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0143.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0143.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.464] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.464] ResetEvent (hEvent=0x300) returned 1 [0143.464] SetEvent (hEvent=0x304) returned 1 [0143.464] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.465] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=46496) returned 1 [0143.465] CloseHandle (hObject=0x334) returned 1 [0143.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0143.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0143.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.465] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.465] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.467] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.469] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=74144) returned 1 [0143.469] CloseHandle (hObject=0x334) returned 1 [0143.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0143.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0143.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.470] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.470] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.471] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77664) returned 1 [0143.471] CloseHandle (hObject=0x334) returned 1 [0143.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0143.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0143.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.471] ResetEvent (hEvent=0x300) returned 1 [0143.471] SetEvent (hEvent=0x304) returned 1 [0143.471] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.472] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45984) returned 1 [0143.472] CloseHandle (hObject=0x334) returned 1 [0143.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0143.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0143.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.472] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.472] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.474] ResetEvent (hEvent=0x300) returned 1 [0143.474] SetEvent (hEvent=0x304) returned 1 [0143.475] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.481] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=75104) returned 1 [0143.481] CloseHandle (hObject=0x334) returned 1 [0143.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0143.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0143.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.481] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.481] ResetEvent (hEvent=0x300) returned 1 [0143.481] SetEvent (hEvent=0x304) returned 1 [0143.481] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0143.483] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45472) returned 1 [0143.484] CloseHandle (hObject=0x33c) returned 1 [0143.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0143.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0143.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.484] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.484] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0xffffffff) returned 0x0 [0143.486] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.491] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3695719) returned 1 [0143.491] CloseHandle (hObject=0x334) returned 1 [0143.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0143.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0143.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0143.495] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.499] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2373000) returned 1 [0143.499] CloseHandle (hObject=0x334) returned 1 [0143.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0143.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0143.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0143.500] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.508] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=174959) returned 1 [0143.508] CloseHandle (hObject=0x334) returned 1 [0143.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0143.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0143.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.512] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.519] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=145419) returned 1 [0143.519] CloseHandle (hObject=0x334) returned 1 [0143.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0143.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0143.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.519] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.520] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=162331) returned 1 [0143.520] CloseHandle (hObject=0x334) returned 1 [0143.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0143.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0143.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.524] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=164347) returned 1 [0143.524] CloseHandle (hObject=0x334) returned 1 [0143.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0143.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0143.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.527] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=85862) returned 1 [0143.527] CloseHandle (hObject=0x334) returned 1 [0143.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0143.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0143.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.528] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=86178) returned 1 [0143.528] CloseHandle (hObject=0x334) returned 1 [0143.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0143.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0143.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.543] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=49091) returned 1 [0143.543] CloseHandle (hObject=0x334) returned 1 [0143.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0143.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0143.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.544] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.544] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.544] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=78176) returned 1 [0143.544] CloseHandle (hObject=0x334) returned 1 [0143.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0143.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0143.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.544] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.545] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.545] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45472) returned 1 [0143.545] CloseHandle (hObject=0x334) returned 1 [0143.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0143.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0143.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.545] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.545] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.546] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77656) returned 1 [0143.546] CloseHandle (hObject=0x334) returned 1 [0143.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0143.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0143.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.546] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.546] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.546] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45984) returned 1 [0143.546] CloseHandle (hObject=0x334) returned 1 [0143.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0143.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0143.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.547] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=76640) returned 1 [0143.547] CloseHandle (hObject=0x334) returned 1 [0143.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0143.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0143.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.548] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.548] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45472) returned 1 [0143.548] CloseHandle (hObject=0x334) returned 1 [0143.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0143.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0143.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.548] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.548] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.548] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=76640) returned 1 [0143.549] CloseHandle (hObject=0x334) returned 1 [0143.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0143.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0143.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.549] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.549] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.549] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45984) returned 1 [0143.549] CloseHandle (hObject=0x334) returned 1 [0143.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0143.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0143.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.550] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.550] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.550] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=74080) returned 1 [0143.550] CloseHandle (hObject=0x334) returned 1 [0143.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0143.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0143.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.550] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.551] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.551] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=54168) returned 1 [0143.551] CloseHandle (hObject=0x334) returned 1 [0143.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0143.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0143.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.551] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.551] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.552] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=92576) returned 1 [0143.552] CloseHandle (hObject=0x334) returned 1 [0143.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0143.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0143.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.552] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.552] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.552] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12192) returned 1 [0143.552] CloseHandle (hObject=0x334) returned 1 [0143.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0143.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0143.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.553] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.553] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.553] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=76128) returned 1 [0143.553] CloseHandle (hObject=0x334) returned 1 [0143.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0143.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0143.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.553] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.554] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.554] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77152) returned 1 [0143.554] CloseHandle (hObject=0x334) returned 1 [0143.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0143.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0143.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.554] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.554] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.555] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=44960) returned 1 [0143.555] CloseHandle (hObject=0x334) returned 1 [0143.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0143.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0143.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.555] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.555] ResetEvent (hEvent=0x300) returned 1 [0143.555] SetEvent (hEvent=0x304) returned 1 [0143.555] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0143.555] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77144) returned 1 [0143.555] CloseHandle (hObject=0x334) returned 1 [0143.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0143.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0143.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.770] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0143.979] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0143.980] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=69632) returned 1 [0143.980] CloseHandle (hObject=0x364) returned 1 [0143.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0143.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0143.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0143.980] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0143.980] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0143.980] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0143.980] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0143.981] ReadFile (in: hFile=0x364, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x11000, lpOverlapped=0x0) returned 1 [0144.003] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x11010, lpOverlapped=0x0) returned 1 [0144.005] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x152, lpOverlapped=0x0) returned 1 [0144.005] CloseHandle (hObject=0x364) returned 1 [0144.005] CloseHandle (hObject=0x368) returned 1 [0144.007] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0144.009] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.009] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=69632) returned 1 [0144.009] CloseHandle (hObject=0x368) returned 1 [0144.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0144.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0144.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.010] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.010] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0144.010] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0144.010] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x364 [0144.010] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x11000, lpOverlapped=0x0) returned 1 [0144.210] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x11010, lpOverlapped=0x0) returned 1 [0144.213] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x132, lpOverlapped=0x0) returned 1 [0144.213] CloseHandle (hObject=0x368) returned 1 [0144.213] CloseHandle (hObject=0x364) returned 1 [0144.215] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0144.216] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0144.217] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1052672) returned 1 [0144.217] CloseHandle (hObject=0x364) returned 1 [0144.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0144.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0144.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.217] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0144.217] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0144.218] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0144.218] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0144.218] ReadFile (in: hFile=0x364, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x101000, lpOverlapped=0x0) returned 1 [0144.243] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x101010, lpOverlapped=0x0) returned 1 [0144.484] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x172, lpOverlapped=0x0) returned 1 [0144.484] CloseHandle (hObject=0x364) returned 1 [0144.484] CloseHandle (hObject=0x368) returned 1 [0144.726] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0144.727] SetEvent (hEvent=0x2fc) returned 1 [0144.727] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.728] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1118208) returned 1 [0144.728] CloseHandle (hObject=0x368) returned 1 [0144.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0144.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0144.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\security.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0144.728] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0144.728] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0144.728] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0144.728] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\security.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x378 [0144.728] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x110100, lpOverlapped=0x0) returned 1 [0144.913] WriteFile (in: hFile=0x378, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x110100, lpOverlapped=0x0) returned 1 [0144.935] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf00, lpOverlapped=0x0) returned 1 [0144.935] WriteFile (in: hFile=0x378, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf10, lpOverlapped=0x0) returned 1 [0144.936] WriteFile (in: hFile=0x378, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0144.936] CloseHandle (hObject=0x368) returned 1 [0144.936] CloseHandle (hObject=0x378) returned 1 [0145.181] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0145.183] SetEvent (hEvent=0x2fc) returned 1 [0145.183] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.183] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=69632) returned 1 [0145.183] CloseHandle (hObject=0x378) returned 1 [0145.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0145.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0145.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.184] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0145.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0145.184] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0145.185] ReadFile (in: hFile=0x378, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x11000, lpOverlapped=0x0) returned 1 [0145.190] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x11010, lpOverlapped=0x0) returned 1 [0145.192] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0145.192] CloseHandle (hObject=0x378) returned 1 [0145.192] CloseHandle (hObject=0x358) returned 1 [0145.194] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0145.195] SetEvent (hEvent=0x2fc) returned 1 [0145.195] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.197] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15984) returned 1 [0145.197] CloseHandle (hObject=0x358) returned 1 [0145.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0145.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0145.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.198] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0145.198] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0145.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x378 [0145.203] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3e70, lpOverlapped=0x0) returned 1 [0145.416] WriteFile (in: hFile=0x378, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3e80, lpOverlapped=0x0) returned 1 [0145.417] WriteFile (in: hFile=0x378, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0145.418] CloseHandle (hObject=0x358) returned 1 [0145.418] CloseHandle (hObject=0x378) returned 1 [0145.419] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0 [0145.573] SetEvent (hEvent=0x2fc) returned 1 [0145.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.575] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18624) returned 1 [0145.575] CloseHandle (hObject=0x378) returned 1 [0145.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0145.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0145.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.575] SetEvent (hEvent=0x2fc) returned 1 [0145.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.576] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21184) returned 1 [0145.576] CloseHandle (hObject=0x378) returned 1 [0145.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0145.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0145.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.576] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0145.577] CloseHandle (hObject=0x378) returned 1 [0145.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0145.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0145.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.577] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0145.577] CloseHandle (hObject=0x378) returned 1 [0145.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0145.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0145.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.582] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18624) returned 1 [0145.582] CloseHandle (hObject=0x378) returned 1 [0145.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0145.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0145.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.582] SetEvent (hEvent=0x2fc) returned 1 [0145.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.582] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11616) returned 1 [0145.582] CloseHandle (hObject=0x378) returned 1 [0145.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0145.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0145.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.583] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19648) returned 1 [0145.583] CloseHandle (hObject=0x378) returned 1 [0145.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0145.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0145.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.584] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22720) returned 1 [0145.584] CloseHandle (hObject=0x378) returned 1 [0145.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0145.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0145.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.585] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0145.585] CloseHandle (hObject=0x378) returned 1 [0145.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0145.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0145.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.586] SetEvent (hEvent=0x2fc) returned 1 [0145.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.586] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20672) returned 1 [0145.586] CloseHandle (hObject=0x378) returned 1 [0145.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0145.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0145.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.587] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19648) returned 1 [0145.587] CloseHandle (hObject=0x378) returned 1 [0145.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0145.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0145.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.588] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0145.588] CloseHandle (hObject=0x378) returned 1 [0145.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0145.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0145.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.590] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27840) returned 1 [0145.590] CloseHandle (hObject=0x374) returned 1 [0145.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0145.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0145.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.590] SetEvent (hEvent=0x2fc) returned 1 [0145.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.591] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26816) returned 1 [0145.591] CloseHandle (hObject=0x374) returned 1 [0145.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0145.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0145.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.591] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=70848) returned 1 [0145.591] CloseHandle (hObject=0x374) returned 1 [0145.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0145.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0145.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0145.592] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19648) returned 1 [0145.592] CloseHandle (hObject=0x374) returned 1 [0145.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0145.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0145.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.594] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23232) returned 1 [0145.595] CloseHandle (hObject=0x378) returned 1 [0145.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0145.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0145.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.595] SetEvent (hEvent=0x2fc) returned 1 [0145.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.595] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24768) returned 1 [0145.595] CloseHandle (hObject=0x378) returned 1 [0145.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0145.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0145.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.596] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24768) returned 1 [0145.596] CloseHandle (hObject=0x378) returned 1 [0145.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0145.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0145.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.597] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21184) returned 1 [0145.597] CloseHandle (hObject=0x378) returned 1 [0145.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0145.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0145.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.598] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0145.598] CloseHandle (hObject=0x378) returned 1 [0145.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0145.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0145.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.598] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=162880) returned 1 [0145.598] CloseHandle (hObject=0x378) returned 1 [0145.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0145.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0145.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.599] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=656088) returned 1 [0145.599] CloseHandle (hObject=0x378) returned 1 [0145.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0145.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0145.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.600] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2054872) returned 1 [0145.600] CloseHandle (hObject=0x378) returned 1 [0145.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0145.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0 [0145.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.601] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=307416) returned 1 [0145.601] CloseHandle (hObject=0x378) returned 1 [0145.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0145.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0145.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.601] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2118360) returned 1 [0145.601] CloseHandle (hObject=0x378) returned 1 [0145.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0145.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0 [0145.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0145.602] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=468696) returned 1 [0145.602] CloseHandle (hObject=0x378) returned 1 [0145.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0145.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0145.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.605] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=396960) returned 1 [0145.605] CloseHandle (hObject=0x358) returned 1 [0145.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0145.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0145.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.606] SetEvent (hEvent=0x2fc) returned 1 [0145.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.606] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=473760) returned 1 [0145.606] CloseHandle (hObject=0x358) returned 1 [0145.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0145.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0145.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.611] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=210648) returned 1 [0145.611] CloseHandle (hObject=0x358) returned 1 [0145.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0145.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0145.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.611] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1402584) returned 1 [0145.611] CloseHandle (hObject=0x358) returned 1 [0145.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0145.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0145.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.612] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1761448) returned 1 [0145.612] CloseHandle (hObject=0x358) returned 1 [0145.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0145.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0 [0145.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.613] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2285736) returned 1 [0145.613] CloseHandle (hObject=0x358) returned 1 [0145.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0145.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0145.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0 [0145.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.614] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=567512) returned 1 [0145.614] CloseHandle (hObject=0x358) returned 1 [0145.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0145.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0145.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.614] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1231576) returned 1 [0145.614] CloseHandle (hObject=0x358) returned 1 [0145.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0145.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0145.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.615] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=947928) returned 1 [0145.615] CloseHandle (hObject=0x358) returned 1 [0145.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0145.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0145.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0145.616] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1295576) returned 1 [0145.616] CloseHandle (hObject=0x358) returned 1 [0145.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0145.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0145.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.845] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=512216) returned 1 [0145.845] CloseHandle (hObject=0x36c) returned 1 [0145.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0145.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0145.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.845] SetEvent (hEvent=0x2fc) returned 1 [0145.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.855] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0145.855] CloseHandle (hObject=0x36c) returned 1 [0145.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0145.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0145.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.856] SetEvent (hEvent=0x2fc) returned 1 [0145.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.857] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0145.857] CloseHandle (hObject=0x36c) returned 1 [0145.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0145.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0145.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.857] SetEvent (hEvent=0x2fc) returned 1 [0145.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.860] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27045) returned 1 [0145.860] CloseHandle (hObject=0x36c) returned 1 [0145.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0145.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0145.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.863] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0145.863] CloseHandle (hObject=0x36c) returned 1 [0145.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0145.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0145.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0145.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0145.866] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=111320) returned 1 [0145.867] CloseHandle (hObject=0x36c) returned 1 [0145.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0145.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0145.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.169] SetEvent (hEvent=0x2fc) returned 1 [0146.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.176] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2560) returned 1 [0146.176] CloseHandle (hObject=0x374) returned 1 [0146.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0146.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0146.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.179] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=44032) returned 1 [0146.179] CloseHandle (hObject=0x374) returned 1 [0146.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0146.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0146.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.184] SetEvent (hEvent=0x2fc) returned 1 [0146.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.184] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=181964) returned 1 [0146.184] CloseHandle (hObject=0x374) returned 1 [0146.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0146.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0146.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.185] SetEvent (hEvent=0x2fc) returned 1 [0146.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.186] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5120) returned 1 [0146.186] CloseHandle (hObject=0x374) returned 1 [0146.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0146.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0146.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.189] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9728) returned 1 [0146.189] CloseHandle (hObject=0x374) returned 1 [0146.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0146.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0146.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.190] SetEvent (hEvent=0x2fc) returned 1 [0146.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.190] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3584) returned 1 [0146.191] CloseHandle (hObject=0x374) returned 1 [0146.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0146.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0146.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.191] SetEvent (hEvent=0x2fc) returned 1 [0146.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.191] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0146.191] CloseHandle (hObject=0x374) returned 1 [0146.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0146.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0146.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.192] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0146.192] CloseHandle (hObject=0x374) returned 1 [0146.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0146.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0146.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.193] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0146.193] CloseHandle (hObject=0x374) returned 1 [0146.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0146.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0146.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.197] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10240) returned 1 [0146.197] CloseHandle (hObject=0x374) returned 1 [0146.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0146.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0146.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.197] SetEvent (hEvent=0x2fc) returned 1 [0146.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.199] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=804864) returned 1 [0146.199] CloseHandle (hObject=0x374) returned 1 [0146.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0146.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0146.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.199] SetEvent (hEvent=0x2fc) returned 1 [0146.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.203] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11264) returned 1 [0146.203] CloseHandle (hObject=0x374) returned 1 [0146.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0146.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0146.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.203] SetEvent (hEvent=0x2fc) returned 1 [0146.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.205] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=212) returned 1 [0146.205] CloseHandle (hObject=0x374) returned 1 [0146.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0146.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0146.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.208] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=215) returned 1 [0146.208] CloseHandle (hObject=0x374) returned 1 [0146.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0146.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0146.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.209] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=903) returned 1 [0146.209] CloseHandle (hObject=0x374) returned 1 [0146.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0146.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0146.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.211] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=693) returned 1 [0146.211] CloseHandle (hObject=0x374) returned 1 [0146.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0146.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0146.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.212] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3333) returned 1 [0146.212] CloseHandle (hObject=0x374) returned 1 [0146.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0146.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0146.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.217] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=247) returned 1 [0146.217] CloseHandle (hObject=0x374) returned 1 [0146.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0146.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0146.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.217] SetEvent (hEvent=0x2fc) returned 1 [0146.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.219] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=738) returned 1 [0146.219] CloseHandle (hObject=0x374) returned 1 [0146.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0146.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0146.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.219] SetEvent (hEvent=0x2fc) returned 1 [0146.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0146.220] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=488) returned 1 [0146.220] CloseHandle (hObject=0x374) returned 1 [0146.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0146.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0146.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.228] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15097) returned 1 [0146.228] CloseHandle (hObject=0x378) returned 1 [0146.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0146.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0146.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.229] SetEvent (hEvent=0x2fc) returned 1 [0146.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.229] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11067) returned 1 [0146.229] CloseHandle (hObject=0x378) returned 1 [0146.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0146.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0146.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.231] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=44506) returned 1 [0146.231] CloseHandle (hObject=0x378) returned 1 [0146.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0146.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0146.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.234] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=737) returned 1 [0146.234] CloseHandle (hObject=0x378) returned 1 [0146.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0146.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0146.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.234] SetEvent (hEvent=0x2fc) returned 1 [0146.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.236] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=471) returned 1 [0146.236] CloseHandle (hObject=0x378) returned 1 [0146.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0146.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0146.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.237] SetEvent (hEvent=0x2fc) returned 1 [0146.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.237] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1069) returned 1 [0146.237] CloseHandle (hObject=0x378) returned 1 [0146.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0146.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0146.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.238] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=213) returned 1 [0146.238] CloseHandle (hObject=0x378) returned 1 [0146.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0146.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0146.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.239] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1853) returned 1 [0146.239] CloseHandle (hObject=0x378) returned 1 [0146.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0146.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0146.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.240] SetEvent (hEvent=0x2fc) returned 1 [0146.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.240] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=219) returned 1 [0146.240] CloseHandle (hObject=0x378) returned 1 [0146.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0146.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0146.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.241] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=924) returned 1 [0146.241] CloseHandle (hObject=0x378) returned 1 [0146.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0146.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0146.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.242] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=215) returned 1 [0146.242] CloseHandle (hObject=0x378) returned 1 [0146.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0146.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0146.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.242] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=694) returned 1 [0146.242] CloseHandle (hObject=0x378) returned 1 [0146.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0146.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0146.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.243] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=805) returned 1 [0146.243] CloseHandle (hObject=0x378) returned 1 [0146.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0146.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0146.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.256] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3823) returned 1 [0146.257] CloseHandle (hObject=0x378) returned 1 [0146.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0146.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0146.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.257] SetEvent (hEvent=0x2fc) returned 1 [0146.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.259] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3380096) returned 1 [0146.259] CloseHandle (hObject=0x378) returned 1 [0146.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0146.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0146.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.262] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=367104) returned 1 [0146.262] CloseHandle (hObject=0x378) returned 1 [0146.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0146.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0146.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.262] SetEvent (hEvent=0x2fc) returned 1 [0146.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.264] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2418) returned 1 [0146.265] CloseHandle (hObject=0x378) returned 1 [0146.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0146.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0146.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0146.270] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2556) returned 1 [0146.270] CloseHandle (hObject=0x378) returned 1 [0146.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0146.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0146.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.277] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2578) returned 1 [0146.277] CloseHandle (hObject=0x358) returned 1 [0146.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0146.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0146.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.277] SetEvent (hEvent=0x2fc) returned 1 [0146.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.278] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3024) returned 1 [0146.278] CloseHandle (hObject=0x358) returned 1 [0146.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0146.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0146.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.278] SetEvent (hEvent=0x2fc) returned 1 [0146.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.280] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2560) returned 1 [0146.280] CloseHandle (hObject=0x358) returned 1 [0146.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0146.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0146.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.280] SetEvent (hEvent=0x2fc) returned 1 [0146.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.281] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2628) returned 1 [0146.281] CloseHandle (hObject=0x358) returned 1 [0146.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0146.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0146.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.281] SetEvent (hEvent=0x2fc) returned 1 [0146.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.283] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2532) returned 1 [0146.283] CloseHandle (hObject=0x358) returned 1 [0146.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0146.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0146.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.288] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2526) returned 1 [0146.288] CloseHandle (hObject=0x358) returned 1 [0146.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0146.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0146.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.288] SetEvent (hEvent=0x2fc) returned 1 [0146.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.289] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2568) returned 1 [0146.289] CloseHandle (hObject=0x358) returned 1 [0146.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0146.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0146.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.289] SetEvent (hEvent=0x2fc) returned 1 [0146.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.291] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=41984) returned 1 [0146.291] CloseHandle (hObject=0x358) returned 1 [0146.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0146.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0146.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.291] SetEvent (hEvent=0x2fc) returned 1 [0146.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.294] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2580) returned 1 [0146.294] CloseHandle (hObject=0x358) returned 1 [0146.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0146.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0146.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.298] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2240) returned 1 [0146.298] CloseHandle (hObject=0x358) returned 1 [0146.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0146.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0146.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.302] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2596) returned 1 [0146.302] CloseHandle (hObject=0x358) returned 1 [0146.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0146.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0146.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.306] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7680) returned 1 [0146.306] CloseHandle (hObject=0x358) returned 1 [0146.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0146.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0146.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.306] SetEvent (hEvent=0x2fc) returned 1 [0146.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.306] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7680) returned 1 [0146.306] CloseHandle (hObject=0x358) returned 1 [0146.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0146.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0146.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.309] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=763) returned 1 [0146.309] CloseHandle (hObject=0x358) returned 1 [0146.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0146.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0146.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.309] SetEvent (hEvent=0x2fc) returned 1 [0146.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.310] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10240) returned 1 [0146.310] CloseHandle (hObject=0x358) returned 1 [0146.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0146.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0146.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.311] SetEvent (hEvent=0x2fc) returned 1 [0146.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.312] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1700352) returned 1 [0146.312] CloseHandle (hObject=0x358) returned 1 [0146.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0146.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0146.313] SetEvent (hEvent=0x2fc) returned 1 [0146.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.314] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=503808) returned 1 [0146.314] CloseHandle (hObject=0x358) returned 1 [0146.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0146.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0146.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.315] SetEvent (hEvent=0x2fc) returned 1 [0146.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.316] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1540608) returned 1 [0146.316] CloseHandle (hObject=0x358) returned 1 [0146.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0146.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0146.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.316] SetEvent (hEvent=0x2fc) returned 1 [0146.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.318] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6368768) returned 1 [0146.318] CloseHandle (hObject=0x358) returned 1 [0146.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0146.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0146.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0146.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.320] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=51200) returned 1 [0146.320] CloseHandle (hObject=0x358) returned 1 [0146.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0146.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0146.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.321] SetEvent (hEvent=0x2fc) returned 1 [0146.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.321] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1075712) returned 1 [0146.321] CloseHandle (hObject=0x358) returned 1 [0146.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0146.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0146.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.322] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10240) returned 1 [0146.322] CloseHandle (hObject=0x358) returned 1 [0146.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0146.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0146.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.329] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10240) returned 1 [0146.330] CloseHandle (hObject=0x358) returned 1 [0146.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0146.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0146.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.330] SetEvent (hEvent=0x2fc) returned 1 [0146.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.330] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10240) returned 1 [0146.330] CloseHandle (hObject=0x358) returned 1 [0146.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0146.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0146.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0146.331] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0146.331] CloseHandle (hObject=0x358) returned 1 [0146.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0146.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0146.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.562] SetEvent (hEvent=0x2fc) returned 1 [0146.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.578] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=370176) returned 1 [0146.578] CloseHandle (hObject=0x368) returned 1 [0146.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0146.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0146.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.578] SetEvent (hEvent=0x2fc) returned 1 [0146.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.580] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=244296) returned 1 [0146.580] CloseHandle (hObject=0x368) returned 1 [0146.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0146.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0146.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.580] SetEvent (hEvent=0x2fc) returned 1 [0146.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.583] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=255) returned 1 [0146.583] CloseHandle (hObject=0x368) returned 1 [0146.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0146.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0146.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.583] SetEvent (hEvent=0x2fc) returned 1 [0146.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.585] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1074) returned 1 [0146.585] CloseHandle (hObject=0x368) returned 1 [0146.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0146.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0146.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.585] SetEvent (hEvent=0x2fc) returned 1 [0146.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.587] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=645) returned 1 [0146.587] CloseHandle (hObject=0x368) returned 1 [0146.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0146.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0146.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.587] SetEvent (hEvent=0x2fc) returned 1 [0146.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.589] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=231) returned 1 [0146.589] CloseHandle (hObject=0x368) returned 1 [0146.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0146.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0146.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.589] SetEvent (hEvent=0x2fc) returned 1 [0146.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.590] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23871) returned 1 [0146.590] CloseHandle (hObject=0x368) returned 1 [0146.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0146.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0146.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.591] SetEvent (hEvent=0x2fc) returned 1 [0146.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.591] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=237) returned 1 [0146.591] CloseHandle (hObject=0x368) returned 1 [0146.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0146.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0146.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.594] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6406) returned 1 [0146.594] CloseHandle (hObject=0x368) returned 1 [0146.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0146.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0146.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.595] SetEvent (hEvent=0x2fc) returned 1 [0146.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.596] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=235) returned 1 [0146.596] CloseHandle (hObject=0x368) returned 1 [0146.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0146.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0146.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.597] SetEvent (hEvent=0x2fc) returned 1 [0146.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.597] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4222) returned 1 [0146.598] CloseHandle (hObject=0x368) returned 1 [0146.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0146.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0146.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.598] SetEvent (hEvent=0x2fc) returned 1 [0146.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.599] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=237) returned 1 [0146.599] CloseHandle (hObject=0x368) returned 1 [0146.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0146.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0146.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.599] SetEvent (hEvent=0x2fc) returned 1 [0146.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.600] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6381) returned 1 [0146.600] CloseHandle (hObject=0x368) returned 1 [0146.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0146.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0146.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.601] SetEvent (hEvent=0x2fc) returned 1 [0146.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.601] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=232) returned 1 [0146.601] CloseHandle (hObject=0x368) returned 1 [0146.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0146.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0146.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.603] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5115) returned 1 [0146.603] CloseHandle (hObject=0x368) returned 1 [0146.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0146.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0146.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.603] SetEvent (hEvent=0x2fc) returned 1 [0146.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.604] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=233) returned 1 [0146.604] CloseHandle (hObject=0x368) returned 1 [0146.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0146.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0146.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.605] SetEvent (hEvent=0x2fc) returned 1 [0146.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.606] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1920) returned 1 [0146.606] CloseHandle (hObject=0x368) returned 1 [0146.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0146.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0146.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.606] SetEvent (hEvent=0x2fc) returned 1 [0146.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.607] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=237) returned 1 [0146.607] CloseHandle (hObject=0x368) returned 1 [0146.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0146.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0146.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.608] SetEvent (hEvent=0x2fc) returned 1 [0146.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.610] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4734) returned 1 [0146.610] CloseHandle (hObject=0x368) returned 1 [0146.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0146.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0146.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.610] SetEvent (hEvent=0x2fc) returned 1 [0146.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.611] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=232) returned 1 [0146.611] CloseHandle (hObject=0x368) returned 1 [0146.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0146.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0146.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.614] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10569) returned 1 [0146.614] CloseHandle (hObject=0x368) returned 1 [0146.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0146.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0146.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.615] SetEvent (hEvent=0x2fc) returned 1 [0146.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.616] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=230) returned 1 [0146.616] CloseHandle (hObject=0x368) returned 1 [0146.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0146.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0146.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.616] SetEvent (hEvent=0x2fc) returned 1 [0146.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.617] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7505) returned 1 [0146.617] CloseHandle (hObject=0x368) returned 1 [0146.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0146.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0146.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.617] SetEvent (hEvent=0x2fc) returned 1 [0146.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0146.619] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=990032) returned 1 [0146.619] CloseHandle (hObject=0x368) returned 1 [0146.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0146.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0146.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.620] SetEvent (hEvent=0x2fc) returned 1 [0146.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.885] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=855376) returned 1 [0146.885] CloseHandle (hObject=0x35c) returned 1 [0146.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0146.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0146.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.885] SetEvent (hEvent=0x2fc) returned 1 [0146.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.888] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12448) returned 1 [0146.888] CloseHandle (hObject=0x35c) returned 1 [0146.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0146.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0146.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.888] SetEvent (hEvent=0x2fc) returned 1 [0146.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.889] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20608) returned 1 [0146.889] CloseHandle (hObject=0x35c) returned 1 [0146.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0146.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0146.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.890] SetEvent (hEvent=0x2fc) returned 1 [0146.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.890] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=100488) returned 1 [0146.890] CloseHandle (hObject=0x35c) returned 1 [0146.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0146.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0146.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.891] SetEvent (hEvent=0x2fc) returned 1 [0146.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.891] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=367216) returned 1 [0146.891] CloseHandle (hObject=0x35c) returned 1 [0146.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0146.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0146.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.892] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=48872) returned 1 [0146.892] CloseHandle (hObject=0x35c) returned 1 [0146.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0146.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0146.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.893] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=168064) returned 1 [0146.893] CloseHandle (hObject=0x35c) returned 1 [0146.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0146.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0146.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.894] SetEvent (hEvent=0x2fc) returned 1 [0146.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.895] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17048) returned 1 [0146.895] CloseHandle (hObject=0x35c) returned 1 [0146.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0146.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0146.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.895] SetEvent (hEvent=0x2fc) returned 1 [0146.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.896] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22680) returned 1 [0146.896] CloseHandle (hObject=0x35c) returned 1 [0146.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0146.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0146.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.901] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2702) returned 1 [0146.901] CloseHandle (hObject=0x35c) returned 1 [0146.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0146.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0146.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.903] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15195) returned 1 [0146.903] CloseHandle (hObject=0x35c) returned 1 [0146.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0146.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0146.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.904] SetEvent (hEvent=0x2fc) returned 1 [0146.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.906] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17920) returned 1 [0146.906] CloseHandle (hObject=0x35c) returned 1 [0146.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0146.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0146.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.906] SetEvent (hEvent=0x2fc) returned 1 [0146.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.909] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1233920) returned 1 [0146.909] CloseHandle (hObject=0x35c) returned 1 [0146.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0146.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0146.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.910] SetEvent (hEvent=0x2fc) returned 1 [0146.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.910] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=53760) returned 1 [0146.910] CloseHandle (hObject=0x35c) returned 1 [0146.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0146.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0146.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.911] SetEvent (hEvent=0x2fc) returned 1 [0146.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.912] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=69632) returned 1 [0146.912] CloseHandle (hObject=0x35c) returned 1 [0146.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0146.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0146.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.916] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=70656) returned 1 [0146.916] CloseHandle (hObject=0x35c) returned 1 [0146.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0146.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0146.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.916] SetEvent (hEvent=0x2fc) returned 1 [0146.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.918] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=70656) returned 1 [0146.918] CloseHandle (hObject=0x35c) returned 1 [0146.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0146.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0146.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.918] SetEvent (hEvent=0x2fc) returned 1 [0146.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.919] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13824) returned 1 [0146.919] CloseHandle (hObject=0x35c) returned 1 [0146.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0146.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0146.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.922] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35840) returned 1 [0146.922] CloseHandle (hObject=0x35c) returned 1 [0146.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0146.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0146.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.922] SetEvent (hEvent=0x2fc) returned 1 [0146.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.923] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=404992) returned 1 [0146.923] CloseHandle (hObject=0x35c) returned 1 [0146.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0146.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0146.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.923] SetEvent (hEvent=0x2fc) returned 1 [0146.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.924] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24576) returned 1 [0146.924] CloseHandle (hObject=0x35c) returned 1 [0146.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0146.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0146.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.925] SetEvent (hEvent=0x2fc) returned 1 [0146.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.926] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32768) returned 1 [0146.926] CloseHandle (hObject=0x35c) returned 1 [0146.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0146.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0146.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.926] SetEvent (hEvent=0x2fc) returned 1 [0146.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.929] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=94208) returned 1 [0146.929] CloseHandle (hObject=0x35c) returned 1 [0146.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0146.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0146.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.930] SetEvent (hEvent=0x2fc) returned 1 [0146.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.930] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=623) returned 1 [0146.930] CloseHandle (hObject=0x35c) returned 1 [0146.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0146.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0146.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.932] SetEvent (hEvent=0x2fc) returned 1 [0146.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.935] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6144) returned 1 [0146.935] CloseHandle (hObject=0x35c) returned 1 [0146.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0146.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0146.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.935] SetEvent (hEvent=0x2fc) returned 1 [0146.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.937] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14336) returned 1 [0146.937] CloseHandle (hObject=0x35c) returned 1 [0146.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0146.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0146.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.941] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2560) returned 1 [0146.941] CloseHandle (hObject=0x35c) returned 1 [0146.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0146.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0146.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.942] SetEvent (hEvent=0x2fc) returned 1 [0146.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0146.942] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=242688) returned 1 [0146.942] CloseHandle (hObject=0x35c) returned 1 [0146.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0146.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0146.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0146.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.943] SetEvent (hEvent=0x2fc) returned 1 [0146.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.293] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2560) returned 1 [0147.293] CloseHandle (hObject=0x368) returned 1 [0147.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0147.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0147.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.294] SetEvent (hEvent=0x2fc) returned 1 [0147.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.298] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=356352) returned 1 [0147.298] CloseHandle (hObject=0x368) returned 1 [0147.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0147.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0147.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.341] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6144) returned 1 [0147.341] CloseHandle (hObject=0x370) returned 1 [0147.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0147.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0147.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.345] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18432) returned 1 [0147.345] CloseHandle (hObject=0x370) returned 1 [0147.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0147.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0147.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.351] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=54784) returned 1 [0147.351] CloseHandle (hObject=0x370) returned 1 [0147.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0147.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0147.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.351] SetEvent (hEvent=0x2fc) returned 1 [0147.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.382] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16384) returned 1 [0147.382] CloseHandle (hObject=0x368) returned 1 [0147.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0147.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0147.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.383] SetEvent (hEvent=0x2fc) returned 1 [0147.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.383] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77824) returned 1 [0147.384] CloseHandle (hObject=0x368) returned 1 [0147.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0147.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0147.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.384] SetEvent (hEvent=0x2fc) returned 1 [0147.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.385] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9804) returned 1 [0147.385] CloseHandle (hObject=0x368) returned 1 [0147.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0147.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0147.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.385] SetEvent (hEvent=0x2fc) returned 1 [0147.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.405] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=868352) returned 1 [0147.406] CloseHandle (hObject=0x368) returned 1 [0147.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0147.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0147.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.406] SetEvent (hEvent=0x2fc) returned 1 [0147.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.408] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4608) returned 1 [0147.408] CloseHandle (hObject=0x368) returned 1 [0147.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0147.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0147.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.411] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=854528) returned 1 [0147.411] CloseHandle (hObject=0x368) returned 1 [0147.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0147.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0147.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.412] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=174) returned 1 [0147.412] CloseHandle (hObject=0x368) returned 1 [0147.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0147.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0147.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0147.413] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0147.413] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0147.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x370 [0147.414] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xae, lpOverlapped=0x0) returned 1 [0147.414] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb0, lpOverlapped=0x0) returned 1 [0147.415] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0147.416] CloseHandle (hObject=0x368) returned 1 [0147.416] CloseHandle (hObject=0x370) returned 1 [0147.417] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0 [0147.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.418] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80384) returned 1 [0147.418] CloseHandle (hObject=0x370) returned 1 [0147.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe")) returned 0x20 [0147.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe")) returned 0x20 [0147.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.424] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2560) returned 1 [0147.424] CloseHandle (hObject=0x370) returned 1 [0147.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0147.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0147.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.433] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=53248) returned 1 [0147.433] CloseHandle (hObject=0x35c) returned 1 [0147.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0147.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0147.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.436] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=54272) returned 1 [0147.436] CloseHandle (hObject=0x370) returned 1 [0147.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0147.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0147.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.436] SetEvent (hEvent=0x2fc) returned 1 [0147.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.441] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=512000) returned 1 [0147.441] CloseHandle (hObject=0x35c) returned 1 [0147.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0147.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0147.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.441] SetEvent (hEvent=0x2fc) returned 1 [0147.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.446] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=224256) returned 1 [0147.446] CloseHandle (hObject=0x35c) returned 1 [0147.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0147.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0147.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.456] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5430) returned 1 [0147.456] CloseHandle (hObject=0x370) returned 1 [0147.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0147.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0147.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.457] SetEvent (hEvent=0x2fc) returned 1 [0147.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.463] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80384) returned 1 [0147.463] CloseHandle (hObject=0x35c) returned 1 [0147.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe")) returned 0x20 [0147.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe")) returned 0x20 [0147.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\brook_den.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.464] SetEvent (hEvent=0x2fc) returned 1 [0147.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.574] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16960) returned 1 [0147.574] CloseHandle (hObject=0x35c) returned 1 [0147.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0147.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0147.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.575] SetEvent (hEvent=0x2fc) returned 1 [0147.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.576] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=159808) returned 1 [0147.576] CloseHandle (hObject=0x35c) returned 1 [0147.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0147.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0147.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.577] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=86080) returned 1 [0147.577] CloseHandle (hObject=0x35c) returned 1 [0147.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0147.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0147.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.578] SetEvent (hEvent=0x2fc) returned 1 [0147.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.579] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=587840) returned 1 [0147.579] CloseHandle (hObject=0x35c) returned 1 [0147.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0147.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0147.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.579] SetEvent (hEvent=0x2fc) returned 1 [0147.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.580] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1026112) returned 1 [0147.580] CloseHandle (hObject=0x35c) returned 1 [0147.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0147.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0147.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.581] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1156672) returned 1 [0147.581] CloseHandle (hObject=0x35c) returned 1 [0147.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0147.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0147.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.586] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29760) returned 1 [0147.586] CloseHandle (hObject=0x35c) returned 1 [0147.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0147.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0147.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.586] SetEvent (hEvent=0x2fc) returned 1 [0147.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.587] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24640) returned 1 [0147.587] CloseHandle (hObject=0x35c) returned 1 [0147.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0147.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0147.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0147.588] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=136256) returned 1 [0147.588] CloseHandle (hObject=0x35c) returned 1 [0147.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0147.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0147.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.947] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=274496) returned 1 [0147.947] CloseHandle (hObject=0x360) returned 1 [0147.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0147.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0147.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.948] SetEvent (hEvent=0x2fc) returned 1 [0147.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.948] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=159808) returned 1 [0147.948] CloseHandle (hObject=0x360) returned 1 [0147.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0147.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0147.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.949] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=206912) returned 1 [0147.949] CloseHandle (hObject=0x360) returned 1 [0147.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0147.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0147.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.951] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=142400) returned 1 [0147.951] CloseHandle (hObject=0x360) returned 1 [0147.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0147.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0147.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.951] SetEvent (hEvent=0x2fc) returned 1 [0147.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.952] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=187392) returned 1 [0147.952] CloseHandle (hObject=0x360) returned 1 [0147.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0147.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0147.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.953] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80448) returned 1 [0147.953] CloseHandle (hObject=0x360) returned 1 [0147.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0147.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0147.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.954] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=69184) returned 1 [0147.955] CloseHandle (hObject=0x360) returned 1 [0147.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0147.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0147.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.955] SetEvent (hEvent=0x2fc) returned 1 [0147.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.955] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=538176) returned 1 [0147.956] CloseHandle (hObject=0x360) returned 1 [0147.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0147.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0147.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.956] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=128064) returned 1 [0147.957] CloseHandle (hObject=0x360) returned 1 [0147.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0147.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0147.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.958] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=206912) returned 1 [0147.958] CloseHandle (hObject=0x360) returned 1 [0147.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0147.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0147.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.959] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=319552) returned 1 [0147.959] CloseHandle (hObject=0x360) returned 1 [0147.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0147.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0147.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.960] SetEvent (hEvent=0x2fc) returned 1 [0147.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.960] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29760) returned 1 [0147.960] CloseHandle (hObject=0x360) returned 1 [0147.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0147.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0147.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.961] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14400) returned 1 [0147.961] CloseHandle (hObject=0x360) returned 1 [0147.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0147.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0147.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.962] SetEvent (hEvent=0x2fc) returned 1 [0147.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.963] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15424) returned 1 [0147.963] CloseHandle (hObject=0x360) returned 1 [0147.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0147.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0147.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.964] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=201792) returned 1 [0147.964] CloseHandle (hObject=0x360) returned 1 [0147.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0147.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0147.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.965] SetEvent (hEvent=0x2fc) returned 1 [0147.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.965] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26688) returned 1 [0147.965] CloseHandle (hObject=0x360) returned 1 [0147.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0147.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0147.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.966] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=139840) returned 1 [0147.966] CloseHandle (hObject=0x360) returned 1 [0147.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0147.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0147.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.967] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=41503296) returned 1 [0147.968] CloseHandle (hObject=0x360) returned 1 [0147.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0147.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0147.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0 [0147.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.969] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15936) returned 1 [0147.969] CloseHandle (hObject=0x360) returned 1 [0147.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0147.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0147.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.970] SetEvent (hEvent=0x2fc) returned 1 [0147.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.970] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=174656) returned 1 [0147.970] CloseHandle (hObject=0x360) returned 1 [0147.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0147.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0147.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.971] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=296000) returned 1 [0147.971] CloseHandle (hObject=0x360) returned 1 [0147.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0147.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0147.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.972] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=112192) returned 1 [0147.972] CloseHandle (hObject=0x360) returned 1 [0147.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0147.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0147.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.973] SetEvent (hEvent=0x2fc) returned 1 [0147.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.974] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20032) returned 1 [0147.974] CloseHandle (hObject=0x360) returned 1 [0147.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0147.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0147.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.974] SetEvent (hEvent=0x2fc) returned 1 [0147.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.975] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=235584) returned 1 [0147.975] CloseHandle (hObject=0x360) returned 1 [0147.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0147.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0147.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.976] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=185920) returned 1 [0147.976] CloseHandle (hObject=0x360) returned 1 [0147.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0147.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0147.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.977] SetEvent (hEvent=0x2fc) returned 1 [0147.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.977] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18496) returned 1 [0147.977] CloseHandle (hObject=0x360) returned 1 [0147.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0147.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0147.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.979] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35392) returned 1 [0147.979] CloseHandle (hObject=0x360) returned 1 [0147.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0147.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0147.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.979] SetEvent (hEvent=0x2fc) returned 1 [0147.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.980] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31296) returned 1 [0147.980] CloseHandle (hObject=0x360) returned 1 [0147.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0147.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0147.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0147.981] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=220736) returned 1 [0147.981] CloseHandle (hObject=0x360) returned 1 [0147.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0147.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0147.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0147.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.220] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16448) returned 1 [0148.220] CloseHandle (hObject=0x370) returned 1 [0148.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0148.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0148.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.439] SetEvent (hEvent=0x2fc) returned 1 [0148.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.440] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8809536) returned 1 [0148.440] CloseHandle (hObject=0x360) returned 1 [0148.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0148.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0148.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0 [0148.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.442] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1423) returned 1 [0148.442] CloseHandle (hObject=0x360) returned 1 [0148.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0148.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0148.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.442] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.442] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0148.444] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x58f, lpOverlapped=0x0) returned 1 [0148.446] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x590, lpOverlapped=0x0) returned 1 [0148.447] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0148.447] CloseHandle (hObject=0x360) returned 1 [0148.447] CloseHandle (hObject=0x370) returned 1 [0148.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0 [0148.448] SetEvent (hEvent=0x2fc) returned 1 [0148.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.449] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16448) returned 1 [0148.450] CloseHandle (hObject=0x370) returned 1 [0148.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0148.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0148.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.450] SetEvent (hEvent=0x2fc) returned 1 [0148.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.451] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=204864) returned 1 [0148.451] CloseHandle (hObject=0x370) returned 1 [0148.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0148.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0148.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.452] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=571968) returned 1 [0148.452] CloseHandle (hObject=0x370) returned 1 [0148.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0148.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0148.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.453] SetEvent (hEvent=0x2fc) returned 1 [0148.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.453] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=70208) returned 1 [0148.453] CloseHandle (hObject=0x370) returned 1 [0148.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0148.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0148.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.455] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=135744) returned 1 [0148.455] CloseHandle (hObject=0x370) returned 1 [0148.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0148.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0148.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.456] SetEvent (hEvent=0x2fc) returned 1 [0148.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.456] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31808) returned 1 [0148.456] CloseHandle (hObject=0x370) returned 1 [0148.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0148.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0148.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.457] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=255040) returned 1 [0148.457] CloseHandle (hObject=0x370) returned 1 [0148.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0148.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0148.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.458] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16448) returned 1 [0148.458] CloseHandle (hObject=0x370) returned 1 [0148.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0148.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0148.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.460] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=79936) returned 1 [0148.460] CloseHandle (hObject=0x370) returned 1 [0148.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0148.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0148.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.460] SetEvent (hEvent=0x2fc) returned 1 [0148.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.461] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=197184) returned 1 [0148.461] CloseHandle (hObject=0x370) returned 1 [0148.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0148.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0148.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.463] SetEvent (hEvent=0x2fc) returned 1 [0148.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.463] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=49216) returned 1 [0148.463] CloseHandle (hObject=0x370) returned 1 [0148.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0148.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0148.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.464] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24128) returned 1 [0148.464] CloseHandle (hObject=0x370) returned 1 [0148.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0148.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0148.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.465] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=110144) returned 1 [0148.465] CloseHandle (hObject=0x370) returned 1 [0148.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0148.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0148.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.467] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=192576) returned 1 [0148.467] CloseHandle (hObject=0x370) returned 1 [0148.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0148.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0148.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.468] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=77888) returned 1 [0148.468] CloseHandle (hObject=0x370) returned 1 [0148.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0148.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0148.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.469] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3244) returned 1 [0148.469] CloseHandle (hObject=0x370) returned 1 [0148.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0148.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0148.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0148.562] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcac, lpOverlapped=0x0) returned 1 [0148.564] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcb0, lpOverlapped=0x0) returned 1 [0148.565] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0148.565] CloseHandle (hObject=0x370) returned 1 [0148.566] CloseHandle (hObject=0x360) returned 1 [0148.566] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0 [0148.567] SetEvent (hEvent=0x2fc) returned 1 [0148.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.568] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=149) returned 1 [0148.568] CloseHandle (hObject=0x360) returned 1 [0148.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0148.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0148.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.569] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.569] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0148.571] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x95, lpOverlapped=0x0) returned 1 [0148.572] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa0, lpOverlapped=0x0) returned 1 [0148.573] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0148.573] CloseHandle (hObject=0x360) returned 1 [0148.574] CloseHandle (hObject=0x370) returned 1 [0148.574] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0 [0148.575] SetEvent (hEvent=0x2fc) returned 1 [0148.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.575] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=634) returned 1 [0148.575] CloseHandle (hObject=0x370) returned 1 [0148.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0148.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0148.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.576] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.576] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0148.578] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x27a, lpOverlapped=0x0) returned 1 [0148.579] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x280, lpOverlapped=0x0) returned 1 [0148.580] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0148.580] CloseHandle (hObject=0x370) returned 1 [0148.580] CloseHandle (hObject=0x360) returned 1 [0148.581] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0 [0148.581] SetEvent (hEvent=0x2fc) returned 1 [0148.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.582] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1378) returned 1 [0148.582] CloseHandle (hObject=0x360) returned 1 [0148.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0148.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0148.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.583] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.583] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0148.584] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x562, lpOverlapped=0x0) returned 1 [0148.586] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x570, lpOverlapped=0x0) returned 1 [0148.587] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0148.587] CloseHandle (hObject=0x360) returned 1 [0148.587] CloseHandle (hObject=0x370) returned 1 [0148.588] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0 [0148.588] SetEvent (hEvent=0x2fc) returned 1 [0148.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.589] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3036922) returned 1 [0148.589] CloseHandle (hObject=0x370) returned 1 [0148.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0148.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0148.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0 [0148.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.590] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=84355) returned 1 [0148.590] CloseHandle (hObject=0x370) returned 1 [0148.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0148.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0148.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.591] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.591] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0148.591] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x14983, lpOverlapped=0x0) returned 1 [0148.596] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x14990, lpOverlapped=0x0) returned 1 [0148.598] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0148.599] CloseHandle (hObject=0x370) returned 1 [0148.599] CloseHandle (hObject=0x360) returned 1 [0148.602] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0 [0148.602] SetEvent (hEvent=0x2fc) returned 1 [0148.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.824] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=51236) returned 1 [0148.824] CloseHandle (hObject=0x360) returned 1 [0148.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0148.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0148.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.825] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.825] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0148.827] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc824, lpOverlapped=0x0) returned 1 [0148.830] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc830, lpOverlapped=0x0) returned 1 [0148.832] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0148.832] CloseHandle (hObject=0x360) returned 1 [0148.832] CloseHandle (hObject=0x370) returned 1 [0148.834] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0 [0148.835] SetEvent (hEvent=0x2fc) returned 1 [0148.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.835] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=632) returned 1 [0148.835] CloseHandle (hObject=0x370) returned 1 [0148.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0148.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0148.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.836] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.836] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0148.837] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x278, lpOverlapped=0x0) returned 1 [0148.838] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x280, lpOverlapped=0x0) returned 1 [0148.839] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0148.839] CloseHandle (hObject=0x370) returned 1 [0148.840] CloseHandle (hObject=0x360) returned 1 [0148.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0 [0148.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.842] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1044) returned 1 [0148.842] CloseHandle (hObject=0x360) returned 1 [0148.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0148.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0148.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0148.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0148.849] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.849] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0148.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.150] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x414, lpOverlapped=0x0) returned 1 [0149.152] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x420, lpOverlapped=0x0) returned 1 [0149.154] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0149.154] CloseHandle (hObject=0x360) returned 1 [0149.154] CloseHandle (hObject=0x370) returned 1 [0149.155] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0 [0149.156] SetEvent (hEvent=0x2fc) returned 1 [0149.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.156] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=274474) returned 1 [0149.156] CloseHandle (hObject=0x370) returned 1 [0149.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0149.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0149.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.157] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.157] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0149.158] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4302a, lpOverlapped=0x0) returned 1 [0149.170] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x43030, lpOverlapped=0x0) returned 1 [0149.178] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0149.178] CloseHandle (hObject=0x370) returned 1 [0149.179] CloseHandle (hObject=0x360) returned 1 [0149.187] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0 [0149.188] SetEvent (hEvent=0x2fc) returned 1 [0149.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.189] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3144) returned 1 [0149.189] CloseHandle (hObject=0x360) returned 1 [0149.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0149.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0149.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.190] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.190] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.416] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc48, lpOverlapped=0x0) returned 1 [0149.418] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc50, lpOverlapped=0x0) returned 1 [0149.419] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0149.419] CloseHandle (hObject=0x360) returned 1 [0149.420] CloseHandle (hObject=0x370) returned 1 [0149.420] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0 [0149.421] SetEvent (hEvent=0x2fc) returned 1 [0149.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.421] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5548) returned 1 [0149.421] CloseHandle (hObject=0x370) returned 1 [0149.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0149.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0149.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.422] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.422] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0149.423] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x15ac, lpOverlapped=0x0) returned 1 [0149.424] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x15b0, lpOverlapped=0x0) returned 1 [0149.426] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0149.426] CloseHandle (hObject=0x370) returned 1 [0149.426] CloseHandle (hObject=0x360) returned 1 [0149.427] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0 [0149.427] SetEvent (hEvent=0x2fc) returned 1 [0149.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.427] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4122) returned 1 [0149.427] CloseHandle (hObject=0x360) returned 1 [0149.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0149.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0149.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.428] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.428] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.429] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x101a, lpOverlapped=0x0) returned 1 [0149.430] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1020, lpOverlapped=0x0) returned 1 [0149.431] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0149.431] CloseHandle (hObject=0x360) returned 1 [0149.431] CloseHandle (hObject=0x370) returned 1 [0149.432] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0 [0149.432] SetEvent (hEvent=0x2fc) returned 1 [0149.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.435] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14156) returned 1 [0149.435] CloseHandle (hObject=0x370) returned 1 [0149.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0149.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0149.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.436] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.436] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0149.438] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x374c, lpOverlapped=0x0) returned 1 [0149.440] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3750, lpOverlapped=0x0) returned 1 [0149.441] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0149.441] CloseHandle (hObject=0x370) returned 1 [0149.441] CloseHandle (hObject=0x360) returned 1 [0149.442] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0 [0149.443] SetEvent (hEvent=0x2fc) returned 1 [0149.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.443] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2860) returned 1 [0149.443] CloseHandle (hObject=0x360) returned 1 [0149.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0149.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0149.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.448] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.448] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.448] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb2c, lpOverlapped=0x0) returned 1 [0149.450] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb30, lpOverlapped=0x0) returned 1 [0149.451] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.451] CloseHandle (hObject=0x360) returned 1 [0149.451] CloseHandle (hObject=0x370) returned 1 [0149.452] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0 [0149.452] SetEvent (hEvent=0x2fc) returned 1 [0149.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.453] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3306) returned 1 [0149.453] CloseHandle (hObject=0x370) returned 1 [0149.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0149.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0149.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.453] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.453] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0149.651] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcea, lpOverlapped=0x0) returned 1 [0149.714] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcf0, lpOverlapped=0x0) returned 1 [0149.715] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.715] CloseHandle (hObject=0x370) returned 1 [0149.716] CloseHandle (hObject=0x360) returned 1 [0149.717] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0 [0149.717] SetEvent (hEvent=0x2fc) returned 1 [0149.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.719] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3600) returned 1 [0149.719] CloseHandle (hObject=0x360) returned 1 [0149.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0149.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0149.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.719] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.719] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.720] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe10, lpOverlapped=0x0) returned 1 [0149.724] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe20, lpOverlapped=0x0) returned 1 [0149.725] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.725] CloseHandle (hObject=0x360) returned 1 [0149.726] CloseHandle (hObject=0x370) returned 1 [0149.726] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0 [0149.727] SetEvent (hEvent=0x2fc) returned 1 [0149.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.727] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3409) returned 1 [0149.727] CloseHandle (hObject=0x370) returned 1 [0149.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0149.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0149.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.728] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.728] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0149.729] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd51, lpOverlapped=0x0) returned 1 [0149.731] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd60, lpOverlapped=0x0) returned 1 [0149.732] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.732] CloseHandle (hObject=0x370) returned 1 [0149.732] CloseHandle (hObject=0x360) returned 1 [0149.734] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0 [0149.734] SetEvent (hEvent=0x2fc) returned 1 [0149.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.734] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3223) returned 1 [0149.734] CloseHandle (hObject=0x360) returned 1 [0149.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0149.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0149.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.735] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.735] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.736] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc97, lpOverlapped=0x0) returned 1 [0149.739] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xca0, lpOverlapped=0x0) returned 1 [0149.741] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.741] CloseHandle (hObject=0x360) returned 1 [0149.741] CloseHandle (hObject=0x370) returned 1 [0149.742] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0 [0149.742] SetEvent (hEvent=0x2fc) returned 1 [0149.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.743] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6349) returned 1 [0149.743] CloseHandle (hObject=0x370) returned 1 [0149.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0149.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0149.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.744] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.744] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0149.745] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x18cd, lpOverlapped=0x0) returned 1 [0149.759] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x18d0, lpOverlapped=0x0) returned 1 [0149.760] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.760] CloseHandle (hObject=0x370) returned 1 [0149.761] CloseHandle (hObject=0x360) returned 1 [0149.762] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0 [0149.763] SetEvent (hEvent=0x2fc) returned 1 [0149.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.763] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5712) returned 1 [0149.763] CloseHandle (hObject=0x360) returned 1 [0149.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0149.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0149.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0149.764] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.764] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0149.768] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1650, lpOverlapped=0x0) returned 1 [0149.771] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1660, lpOverlapped=0x0) returned 1 [0149.772] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.772] CloseHandle (hObject=0x360) returned 1 [0149.772] CloseHandle (hObject=0x368) returned 1 [0149.773] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0 [0149.773] SetEvent (hEvent=0x2fc) returned 1 [0149.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0149.976] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3285) returned 1 [0149.976] CloseHandle (hObject=0x358) returned 1 [0149.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0149.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0149.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0149.976] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.977] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.977] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcd5, lpOverlapped=0x0) returned 1 [0149.979] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xce0, lpOverlapped=0x0) returned 1 [0149.980] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0149.980] CloseHandle (hObject=0x358) returned 1 [0149.980] CloseHandle (hObject=0x370) returned 1 [0149.981] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0 [0149.981] SetEvent (hEvent=0x2fc) returned 1 [0149.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.982] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3409) returned 1 [0149.982] CloseHandle (hObject=0x370) returned 1 [0149.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0149.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0149.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.983] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.983] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0149.983] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd51, lpOverlapped=0x0) returned 1 [0149.985] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd60, lpOverlapped=0x0) returned 1 [0149.986] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0149.986] CloseHandle (hObject=0x370) returned 1 [0149.986] CloseHandle (hObject=0x358) returned 1 [0149.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0 [0149.987] SetEvent (hEvent=0x2fc) returned 1 [0149.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0149.988] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4072) returned 1 [0149.988] CloseHandle (hObject=0x358) returned 1 [0149.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0149.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0149.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0149.988] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.989] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0149.990] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfe8, lpOverlapped=0x0) returned 1 [0149.991] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xff0, lpOverlapped=0x0) returned 1 [0149.992] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0149.992] CloseHandle (hObject=0x358) returned 1 [0149.992] CloseHandle (hObject=0x370) returned 1 [0149.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0 [0149.994] SetEvent (hEvent=0x2fc) returned 1 [0149.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.995] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3752) returned 1 [0149.995] CloseHandle (hObject=0x370) returned 1 [0149.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0149.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0149.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0149.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.996] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.996] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0149.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0149.997] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xea8, lpOverlapped=0x0) returned 1 [0149.999] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xeb0, lpOverlapped=0x0) returned 1 [0150.000] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0150.000] CloseHandle (hObject=0x370) returned 1 [0150.000] CloseHandle (hObject=0x368) returned 1 [0150.001] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0 [0150.001] SetEvent (hEvent=0x2fc) returned 1 [0150.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.002] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3752) returned 1 [0150.002] CloseHandle (hObject=0x368) returned 1 [0150.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0150.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0150.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.003] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.003] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0150.004] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xea8, lpOverlapped=0x0) returned 1 [0150.006] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xeb0, lpOverlapped=0x0) returned 1 [0150.007] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0150.007] CloseHandle (hObject=0x368) returned 1 [0150.007] CloseHandle (hObject=0x370) returned 1 [0150.008] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0 [0150.008] SetEvent (hEvent=0x2fc) returned 1 [0150.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.008] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8590) returned 1 [0150.008] CloseHandle (hObject=0x370) returned 1 [0150.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0150.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0150.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.009] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.009] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0150.010] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x218e, lpOverlapped=0x0) returned 1 [0150.012] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2190, lpOverlapped=0x0) returned 1 [0150.013] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.013] CloseHandle (hObject=0x370) returned 1 [0150.013] CloseHandle (hObject=0x368) returned 1 [0150.014] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0 [0150.230] SetEvent (hEvent=0x2fc) returned 1 [0150.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.231] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15276) returned 1 [0150.231] CloseHandle (hObject=0x368) returned 1 [0150.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0150.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0150.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.232] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.232] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0150.233] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3bac, lpOverlapped=0x0) returned 1 [0150.237] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3bb0, lpOverlapped=0x0) returned 1 [0150.238] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.238] CloseHandle (hObject=0x368) returned 1 [0150.238] CloseHandle (hObject=0x370) returned 1 [0150.240] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0 [0150.240] SetEvent (hEvent=0x2fc) returned 1 [0150.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.240] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7805) returned 1 [0150.240] CloseHandle (hObject=0x370) returned 1 [0150.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0150.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0150.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.241] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.241] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0150.243] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1e7d, lpOverlapped=0x0) returned 1 [0150.247] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1e80, lpOverlapped=0x0) returned 1 [0150.248] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0150.248] CloseHandle (hObject=0x370) returned 1 [0150.248] CloseHandle (hObject=0x360) returned 1 [0150.249] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0 [0150.249] SetEvent (hEvent=0x2fc) returned 1 [0150.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.250] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12250) returned 1 [0150.250] CloseHandle (hObject=0x360) returned 1 [0150.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0150.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0150.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.250] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.250] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0150.251] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2fda, lpOverlapped=0x0) returned 1 [0150.254] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2fe0, lpOverlapped=0x0) returned 1 [0150.255] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0150.255] CloseHandle (hObject=0x360) returned 1 [0150.256] CloseHandle (hObject=0x370) returned 1 [0150.256] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0 [0150.257] SetEvent (hEvent=0x2fc) returned 1 [0150.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.259] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5040094) returned 1 [0150.259] CloseHandle (hObject=0x360) returned 1 [0150.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0150.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0150.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0 [0150.259] SetEvent (hEvent=0x2fc) returned 1 [0150.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.267] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=188024) returned 1 [0150.267] CloseHandle (hObject=0x370) returned 1 [0150.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0150.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0150.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.268] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.268] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0150.271] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2de78, lpOverlapped=0x0) returned 1 [0150.280] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2de80, lpOverlapped=0x0) returned 1 [0150.284] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0150.284] CloseHandle (hObject=0x370) returned 1 [0150.284] CloseHandle (hObject=0x368) returned 1 [0150.288] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0 [0150.289] SetEvent (hEvent=0x2fc) returned 1 [0150.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.289] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3860502) returned 1 [0150.289] CloseHandle (hObject=0x368) returned 1 [0150.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0150.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0150.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0 [0150.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.541] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8286) returned 1 [0150.541] CloseHandle (hObject=0x360) returned 1 [0150.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0150.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0150.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.542] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.542] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0150.542] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x205e, lpOverlapped=0x0) returned 1 [0150.544] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2060, lpOverlapped=0x0) returned 1 [0150.545] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.545] CloseHandle (hObject=0x360) returned 1 [0150.545] CloseHandle (hObject=0x368) returned 1 [0150.546] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0 [0150.546] SetEvent (hEvent=0x2fc) returned 1 [0150.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.547] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=44516) returned 1 [0150.547] CloseHandle (hObject=0x368) returned 1 [0150.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0150.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0150.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.548] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.548] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0150.550] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xade4, lpOverlapped=0x0) returned 1 [0150.553] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xadf0, lpOverlapped=0x0) returned 1 [0150.555] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.555] CloseHandle (hObject=0x368) returned 1 [0150.555] CloseHandle (hObject=0x360) returned 1 [0150.557] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0 [0150.557] SetEvent (hEvent=0x2fc) returned 1 [0150.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.558] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18246297) returned 1 [0150.558] CloseHandle (hObject=0x360) returned 1 [0150.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0150.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0150.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0 [0150.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.560] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2204781) returned 1 [0150.560] CloseHandle (hObject=0x360) returned 1 [0150.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0150.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0150.560] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0 [0150.560] SetEvent (hEvent=0x2fc) returned 1 [0150.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.561] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1461) returned 1 [0150.561] CloseHandle (hObject=0x360) returned 1 [0150.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0150.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0150.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.562] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.562] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x368 [0150.562] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5b5, lpOverlapped=0x0) returned 1 [0150.564] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5c0, lpOverlapped=0x0) returned 1 [0150.565] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.565] CloseHandle (hObject=0x360) returned 1 [0150.565] CloseHandle (hObject=0x368) returned 1 [0150.566] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0 [0150.566] SetEvent (hEvent=0x2fc) returned 1 [0150.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.567] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2022734) returned 1 [0150.567] CloseHandle (hObject=0x368) returned 1 [0150.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0150.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0150.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0 [0150.568] SetEvent (hEvent=0x2fc) returned 1 [0150.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.569] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42185) returned 1 [0150.569] CloseHandle (hObject=0x368) returned 1 [0150.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0150.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0150.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0150.570] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa4c9, lpOverlapped=0x0) returned 1 [0150.574] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa4d0, lpOverlapped=0x0) returned 1 [0150.576] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.576] CloseHandle (hObject=0x368) returned 1 [0150.576] CloseHandle (hObject=0x360) returned 1 [0150.578] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0 [0150.578] SetEvent (hEvent=0x2fc) returned 1 [0150.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.579] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=280161) returned 1 [0150.579] CloseHandle (hObject=0x360) returned 1 [0150.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0150.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0150.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.580] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.580] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0150.824] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x44661, lpOverlapped=0x0) returned 1 [0150.833] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x44670, lpOverlapped=0x0) returned 1 [0150.839] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0150.839] CloseHandle (hObject=0x360) returned 1 [0150.839] CloseHandle (hObject=0x36c) returned 1 [0150.845] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0 [0150.846] SetEvent (hEvent=0x2fc) returned 1 [0150.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.846] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32699) returned 1 [0150.846] CloseHandle (hObject=0x36c) returned 1 [0150.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0150.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0150.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0150.847] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.848] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0150.848] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7fbb, lpOverlapped=0x0) returned 1 [0150.851] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7fc0, lpOverlapped=0x0) returned 1 [0150.852] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0150.852] CloseHandle (hObject=0x36c) returned 1 [0150.853] CloseHandle (hObject=0x360) returned 1 [0150.854] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0 [0150.855] SetEvent (hEvent=0x2fc) returned 1 [0150.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.855] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=251327) returned 1 [0150.855] CloseHandle (hObject=0x360) returned 1 [0150.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0150.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0150.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0150.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0150.856] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.856] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0150.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0150.856] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3d5bf, lpOverlapped=0x0) returned 1 [0151.137] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3d5c0, lpOverlapped=0x0) returned 1 [0151.142] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0151.142] CloseHandle (hObject=0x360) returned 1 [0151.142] CloseHandle (hObject=0x36c) returned 1 [0151.149] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0 [0151.149] SetEvent (hEvent=0x2fc) returned 1 [0151.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.150] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=68924) returned 1 [0151.150] CloseHandle (hObject=0x36c) returned 1 [0151.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0151.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0151.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.151] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.151] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0151.152] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x10d3c, lpOverlapped=0x0) returned 1 [0151.156] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x10d40, lpOverlapped=0x0) returned 1 [0151.158] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0151.158] CloseHandle (hObject=0x36c) returned 1 [0151.158] CloseHandle (hObject=0x360) returned 1 [0151.160] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0 [0151.160] SetEvent (hEvent=0x2fc) returned 1 [0151.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.161] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3928) returned 1 [0151.161] CloseHandle (hObject=0x360) returned 1 [0151.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0151.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0151.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.161] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.161] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0151.162] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf58, lpOverlapped=0x0) returned 1 [0151.164] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf60, lpOverlapped=0x0) returned 1 [0151.165] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0151.165] CloseHandle (hObject=0x360) returned 1 [0151.165] CloseHandle (hObject=0x36c) returned 1 [0151.166] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0 [0151.166] SetEvent (hEvent=0x2fc) returned 1 [0151.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.167] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3770) returned 1 [0151.167] CloseHandle (hObject=0x36c) returned 1 [0151.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0151.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0151.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.168] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.168] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0151.168] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xeba, lpOverlapped=0x0) returned 1 [0151.428] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xec0, lpOverlapped=0x0) returned 1 [0151.429] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0151.430] CloseHandle (hObject=0x36c) returned 1 [0151.430] CloseHandle (hObject=0x360) returned 1 [0151.431] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0 [0151.431] SetEvent (hEvent=0x2fc) returned 1 [0151.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.432] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10568) returned 1 [0151.432] CloseHandle (hObject=0x360) returned 1 [0151.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0151.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0151.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0151.434] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2948, lpOverlapped=0x0) returned 1 [0151.436] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2950, lpOverlapped=0x0) returned 1 [0151.437] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0151.437] CloseHandle (hObject=0x360) returned 1 [0151.437] CloseHandle (hObject=0x36c) returned 1 [0151.438] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0 [0151.438] SetEvent (hEvent=0x2fc) returned 1 [0151.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.441] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=75144) returned 1 [0151.441] CloseHandle (hObject=0x36c) returned 1 [0151.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0151.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0151.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.442] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.442] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0151.443] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x12588, lpOverlapped=0x0) returned 1 [0151.447] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x12590, lpOverlapped=0x0) returned 1 [0151.449] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0151.449] CloseHandle (hObject=0x36c) returned 1 [0151.449] CloseHandle (hObject=0x360) returned 1 [0151.452] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0 [0151.453] SetEvent (hEvent=0x2fc) returned 1 [0151.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.453] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=75124) returned 1 [0151.453] CloseHandle (hObject=0x360) returned 1 [0151.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0151.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0151.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.456] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.456] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0151.457] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x12574, lpOverlapped=0x0) returned 1 [0151.461] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x12580, lpOverlapped=0x0) returned 1 [0151.464] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0151.464] CloseHandle (hObject=0x360) returned 1 [0151.464] CloseHandle (hObject=0x36c) returned 1 [0151.466] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0 [0151.468] SetEvent (hEvent=0x2fc) returned 1 [0151.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.468] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80856) returned 1 [0151.468] CloseHandle (hObject=0x36c) returned 1 [0151.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0151.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0151.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0151.469] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.469] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0151.709] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x13bd8, lpOverlapped=0x0) returned 1 [0151.713] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13be0, lpOverlapped=0x0) returned 1 [0151.715] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0151.715] CloseHandle (hObject=0x36c) returned 1 [0151.715] CloseHandle (hObject=0x358) returned 1 [0151.718] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0 [0151.718] SetEvent (hEvent=0x2fc) returned 1 [0151.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0151.720] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=344908) returned 1 [0151.721] CloseHandle (hObject=0x358) returned 1 [0151.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0151.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0151.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0151.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0151.721] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.721] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0151.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0151.722] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5434c, lpOverlapped=0x0) returned 1 [0151.733] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x54350, lpOverlapped=0x0) returned 1 [0151.739] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0151.740] CloseHandle (hObject=0x358) returned 1 [0151.740] CloseHandle (hObject=0x36c) returned 1 [0152.011] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0 [0152.011] SetEvent (hEvent=0x2fc) returned 1 [0152.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.012] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=317896) returned 1 [0152.012] CloseHandle (hObject=0x36c) returned 1 [0152.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0152.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0152.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0152.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.013] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.013] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0152.013] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4d9c8, lpOverlapped=0x0) returned 1 [0152.024] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4d9d0, lpOverlapped=0x0) returned 1 [0152.030] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0152.030] CloseHandle (hObject=0x36c) returned 1 [0152.030] CloseHandle (hObject=0x360) returned 1 [0152.038] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0 [0152.038] SetEvent (hEvent=0x2fc) returned 1 [0152.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0152.039] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=698236) returned 1 [0152.039] CloseHandle (hObject=0x360) returned 1 [0152.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0152.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0152.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0152.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0152.040] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.040] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0152.295] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xaa77c, lpOverlapped=0x0) returned 1 [0152.314] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xaa780, lpOverlapped=0x0) returned 1 [0152.326] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0152.326] CloseHandle (hObject=0x360) returned 1 [0152.327] CloseHandle (hObject=0x36c) returned 1 [0152.538] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0 [0152.539] SetEvent (hEvent=0x2fc) returned 1 [0152.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.540] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=234068) returned 1 [0152.540] CloseHandle (hObject=0x36c) returned 1 [0152.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0152.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0152.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0152.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.540] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.540] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0152.541] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x39254, lpOverlapped=0x0) returned 1 [0152.593] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x39260, lpOverlapped=0x0) returned 1 [0152.597] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0152.597] CloseHandle (hObject=0x36c) returned 1 [0152.598] CloseHandle (hObject=0x37c) returned 1 [0152.957] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0 [0152.957] SetEvent (hEvent=0x2fc) returned 1 [0152.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.958] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=242700) returned 1 [0152.958] CloseHandle (hObject=0x37c) returned 1 [0152.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0152.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0152.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0152.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.959] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.959] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0152.960] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3b40c, lpOverlapped=0x0) returned 1 [0152.969] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3b410, lpOverlapped=0x0) returned 1 [0152.973] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0152.973] CloseHandle (hObject=0x37c) returned 1 [0152.973] CloseHandle (hObject=0x358) returned 1 [0152.979] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0 [0152.979] SetEvent (hEvent=0x2fc) returned 1 [0152.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0152.980] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13962) returned 1 [0152.980] CloseHandle (hObject=0x358) returned 1 [0152.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0152.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0152.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0152.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0152.981] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.981] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0152.981] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x368a, lpOverlapped=0x0) returned 1 [0152.990] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3690, lpOverlapped=0x0) returned 1 [0152.991] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x122, lpOverlapped=0x0) returned 1 [0152.991] CloseHandle (hObject=0x358) returned 1 [0152.991] CloseHandle (hObject=0x37c) returned 1 [0152.992] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0 [0152.993] SetEvent (hEvent=0x2fc) returned 1 [0152.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.995] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1280) returned 1 [0152.995] CloseHandle (hObject=0x37c) returned 1 [0152.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0152.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0152.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0152.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0152.996] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.996] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0152.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0153.185] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x500, lpOverlapped=0x0) returned 1 [0153.196] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x510, lpOverlapped=0x0) returned 1 [0153.197] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0153.197] CloseHandle (hObject=0x37c) returned 1 [0153.197] CloseHandle (hObject=0x358) returned 1 [0153.198] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0 [0153.198] SetEvent (hEvent=0x2fc) returned 1 [0153.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.199] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=153) returned 1 [0153.199] CloseHandle (hObject=0x358) returned 1 [0153.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0153.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0153.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0153.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.199] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.199] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x37c [0153.200] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x99, lpOverlapped=0x0) returned 1 [0153.201] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa0, lpOverlapped=0x0) returned 1 [0153.202] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0153.202] CloseHandle (hObject=0x358) returned 1 [0153.202] CloseHandle (hObject=0x37c) returned 1 [0153.203] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0 [0153.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.205] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=165) returned 1 [0153.205] CloseHandle (hObject=0x358) returned 1 [0153.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0153.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0153.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0153.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.206] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.206] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0153.209] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa5, lpOverlapped=0x0) returned 1 [0153.210] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb0, lpOverlapped=0x0) returned 1 [0153.211] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0153.211] CloseHandle (hObject=0x358) returned 1 [0153.211] CloseHandle (hObject=0x36c) returned 1 [0153.212] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0 [0153.212] SetEvent (hEvent=0x2fc) returned 1 [0153.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0153.213] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=153) returned 1 [0153.213] CloseHandle (hObject=0x36c) returned 1 [0153.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0153.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0153.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0153.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0153.214] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.214] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0153.217] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x99, lpOverlapped=0x0) returned 1 [0153.218] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa0, lpOverlapped=0x0) returned 1 [0153.219] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0153.219] CloseHandle (hObject=0x36c) returned 1 [0153.219] CloseHandle (hObject=0x358) returned 1 [0153.220] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0 [0153.221] SetEvent (hEvent=0x2fc) returned 1 [0153.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.221] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=168) returned 1 [0153.221] CloseHandle (hObject=0x358) returned 1 [0153.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0153.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0153.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0153.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.222] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.222] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0153.222] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa8, lpOverlapped=0x0) returned 1 [0153.223] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb0, lpOverlapped=0x0) returned 1 [0153.224] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0153.224] CloseHandle (hObject=0x358) returned 1 [0153.224] CloseHandle (hObject=0x36c) returned 1 [0153.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0 [0153.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0153.226] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=153) returned 1 [0153.226] CloseHandle (hObject=0x36c) returned 1 [0153.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0153.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0153.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0153.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0153.226] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.227] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0153.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0153.227] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x99, lpOverlapped=0x0) returned 1 [0153.228] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa0, lpOverlapped=0x0) returned 1 [0153.229] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0153.229] CloseHandle (hObject=0x36c) returned 1 [0153.229] CloseHandle (hObject=0x358) returned 1 [0153.230] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0 [0153.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.490] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=147) returned 1 [0154.490] CloseHandle (hObject=0x358) returned 1 [0154.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0154.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0154.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.491] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.491] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0154.492] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x93, lpOverlapped=0x0) returned 1 [0154.493] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa0, lpOverlapped=0x0) returned 1 [0154.494] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0154.494] CloseHandle (hObject=0x358) returned 1 [0154.494] CloseHandle (hObject=0x36c) returned 1 [0154.495] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0 [0154.495] SetEvent (hEvent=0x2fc) returned 1 [0154.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.496] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=153) returned 1 [0154.496] CloseHandle (hObject=0x36c) returned 1 [0154.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0154.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0154.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.497] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.497] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0154.498] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x99, lpOverlapped=0x0) returned 1 [0154.499] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa0, lpOverlapped=0x0) returned 1 [0154.500] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0154.500] CloseHandle (hObject=0x36c) returned 1 [0154.500] CloseHandle (hObject=0x358) returned 1 [0154.501] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0 [0154.501] SetEvent (hEvent=0x2fc) returned 1 [0154.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.501] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=56) returned 1 [0154.501] CloseHandle (hObject=0x358) returned 1 [0154.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0154.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0154.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.502] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.502] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0154.503] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x38, lpOverlapped=0x0) returned 1 [0154.504] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x40, lpOverlapped=0x0) returned 1 [0154.505] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0154.505] CloseHandle (hObject=0x358) returned 1 [0154.505] CloseHandle (hObject=0x36c) returned 1 [0154.506] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0 [0154.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.507] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=944167) returned 1 [0154.507] CloseHandle (hObject=0x36c) returned 1 [0154.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0154.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0154.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.508] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.508] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0154.509] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe6827, lpOverlapped=0x0) returned 1 [0154.752] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe6830, lpOverlapped=0x0) returned 1 [0154.767] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0154.767] CloseHandle (hObject=0x36c) returned 1 [0154.768] CloseHandle (hObject=0x358) returned 1 [0154.973] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0 [0154.974] SetEvent (hEvent=0x2fc) returned 1 [0154.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.975] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=116446) returned 1 [0154.975] CloseHandle (hObject=0x358) returned 1 [0154.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0154.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0154.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.975] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.975] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0154.976] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1c6de, lpOverlapped=0x0) returned 1 [0154.981] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1c6e0, lpOverlapped=0x0) returned 1 [0154.983] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0154.983] CloseHandle (hObject=0x358) returned 1 [0154.983] CloseHandle (hObject=0x36c) returned 1 [0154.986] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0 [0154.986] SetEvent (hEvent=0x2fc) returned 1 [0154.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.987] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20109) returned 1 [0154.987] CloseHandle (hObject=0x36c) returned 1 [0154.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0154.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0154.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.987] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.988] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0154.990] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4e8d, lpOverlapped=0x0) returned 1 [0154.992] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4e90, lpOverlapped=0x0) returned 1 [0154.993] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0154.993] CloseHandle (hObject=0x36c) returned 1 [0154.993] CloseHandle (hObject=0x358) returned 1 [0154.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0 [0154.994] SetEvent (hEvent=0x2fc) returned 1 [0154.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.995] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20065) returned 1 [0154.995] CloseHandle (hObject=0x358) returned 1 [0154.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0154.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0154.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0154.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.996] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.996] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0154.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x36c [0154.996] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4e61, lpOverlapped=0x0) returned 1 [0155.245] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4e70, lpOverlapped=0x0) returned 1 [0155.247] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0155.247] CloseHandle (hObject=0x358) returned 1 [0155.247] CloseHandle (hObject=0x36c) returned 1 [0155.250] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0 [0155.250] SetEvent (hEvent=0x2fc) returned 1 [0155.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.251] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=560581) returned 1 [0155.251] CloseHandle (hObject=0x36c) returned 1 [0155.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0155.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0155.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0155.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.252] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0155.252] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0155.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0155.253] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x88dc5, lpOverlapped=0x0) returned 1 [0155.271] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x88dd0, lpOverlapped=0x0) returned 1 [0155.281] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0155.282] CloseHandle (hObject=0x36c) returned 1 [0155.282] CloseHandle (hObject=0x358) returned 1 [0155.544] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0 [0155.544] SetEvent (hEvent=0x2fc) returned 1 [0155.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.545] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33932) returned 1 [0155.546] CloseHandle (hObject=0x358) returned 1 [0155.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0155.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0155.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0155.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.546] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0155.547] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0155.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0155.548] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x848c, lpOverlapped=0x0) returned 1 [0155.551] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8490, lpOverlapped=0x0) returned 1 [0155.553] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0155.553] CloseHandle (hObject=0x358) returned 1 [0155.554] CloseHandle (hObject=0x344) returned 1 [0155.556] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0 [0155.557] SetEvent (hEvent=0x2fc) returned 1 [0155.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0155.557] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=584576) returned 1 [0155.557] CloseHandle (hObject=0x344) returned 1 [0155.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0155.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0155.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0155.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0155.558] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0155.558] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0155.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0155.559] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8eb80, lpOverlapped=0x0) returned 1 [0155.583] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8eb90, lpOverlapped=0x0) returned 1 [0156.112] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0156.113] CloseHandle (hObject=0x344) returned 1 [0156.113] CloseHandle (hObject=0x358) returned 1 [0156.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0 [0156.128] SetEvent (hEvent=0x2fc) returned 1 [0156.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.129] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4226) returned 1 [0156.129] CloseHandle (hObject=0x358) returned 1 [0156.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0156.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0156.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.129] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.129] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.130] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1082, lpOverlapped=0x0) returned 1 [0156.132] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1090, lpOverlapped=0x0) returned 1 [0156.133] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0156.133] CloseHandle (hObject=0x358) returned 1 [0156.133] CloseHandle (hObject=0x344) returned 1 [0156.134] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0 [0156.134] SetEvent (hEvent=0x2fc) returned 1 [0156.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.134] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2455) returned 1 [0156.134] CloseHandle (hObject=0x344) returned 1 [0156.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0156.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0156.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.135] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.135] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.136] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x997, lpOverlapped=0x0) returned 1 [0156.138] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9a0, lpOverlapped=0x0) returned 1 [0156.139] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.139] CloseHandle (hObject=0x344) returned 1 [0156.139] CloseHandle (hObject=0x358) returned 1 [0156.140] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0 [0156.140] SetEvent (hEvent=0x2fc) returned 1 [0156.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.142] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3998) returned 1 [0156.142] CloseHandle (hObject=0x358) returned 1 [0156.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0156.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0156.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.406] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.406] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.409] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf9e, lpOverlapped=0x0) returned 1 [0156.410] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfa0, lpOverlapped=0x0) returned 1 [0156.411] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.411] CloseHandle (hObject=0x358) returned 1 [0156.412] CloseHandle (hObject=0x344) returned 1 [0156.413] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0 [0156.413] SetEvent (hEvent=0x2fc) returned 1 [0156.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.414] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2856) returned 1 [0156.414] CloseHandle (hObject=0x344) returned 1 [0156.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0156.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0156.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.415] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.415] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.418] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb28, lpOverlapped=0x0) returned 1 [0156.419] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb30, lpOverlapped=0x0) returned 1 [0156.420] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x112, lpOverlapped=0x0) returned 1 [0156.420] CloseHandle (hObject=0x344) returned 1 [0156.420] CloseHandle (hObject=0x358) returned 1 [0156.421] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0 [0156.422] SetEvent (hEvent=0x2fc) returned 1 [0156.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.422] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14630) returned 1 [0156.422] CloseHandle (hObject=0x358) returned 1 [0156.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0156.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0156.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.423] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.423] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.424] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3926, lpOverlapped=0x0) returned 1 [0156.426] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3930, lpOverlapped=0x0) returned 1 [0156.427] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.427] CloseHandle (hObject=0x358) returned 1 [0156.427] CloseHandle (hObject=0x344) returned 1 [0156.429] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0 [0156.429] SetEvent (hEvent=0x2fc) returned 1 [0156.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.430] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3376) returned 1 [0156.430] CloseHandle (hObject=0x344) returned 1 [0156.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0156.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0156.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.430] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.431] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.432] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd30, lpOverlapped=0x0) returned 1 [0156.434] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd40, lpOverlapped=0x0) returned 1 [0156.435] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.435] CloseHandle (hObject=0x344) returned 1 [0156.435] CloseHandle (hObject=0x358) returned 1 [0156.436] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0 [0156.436] SetEvent (hEvent=0x2fc) returned 1 [0156.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.436] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=381) returned 1 [0156.436] CloseHandle (hObject=0x358) returned 1 [0156.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0156.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0156.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.437] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.437] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.438] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x17d, lpOverlapped=0x0) returned 1 [0156.438] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x180, lpOverlapped=0x0) returned 1 [0156.439] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.440] CloseHandle (hObject=0x358) returned 1 [0156.440] CloseHandle (hObject=0x344) returned 1 [0156.441] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0 [0156.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.442] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2126) returned 1 [0156.442] CloseHandle (hObject=0x344) returned 1 [0156.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0156.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0156.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.443] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.443] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.444] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x84e, lpOverlapped=0x0) returned 1 [0156.616] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x850, lpOverlapped=0x0) returned 1 [0156.617] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0156.617] CloseHandle (hObject=0x344) returned 1 [0156.617] CloseHandle (hObject=0x358) returned 1 [0156.618] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0 [0156.618] SetEvent (hEvent=0x2fc) returned 1 [0156.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.619] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4464) returned 1 [0156.619] CloseHandle (hObject=0x358) returned 1 [0156.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0156.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0156.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.620] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.620] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.620] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1170, lpOverlapped=0x0) returned 1 [0156.622] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1180, lpOverlapped=0x0) returned 1 [0156.623] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0156.623] CloseHandle (hObject=0x358) returned 1 [0156.623] CloseHandle (hObject=0x344) returned 1 [0156.624] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0 [0156.624] SetEvent (hEvent=0x2fc) returned 1 [0156.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.625] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1923211) returned 1 [0156.625] CloseHandle (hObject=0x344) returned 1 [0156.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0156.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0156.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0 [0156.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.626] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2796) returned 1 [0156.626] CloseHandle (hObject=0x344) returned 1 [0156.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0156.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0156.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.627] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.627] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.628] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xaec, lpOverlapped=0x0) returned 1 [0156.629] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xaf0, lpOverlapped=0x0) returned 1 [0156.630] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.631] CloseHandle (hObject=0x344) returned 1 [0156.631] CloseHandle (hObject=0x358) returned 1 [0156.632] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0 [0156.632] SetEvent (hEvent=0x2fc) returned 1 [0156.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.633] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10393) returned 1 [0156.633] CloseHandle (hObject=0x358) returned 1 [0156.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0156.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0156.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.633] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.633] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.634] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2899, lpOverlapped=0x0) returned 1 [0156.636] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x28a0, lpOverlapped=0x0) returned 1 [0156.637] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.638] CloseHandle (hObject=0x358) returned 1 [0156.638] CloseHandle (hObject=0x344) returned 1 [0156.639] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0 [0156.639] SetEvent (hEvent=0x2fc) returned 1 [0156.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.640] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3492573) returned 1 [0156.640] CloseHandle (hObject=0x344) returned 1 [0156.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0156.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0156.640] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0 [0156.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.641] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=54560347) returned 1 [0156.641] CloseHandle (hObject=0x344) returned 1 [0156.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0156.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0156.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0 [0156.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.647] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4054) returned 1 [0156.647] CloseHandle (hObject=0x344) returned 1 [0156.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0156.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0156.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.648] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.648] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.651] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfd6, lpOverlapped=0x0) returned 1 [0156.818] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfe0, lpOverlapped=0x0) returned 1 [0156.820] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0156.824] CloseHandle (hObject=0x344) returned 1 [0156.824] CloseHandle (hObject=0x358) returned 1 [0156.825] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0 [0156.826] SetEvent (hEvent=0x2fc) returned 1 [0156.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.827] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1253) returned 1 [0156.827] CloseHandle (hObject=0x358) returned 1 [0156.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0156.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0156.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.828] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.828] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.829] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4e5, lpOverlapped=0x0) returned 1 [0156.830] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0156.831] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0156.832] CloseHandle (hObject=0x358) returned 1 [0156.832] CloseHandle (hObject=0x344) returned 1 [0156.833] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0 [0156.833] SetEvent (hEvent=0x2fc) returned 1 [0156.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.834] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=114923) returned 1 [0156.834] CloseHandle (hObject=0x344) returned 1 [0156.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0156.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0156.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.834] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.835] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.837] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1c0eb, lpOverlapped=0x0) returned 1 [0156.841] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1c0f0, lpOverlapped=0x0) returned 1 [0156.844] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0156.844] CloseHandle (hObject=0x344) returned 1 [0156.845] CloseHandle (hObject=0x358) returned 1 [0156.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0 [0156.848] SetEvent (hEvent=0x2fc) returned 1 [0156.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.850] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2466) returned 1 [0156.850] CloseHandle (hObject=0x358) returned 1 [0156.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0156.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0156.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.850] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.850] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0156.851] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9a2, lpOverlapped=0x0) returned 1 [0156.853] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9b0, lpOverlapped=0x0) returned 1 [0156.854] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0156.854] CloseHandle (hObject=0x358) returned 1 [0156.854] CloseHandle (hObject=0x344) returned 1 [0156.855] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0 [0156.855] SetEvent (hEvent=0x2fc) returned 1 [0156.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.856] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=36524) returned 1 [0156.856] CloseHandle (hObject=0x344) returned 1 [0156.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0156.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0156.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0156.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0156.856] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.856] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0156.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0156.857] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8eac, lpOverlapped=0x0) returned 1 [0157.096] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8eb0, lpOverlapped=0x0) returned 1 [0157.107] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0157.107] CloseHandle (hObject=0x344) returned 1 [0157.107] CloseHandle (hObject=0x358) returned 1 [0157.108] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0 [0157.108] SetEvent (hEvent=0x2fc) returned 1 [0157.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.109] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=98) returned 1 [0157.109] CloseHandle (hObject=0x358) returned 1 [0157.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0157.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0157.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.110] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.110] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0157.111] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x62, lpOverlapped=0x0) returned 1 [0157.112] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x70, lpOverlapped=0x0) returned 1 [0157.113] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0157.113] CloseHandle (hObject=0x358) returned 1 [0157.113] CloseHandle (hObject=0x344) returned 1 [0157.113] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0 [0157.114] SetEvent (hEvent=0x2fc) returned 1 [0157.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.114] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3527) returned 1 [0157.114] CloseHandle (hObject=0x344) returned 1 [0157.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0157.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0157.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.115] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.115] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0157.116] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xdc7, lpOverlapped=0x0) returned 1 [0157.117] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xdd0, lpOverlapped=0x0) returned 1 [0157.118] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0157.119] CloseHandle (hObject=0x344) returned 1 [0157.119] CloseHandle (hObject=0x358) returned 1 [0157.119] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0 [0157.119] SetEvent (hEvent=0x2fc) returned 1 [0157.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.120] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=0) returned 1 [0157.120] CloseHandle (hObject=0x358) returned 1 [0157.120] SetEvent (hEvent=0x2fc) returned 1 [0157.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.121] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3026) returned 1 [0157.121] CloseHandle (hObject=0x358) returned 1 [0157.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0157.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0157.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.121] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.122] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0157.122] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbd2, lpOverlapped=0x0) returned 1 [0157.124] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbe0, lpOverlapped=0x0) returned 1 [0157.125] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0157.125] CloseHandle (hObject=0x358) returned 1 [0157.125] CloseHandle (hObject=0x344) returned 1 [0157.125] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0 [0157.125] SetEvent (hEvent=0x2fc) returned 1 [0157.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.126] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1210) returned 1 [0157.126] CloseHandle (hObject=0x344) returned 1 [0157.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0157.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0157.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.127] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.127] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0157.127] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ba, lpOverlapped=0x0) returned 1 [0157.129] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4c0, lpOverlapped=0x0) returned 1 [0157.130] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0157.130] CloseHandle (hObject=0x344) returned 1 [0157.130] CloseHandle (hObject=0x358) returned 1 [0157.130] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0 [0157.131] SetEvent (hEvent=0x2fc) returned 1 [0157.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.131] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=105500) returned 1 [0157.131] CloseHandle (hObject=0x358) returned 1 [0157.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0157.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0157.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.132] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.132] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x344 [0157.133] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x19c1c, lpOverlapped=0x0) returned 1 [0157.138] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x19c20, lpOverlapped=0x0) returned 1 [0157.140] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0157.140] CloseHandle (hObject=0x358) returned 1 [0157.140] CloseHandle (hObject=0x344) returned 1 [0157.141] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0 [0157.141] SetEvent (hEvent=0x2fc) returned 1 [0157.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.141] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8400) returned 1 [0157.141] CloseHandle (hObject=0x344) returned 1 [0157.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0157.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0157.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.142] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.142] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0157.142] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x20d0, lpOverlapped=0x0) returned 1 [0157.344] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x20e0, lpOverlapped=0x0) returned 1 [0157.345] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0157.345] CloseHandle (hObject=0x344) returned 1 [0157.345] CloseHandle (hObject=0x358) returned 1 [0157.345] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0 [0157.345] SetEvent (hEvent=0x2fc) returned 1 [0157.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\scriptftp.exe" (normalized: "c:\\program files\\java\\scriptftp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.347] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80384) returned 1 [0157.347] CloseHandle (hObject=0x358) returned 1 [0157.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\scriptftp.exe" (normalized: "c:\\program files\\java\\scriptftp.exe")) returned 0x20 [0157.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\scriptftp.exe" (normalized: "c:\\program files\\java\\scriptftp.exe")) returned 0x20 [0157.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\scriptftp.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\scriptftp.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\scriptftp.exe" (normalized: "c:\\program files\\java\\scriptftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.347] SetEvent (hEvent=0x2fc) returned 1 [0157.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\skype.exe" (normalized: "c:\\program files\\java\\skype.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.348] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80384) returned 1 [0157.348] CloseHandle (hObject=0x358) returned 1 [0157.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\skype.exe" (normalized: "c:\\program files\\java\\skype.exe")) returned 0x20 [0157.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\skype.exe" (normalized: "c:\\program files\\java\\skype.exe")) returned 0x20 [0157.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\skype.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\skype.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\skype.exe" (normalized: "c:\\program files\\java\\skype.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\afr38.exe" (normalized: "c:\\program files\\microsoft office\\afr38.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.349] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=80384) returned 1 [0157.349] CloseHandle (hObject=0x358) returned 1 [0157.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\afr38.exe" (normalized: "c:\\program files\\microsoft office\\afr38.exe")) returned 0x20 [0157.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\afr38.exe" (normalized: "c:\\program files\\microsoft office\\afr38.exe")) returned 0x20 [0157.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\afr38.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\afr38.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\afr38.exe" (normalized: "c:\\program files\\microsoft office\\afr38.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.350] SetEvent (hEvent=0x2fc) returned 1 [0157.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.350] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5944055) returned 1 [0157.350] CloseHandle (hObject=0x358) returned 1 [0157.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0157.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0157.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0 [0157.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.351] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=281) returned 1 [0157.351] CloseHandle (hObject=0x358) returned 1 [0157.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0157.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0157.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.352] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.352] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0157.355] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x119, lpOverlapped=0x0) returned 1 [0157.356] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x120, lpOverlapped=0x0) returned 1 [0157.357] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x102, lpOverlapped=0x0) returned 1 [0157.358] CloseHandle (hObject=0x358) returned 1 [0157.358] CloseHandle (hObject=0x344) returned 1 [0157.359] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0 [0157.359] SetEvent (hEvent=0x2fc) returned 1 [0157.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.360] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=174528) returned 1 [0157.360] CloseHandle (hObject=0x344) returned 1 [0157.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0157.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0157.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0157.361] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.361] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x358 [0157.362] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a9c0, lpOverlapped=0x0) returned 1 [0157.368] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a9d0, lpOverlapped=0x0) returned 1 [0157.372] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0157.372] CloseHandle (hObject=0x344) returned 1 [0157.372] CloseHandle (hObject=0x358) returned 1 [0157.372] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0 [0157.373] SetEvent (hEvent=0x2fc) returned 1 [0157.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.373] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=94467) returned 1 [0157.373] CloseHandle (hObject=0x358) returned 1 [0157.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0157.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0157.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.374] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27200) returned 1 [0157.374] CloseHandle (hObject=0x358) returned 1 [0157.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0157.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0157.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.375] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=36336) returned 1 [0157.375] CloseHandle (hObject=0x358) returned 1 [0157.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0157.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0157.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.376] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.376] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x370 [0157.380] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8df0, lpOverlapped=0x0) returned 1 [0157.699] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8e00, lpOverlapped=0x0) returned 1 [0157.701] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0157.701] CloseHandle (hObject=0x358) returned 1 [0157.701] CloseHandle (hObject=0x370) returned 1 [0157.701] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0 [0157.702] SetEvent (hEvent=0x2fc) returned 1 [0157.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0157.703] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=800867) returned 1 [0157.703] CloseHandle (hObject=0x370) returned 1 [0157.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0157.704] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.704] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0157.705] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc3863, lpOverlapped=0x0) returned 1 [0157.728] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc3870, lpOverlapped=0x0) returned 1 [0157.743] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0157.743] CloseHandle (hObject=0x370) returned 1 [0157.743] CloseHandle (hObject=0x358) returned 1 [0157.743] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0 [0157.743] SetEvent (hEvent=0x2fc) returned 1 [0157.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.744] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0157.744] CloseHandle (hObject=0x358) returned 1 [0157.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0157.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0157.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0157.746] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0157.986] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0157.987] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0157.987] CloseHandle (hObject=0x358) returned 1 [0157.987] CloseHandle (hObject=0x370) returned 1 [0157.988] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0 [0157.988] SetEvent (hEvent=0x2fc) returned 1 [0157.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0157.989] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0157.989] CloseHandle (hObject=0x370) returned 1 [0157.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0157.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0157.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0157.990] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.990] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0157.991] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0157.992] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0157.993] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0157.993] CloseHandle (hObject=0x370) returned 1 [0157.993] CloseHandle (hObject=0x358) returned 1 [0157.993] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0 [0157.994] SetEvent (hEvent=0x2fc) returned 1 [0157.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.995] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=253712) returned 1 [0157.995] CloseHandle (hObject=0x358) returned 1 [0157.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0157.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0157.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.995] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.995] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0157.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0157.996] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3df10, lpOverlapped=0x0) returned 1 [0158.116] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3df20, lpOverlapped=0x0) returned 1 [0158.121] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0158.122] CloseHandle (hObject=0x358) returned 1 [0158.122] CloseHandle (hObject=0x370) returned 1 [0158.122] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0 [0158.123] SetEvent (hEvent=0x2fc) returned 1 [0158.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.126] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0158.126] CloseHandle (hObject=0x370) returned 1 [0158.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0158.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0158.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0158.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0158.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0158.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0158.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0158.127] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0159.587] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0159.588] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0159.588] CloseHandle (hObject=0x370) returned 1 [0159.588] CloseHandle (hObject=0x358) returned 1 [0159.589] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0 [0159.589] SetEvent (hEvent=0x2fc) returned 1 [0159.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0159.591] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19451) returned 1 [0159.591] CloseHandle (hObject=0x358) returned 1 [0159.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0159.592] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.592] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0159.594] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4bfb, lpOverlapped=0x0) returned 1 [0159.598] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4c00, lpOverlapped=0x0) returned 1 [0159.599] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0159.600] CloseHandle (hObject=0x358) returned 1 [0159.600] CloseHandle (hObject=0x344) returned 1 [0159.600] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0 [0159.600] SetEvent (hEvent=0x2fc) returned 1 [0159.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.605] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=763363) returned 1 [0159.605] CloseHandle (hObject=0x360) returned 1 [0159.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0159.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0159.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.606] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.606] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0159.620] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xba5e3, lpOverlapped=0x0) returned 1 [0159.645] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xba5f0, lpOverlapped=0x0) returned 1 [0159.909] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0159.909] CloseHandle (hObject=0x360) returned 1 [0159.910] CloseHandle (hObject=0x344) returned 1 [0159.910] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0 [0159.910] SetEvent (hEvent=0x2fc) returned 1 [0159.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0159.911] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2147) returned 1 [0159.911] CloseHandle (hObject=0x344) returned 1 [0159.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0159.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0159.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0159.912] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.912] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0159.913] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x863, lpOverlapped=0x0) returned 1 [0159.952] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x870, lpOverlapped=0x0) returned 1 [0159.954] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0159.954] CloseHandle (hObject=0x344) returned 1 [0159.954] CloseHandle (hObject=0x360) returned 1 [0159.954] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0 [0159.955] SetEvent (hEvent=0x2fc) returned 1 [0159.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.962] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=215883) returned 1 [0159.962] CloseHandle (hObject=0x338) returned 1 [0159.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0159.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0159.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.963] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.963] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0159.964] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x34b4b, lpOverlapped=0x0) returned 1 [0159.972] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x34b50, lpOverlapped=0x0) returned 1 [0159.977] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0159.977] CloseHandle (hObject=0x338) returned 1 [0159.977] CloseHandle (hObject=0x368) returned 1 [0159.977] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0 [0159.977] SetEvent (hEvent=0x2fc) returned 1 [0159.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.980] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0159.980] CloseHandle (hObject=0x368) returned 1 [0159.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.981] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.981] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0159.981] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0159.984] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0159.985] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0159.985] CloseHandle (hObject=0x368) returned 1 [0159.985] CloseHandle (hObject=0x338) returned 1 [0159.986] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0 [0159.986] SetEvent (hEvent=0x2fc) returned 1 [0159.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.988] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0159.988] CloseHandle (hObject=0x368) returned 1 [0159.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0159.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0159.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.989] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.989] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0159.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0159.997] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.003] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.004] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.004] CloseHandle (hObject=0x368) returned 1 [0160.004] CloseHandle (hObject=0x338) returned 1 [0160.005] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0 [0160.005] SetEvent (hEvent=0x2fc) returned 1 [0160.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.005] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=343329) returned 1 [0160.006] CloseHandle (hObject=0x338) returned 1 [0160.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.006] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.006] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0160.009] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x53d21, lpOverlapped=0x0) returned 1 [0160.226] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x53d30, lpOverlapped=0x0) returned 1 [0160.259] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.259] CloseHandle (hObject=0x338) returned 1 [0160.259] CloseHandle (hObject=0x368) returned 1 [0160.260] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0 [0160.260] SetEvent (hEvent=0x2fc) returned 1 [0160.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.261] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=65002) returned 1 [0160.261] CloseHandle (hObject=0x368) returned 1 [0160.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.262] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.262] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0160.262] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfdea, lpOverlapped=0x0) returned 1 [0160.269] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfdf0, lpOverlapped=0x0) returned 1 [0160.271] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.271] CloseHandle (hObject=0x368) returned 1 [0160.271] CloseHandle (hObject=0x338) returned 1 [0160.272] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0 [0160.272] SetEvent (hEvent=0x2fc) returned 1 [0160.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.272] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.272] CloseHandle (hObject=0x338) returned 1 [0160.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.273] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.273] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0160.275] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.278] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.279] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.279] CloseHandle (hObject=0x338) returned 1 [0160.279] CloseHandle (hObject=0x368) returned 1 [0160.280] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0 [0160.280] SetEvent (hEvent=0x2fc) returned 1 [0160.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.282] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.282] CloseHandle (hObject=0x338) returned 1 [0160.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0160.283] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.283] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0160.284] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.285] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.286] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.286] CloseHandle (hObject=0x338) returned 1 [0160.287] CloseHandle (hObject=0x37c) returned 1 [0160.287] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0 [0160.287] SetEvent (hEvent=0x2fc) returned 1 [0160.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.288] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9216) returned 1 [0160.288] CloseHandle (hObject=0x37c) returned 1 [0160.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0160.547] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2400, lpOverlapped=0x0) returned 1 [0160.571] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2410, lpOverlapped=0x0) returned 1 [0160.572] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.572] CloseHandle (hObject=0x37c) returned 1 [0160.573] CloseHandle (hObject=0x384) returned 1 [0160.573] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0 [0160.573] SetEvent (hEvent=0x2fc) returned 1 [0160.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.574] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.574] CloseHandle (hObject=0x384) returned 1 [0160.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0160.574] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.575] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0160.575] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.587] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.588] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.588] CloseHandle (hObject=0x384) returned 1 [0160.588] CloseHandle (hObject=0x37c) returned 1 [0160.588] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0 [0160.588] SetEvent (hEvent=0x2fc) returned 1 [0160.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.589] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.589] CloseHandle (hObject=0x37c) returned 1 [0160.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.590] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.590] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0160.590] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.608] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.609] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.609] CloseHandle (hObject=0x37c) returned 1 [0160.609] CloseHandle (hObject=0x384) returned 1 [0160.612] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0 [0160.612] SetEvent (hEvent=0x2fc) returned 1 [0160.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0160.830] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.830] CloseHandle (hObject=0x380) returned 1 [0160.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0160.831] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.831] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0160.842] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.844] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.845] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.845] CloseHandle (hObject=0x380) returned 1 [0160.845] CloseHandle (hObject=0x370) returned 1 [0160.846] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0 [0160.846] SetEvent (hEvent=0x2fc) returned 1 [0160.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.847] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.847] CloseHandle (hObject=0x370) returned 1 [0160.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.847] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.848] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0160.848] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.863] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.864] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.864] CloseHandle (hObject=0x370) returned 1 [0160.865] CloseHandle (hObject=0x380) returned 1 [0160.865] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0 [0160.865] SetEvent (hEvent=0x2fc) returned 1 [0160.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0160.866] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1261) returned 1 [0160.866] CloseHandle (hObject=0x380) returned 1 [0160.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0160.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0160.866] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.867] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0160.870] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ed, lpOverlapped=0x0) returned 1 [0160.872] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f0, lpOverlapped=0x0) returned 1 [0160.873] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0160.873] CloseHandle (hObject=0x380) returned 1 [0160.873] CloseHandle (hObject=0x388) returned 1 [0160.874] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0 [0160.874] SetEvent (hEvent=0x2fc) returned 1 [0160.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0160.875] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=527958) returned 1 [0160.875] CloseHandle (hObject=0x388) returned 1 [0160.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0160.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0160.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0160.875] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.875] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0160.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0160.876] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x80e56, lpOverlapped=0x0) returned 1 [0160.893] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x80e60, lpOverlapped=0x0) returned 1 [0161.158] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x142, lpOverlapped=0x0) returned 1 [0161.158] CloseHandle (hObject=0x388) returned 1 [0161.158] CloseHandle (hObject=0x380) returned 1 [0161.159] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0 [0161.159] SetEvent (hEvent=0x2fc) returned 1 [0161.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.355] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18624) returned 1 [0161.355] CloseHandle (hObject=0x37c) returned 1 [0161.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0161.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0161.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.355] SetEvent (hEvent=0x2fc) returned 1 [0161.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.356] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21184) returned 1 [0161.356] CloseHandle (hObject=0x37c) returned 1 [0161.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0161.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0161.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.358] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0161.358] CloseHandle (hObject=0x37c) returned 1 [0161.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0161.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0161.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.359] SetEvent (hEvent=0x2fc) returned 1 [0161.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.359] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0161.359] CloseHandle (hObject=0x37c) returned 1 [0161.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0161.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0161.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.361] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18624) returned 1 [0161.361] CloseHandle (hObject=0x37c) returned 1 [0161.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0161.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0161.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.361] SetEvent (hEvent=0x2fc) returned 1 [0161.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.362] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11616) returned 1 [0161.362] CloseHandle (hObject=0x37c) returned 1 [0161.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0161.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0161.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.363] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19648) returned 1 [0161.363] CloseHandle (hObject=0x37c) returned 1 [0161.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0161.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0161.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.364] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22720) returned 1 [0161.364] CloseHandle (hObject=0x37c) returned 1 [0161.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0161.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0161.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.365] SetEvent (hEvent=0x2fc) returned 1 [0161.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.366] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0161.366] CloseHandle (hObject=0x37c) returned 1 [0161.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0161.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0161.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.366] SetEvent (hEvent=0x2fc) returned 1 [0161.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.367] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20672) returned 1 [0161.367] CloseHandle (hObject=0x37c) returned 1 [0161.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0161.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0161.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.368] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19648) returned 1 [0161.368] CloseHandle (hObject=0x37c) returned 1 [0161.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0161.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0161.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.369] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0161.369] CloseHandle (hObject=0x37c) returned 1 [0161.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0161.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0161.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.370] SetEvent (hEvent=0x2fc) returned 1 [0161.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.371] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27840) returned 1 [0161.371] CloseHandle (hObject=0x37c) returned 1 [0161.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0161.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0161.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.371] SetEvent (hEvent=0x2fc) returned 1 [0161.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.372] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26816) returned 1 [0161.372] CloseHandle (hObject=0x37c) returned 1 [0161.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0161.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0161.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.373] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=70848) returned 1 [0161.373] CloseHandle (hObject=0x37c) returned 1 [0161.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0161.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0161.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.374] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19648) returned 1 [0161.374] CloseHandle (hObject=0x37c) returned 1 [0161.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0161.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0161.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.375] SetEvent (hEvent=0x2fc) returned 1 [0161.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.376] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23232) returned 1 [0161.376] CloseHandle (hObject=0x37c) returned 1 [0161.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0161.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0161.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.377] SetEvent (hEvent=0x2fc) returned 1 [0161.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.377] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24768) returned 1 [0161.377] CloseHandle (hObject=0x37c) returned 1 [0161.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0161.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0161.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.378] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24768) returned 1 [0161.378] CloseHandle (hObject=0x37c) returned 1 [0161.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0161.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0161.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.380] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21184) returned 1 [0161.380] CloseHandle (hObject=0x37c) returned 1 [0161.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0161.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0161.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.381] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19136) returned 1 [0161.381] CloseHandle (hObject=0x37c) returned 1 [0161.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0161.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0161.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.382] SetEvent (hEvent=0x2fc) returned 1 [0161.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.382] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=215768) returned 1 [0161.382] CloseHandle (hObject=0x37c) returned 1 [0161.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 0x220 [0161.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 0x220 [0161.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.383] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=255192) returned 1 [0161.383] CloseHandle (hObject=0x37c) returned 1 [0161.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 0x220 [0161.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 0x220 [0161.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.384] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=396960) returned 1 [0161.384] CloseHandle (hObject=0x37c) returned 1 [0161.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll")) returned 0x420 [0161.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll")) returned 0x420 [0161.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.386] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=473760) returned 1 [0161.386] CloseHandle (hObject=0x37c) returned 1 [0161.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0161.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0161.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.387] SetEvent (hEvent=0x2fc) returned 1 [0161.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.387] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1761448) returned 1 [0161.387] CloseHandle (hObject=0x37c) returned 1 [0161.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll")) returned 0x420 [0161.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0161.388] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll")) returned 0 [0161.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0161.388] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2285736) returned 1 [0161.388] CloseHandle (hObject=0x37c) returned 1 [0161.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0x420 [0161.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0161.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0 [0161.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.703] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=431664) returned 1 [0161.703] CloseHandle (hObject=0x380) returned 1 [0161.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 0x220 [0161.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 0x220 [0161.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0161.901] SetEvent (hEvent=0x2fc) returned 1 [0161.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.902] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3251) returned 1 [0161.902] CloseHandle (hObject=0x380) returned 1 [0161.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0161.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0161.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.903] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.903] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0161.904] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcb3, lpOverlapped=0x0) returned 1 [0161.905] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcc0, lpOverlapped=0x0) returned 1 [0161.906] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0161.906] CloseHandle (hObject=0x380) returned 1 [0161.907] CloseHandle (hObject=0x390) returned 1 [0161.907] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0 [0161.907] SetEvent (hEvent=0x2fc) returned 1 [0161.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.908] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8097) returned 1 [0161.908] CloseHandle (hObject=0x390) returned 1 [0161.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0161.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0161.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.908] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.908] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0161.909] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1fa1, lpOverlapped=0x0) returned 1 [0161.911] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1fb0, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0161.912] CloseHandle (hObject=0x390) returned 1 [0161.912] CloseHandle (hObject=0x380) returned 1 [0161.912] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0 [0161.912] SetEvent (hEvent=0x2fc) returned 1 [0161.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.915] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7686) returned 1 [0161.915] CloseHandle (hObject=0x380) returned 1 [0161.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0161.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0161.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.916] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.916] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0161.917] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1e06, lpOverlapped=0x0) returned 1 [0161.919] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1e10, lpOverlapped=0x0) returned 1 [0161.920] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0161.920] CloseHandle (hObject=0x380) returned 1 [0161.920] CloseHandle (hObject=0x390) returned 1 [0161.920] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0 [0161.920] SetEvent (hEvent=0x2fc) returned 1 [0161.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.923] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11891) returned 1 [0161.923] CloseHandle (hObject=0x390) returned 1 [0161.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0161.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0161.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.924] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.924] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0161.925] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2e73, lpOverlapped=0x0) returned 1 [0161.926] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2e80, lpOverlapped=0x0) returned 1 [0161.927] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0161.928] CloseHandle (hObject=0x390) returned 1 [0161.928] CloseHandle (hObject=0x380) returned 1 [0161.928] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0 [0161.928] SetEvent (hEvent=0x2fc) returned 1 [0161.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.930] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=517) returned 1 [0161.930] CloseHandle (hObject=0x380) returned 1 [0161.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0161.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0161.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0161.931] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.931] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0161.932] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x205, lpOverlapped=0x0) returned 1 [0161.933] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x210, lpOverlapped=0x0) returned 1 [0161.933] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0161.934] CloseHandle (hObject=0x380) returned 1 [0161.934] CloseHandle (hObject=0x390) returned 1 [0161.934] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0 [0161.934] SetEvent (hEvent=0x2fc) returned 1 [0161.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.935] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=502) returned 1 [0161.935] CloseHandle (hObject=0x390) returned 1 [0161.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0161.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0161.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0161.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.936] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.936] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0161.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0161.936] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f6, lpOverlapped=0x0) returned 1 [0162.145] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x200, lpOverlapped=0x0) returned 1 [0162.162] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.162] CloseHandle (hObject=0x390) returned 1 [0162.162] CloseHandle (hObject=0x380) returned 1 [0162.163] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0 [0162.168] SetEvent (hEvent=0x2fc) returned 1 [0162.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.180] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5253) returned 1 [0162.180] CloseHandle (hObject=0x38c) returned 1 [0162.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0162.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0162.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.181] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.181] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.249] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1485, lpOverlapped=0x0) returned 1 [0162.251] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1490, lpOverlapped=0x0) returned 1 [0162.252] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.252] CloseHandle (hObject=0x38c) returned 1 [0162.252] CloseHandle (hObject=0x394) returned 1 [0162.252] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0 [0162.253] SetEvent (hEvent=0x2fc) returned 1 [0162.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.253] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10607) returned 1 [0162.253] CloseHandle (hObject=0x394) returned 1 [0162.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0162.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0162.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.254] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.254] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0162.254] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x296f, lpOverlapped=0x0) returned 1 [0162.256] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2970, lpOverlapped=0x0) returned 1 [0162.257] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.257] CloseHandle (hObject=0x394) returned 1 [0162.257] CloseHandle (hObject=0x38c) returned 1 [0162.258] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0 [0162.258] SetEvent (hEvent=0x2fc) returned 1 [0162.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.259] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15308) returned 1 [0162.259] CloseHandle (hObject=0x38c) returned 1 [0162.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0162.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0162.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0162.259] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.260] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.260] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3bcc, lpOverlapped=0x0) returned 1 [0162.262] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3bd0, lpOverlapped=0x0) returned 1 [0162.263] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.263] CloseHandle (hObject=0x38c) returned 1 [0162.263] CloseHandle (hObject=0x394) returned 1 [0162.264] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0 [0162.264] SetEvent (hEvent=0x2fc) returned 1 [0162.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.265] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5315) returned 1 [0162.265] CloseHandle (hObject=0x380) returned 1 [0162.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0162.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0162.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.265] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.265] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.266] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x14c3, lpOverlapped=0x0) returned 1 [0162.268] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x14d0, lpOverlapped=0x0) returned 1 [0162.269] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.269] CloseHandle (hObject=0x380) returned 1 [0162.269] CloseHandle (hObject=0x394) returned 1 [0162.269] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0 [0162.271] SetEvent (hEvent=0x2fc) returned 1 [0162.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.272] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4955) returned 1 [0162.272] CloseHandle (hObject=0x394) returned 1 [0162.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0162.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0162.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.273] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.273] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.274] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x135b, lpOverlapped=0x0) returned 1 [0162.276] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1360, lpOverlapped=0x0) returned 1 [0162.277] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.277] CloseHandle (hObject=0x394) returned 1 [0162.277] CloseHandle (hObject=0x380) returned 1 [0162.277] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0 [0162.278] SetEvent (hEvent=0x2fc) returned 1 [0162.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.278] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5030) returned 1 [0162.278] CloseHandle (hObject=0x380) returned 1 [0162.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0162.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0162.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.281] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.281] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.282] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x13a6, lpOverlapped=0x0) returned 1 [0162.468] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13b0, lpOverlapped=0x0) returned 1 [0162.484] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.489] CloseHandle (hObject=0x380) returned 1 [0162.490] CloseHandle (hObject=0x394) returned 1 [0162.490] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0 [0162.490] SetEvent (hEvent=0x2fc) returned 1 [0162.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.491] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5016) returned 1 [0162.491] CloseHandle (hObject=0x394) returned 1 [0162.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0162.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0162.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.492] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.492] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.492] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1398, lpOverlapped=0x0) returned 1 [0162.494] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13a0, lpOverlapped=0x0) returned 1 [0162.495] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.495] CloseHandle (hObject=0x394) returned 1 [0162.495] CloseHandle (hObject=0x380) returned 1 [0162.495] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0 [0162.495] SetEvent (hEvent=0x2fc) returned 1 [0162.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.496] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4390) returned 1 [0162.496] CloseHandle (hObject=0x380) returned 1 [0162.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0162.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0162.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.497] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.497] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.497] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1126, lpOverlapped=0x0) returned 1 [0162.499] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1130, lpOverlapped=0x0) returned 1 [0162.500] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.500] CloseHandle (hObject=0x380) returned 1 [0162.500] CloseHandle (hObject=0x394) returned 1 [0162.500] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0 [0162.500] SetEvent (hEvent=0x2fc) returned 1 [0162.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.501] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3966) returned 1 [0162.501] CloseHandle (hObject=0x394) returned 1 [0162.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0162.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0162.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.502] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.502] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.503] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf7e, lpOverlapped=0x0) returned 1 [0162.505] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf80, lpOverlapped=0x0) returned 1 [0162.506] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.506] CloseHandle (hObject=0x394) returned 1 [0162.506] CloseHandle (hObject=0x380) returned 1 [0162.506] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0 [0162.506] SetEvent (hEvent=0x2fc) returned 1 [0162.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.507] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3378) returned 1 [0162.507] CloseHandle (hObject=0x380) returned 1 [0162.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0162.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0162.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.508] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.508] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.509] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd32, lpOverlapped=0x0) returned 1 [0162.510] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd40, lpOverlapped=0x0) returned 1 [0162.511] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.511] CloseHandle (hObject=0x380) returned 1 [0162.511] CloseHandle (hObject=0x394) returned 1 [0162.512] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0 [0162.512] SetEvent (hEvent=0x2fc) returned 1 [0162.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.513] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3120) returned 1 [0162.513] CloseHandle (hObject=0x394) returned 1 [0162.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0162.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0162.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.514] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.514] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.515] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc30, lpOverlapped=0x0) returned 1 [0162.516] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc40, lpOverlapped=0x0) returned 1 [0162.517] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.517] CloseHandle (hObject=0x394) returned 1 [0162.517] CloseHandle (hObject=0x380) returned 1 [0162.518] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0 [0162.518] SetEvent (hEvent=0x2fc) returned 1 [0162.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.518] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3026) returned 1 [0162.518] CloseHandle (hObject=0x380) returned 1 [0162.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0162.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0162.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0162.519] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.519] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0162.520] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbd2, lpOverlapped=0x0) returned 1 [0162.521] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbe0, lpOverlapped=0x0) returned 1 [0162.522] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.522] CloseHandle (hObject=0x380) returned 1 [0162.522] CloseHandle (hObject=0x394) returned 1 [0162.522] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0 [0162.523] SetEvent (hEvent=0x2fc) returned 1 [0162.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.523] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4734) returned 1 [0162.523] CloseHandle (hObject=0x394) returned 1 [0162.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0162.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0162.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.524] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.524] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0162.524] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x127e, lpOverlapped=0x0) returned 1 [0162.741] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1280, lpOverlapped=0x0) returned 1 [0162.742] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.742] CloseHandle (hObject=0x394) returned 1 [0162.742] CloseHandle (hObject=0x380) returned 1 [0162.743] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0 [0162.743] SetEvent (hEvent=0x2fc) returned 1 [0162.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.953] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10832) returned 1 [0162.953] CloseHandle (hObject=0x37c) returned 1 [0162.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0162.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0162.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.953] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.954] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0162.954] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a50, lpOverlapped=0x0) returned 1 [0162.956] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a60, lpOverlapped=0x0) returned 1 [0162.957] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.957] CloseHandle (hObject=0x37c) returned 1 [0162.957] CloseHandle (hObject=0x388) returned 1 [0162.957] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0 [0162.958] SetEvent (hEvent=0x2fc) returned 1 [0162.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.958] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7968) returned 1 [0162.958] CloseHandle (hObject=0x388) returned 1 [0162.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0162.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0162.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.959] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.959] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0162.960] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f20, lpOverlapped=0x0) returned 1 [0162.961] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f30, lpOverlapped=0x0) returned 1 [0162.962] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.962] CloseHandle (hObject=0x388) returned 1 [0162.965] CloseHandle (hObject=0x37c) returned 1 [0162.965] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0 [0162.965] SetEvent (hEvent=0x2fc) returned 1 [0162.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.966] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1832) returned 1 [0162.966] CloseHandle (hObject=0x37c) returned 1 [0162.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0162.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0162.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.967] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.967] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0162.971] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x728, lpOverlapped=0x0) returned 1 [0162.973] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x730, lpOverlapped=0x0) returned 1 [0162.974] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.974] CloseHandle (hObject=0x37c) returned 1 [0162.974] CloseHandle (hObject=0x388) returned 1 [0162.974] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0 [0162.975] SetEvent (hEvent=0x2fc) returned 1 [0162.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.976] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26332) returned 1 [0162.976] CloseHandle (hObject=0x388) returned 1 [0162.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0162.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0162.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.976] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.976] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0162.977] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x66dc, lpOverlapped=0x0) returned 1 [0162.979] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x66e0, lpOverlapped=0x0) returned 1 [0162.980] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.980] CloseHandle (hObject=0x388) returned 1 [0162.981] CloseHandle (hObject=0x37c) returned 1 [0162.981] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0 [0162.981] SetEvent (hEvent=0x2fc) returned 1 [0162.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.981] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27858) returned 1 [0162.982] CloseHandle (hObject=0x37c) returned 1 [0162.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0162.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0162.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.982] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.982] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0162.983] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6cd2, lpOverlapped=0x0) returned 1 [0162.985] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6ce0, lpOverlapped=0x0) returned 1 [0162.986] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0162.986] CloseHandle (hObject=0x37c) returned 1 [0162.986] CloseHandle (hObject=0x388) returned 1 [0162.986] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0 [0162.987] SetEvent (hEvent=0x2fc) returned 1 [0162.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.987] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3746) returned 1 [0162.987] CloseHandle (hObject=0x388) returned 1 [0162.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0162.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0162.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0162.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.988] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.988] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0162.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0162.988] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xea2, lpOverlapped=0x0) returned 1 [0163.184] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xeb0, lpOverlapped=0x0) returned 1 [0163.185] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0163.186] CloseHandle (hObject=0x388) returned 1 [0163.186] CloseHandle (hObject=0x37c) returned 1 [0163.356] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0 [0163.356] SetEvent (hEvent=0x2fc) returned 1 [0163.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.357] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7372) returned 1 [0163.357] CloseHandle (hObject=0x388) returned 1 [0163.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0163.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0163.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0163.369] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.369] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0163.739] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1ccc, lpOverlapped=0x0) returned 1 [0163.745] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1cd0, lpOverlapped=0x0) returned 1 [0163.746] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0163.746] CloseHandle (hObject=0x388) returned 1 [0163.746] CloseHandle (hObject=0x398) returned 1 [0163.747] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0 [0163.747] SetEvent (hEvent=0x2fc) returned 1 [0163.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0163.750] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2344) returned 1 [0163.750] CloseHandle (hObject=0x38c) returned 1 [0163.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0163.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0163.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0163.750] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.750] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0163.751] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x928, lpOverlapped=0x0) returned 1 [0163.768] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x930, lpOverlapped=0x0) returned 1 [0163.769] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0163.769] CloseHandle (hObject=0x38c) returned 1 [0163.769] CloseHandle (hObject=0x384) returned 1 [0163.770] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0 [0163.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0163.771] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3416) returned 1 [0163.771] CloseHandle (hObject=0x384) returned 1 [0163.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0163.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0163.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0163.771] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.771] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0163.773] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd58, lpOverlapped=0x0) returned 1 [0163.783] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd60, lpOverlapped=0x0) returned 1 [0163.784] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0163.784] CloseHandle (hObject=0x384) returned 1 [0163.784] CloseHandle (hObject=0x38c) returned 1 [0163.785] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0 [0163.785] SetEvent (hEvent=0x2fc) returned 1 [0163.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0163.786] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6636) returned 1 [0163.786] CloseHandle (hObject=0x38c) returned 1 [0163.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0163.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0163.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0163.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0163.786] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.786] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0163.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0163.787] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x19ec, lpOverlapped=0x0) returned 1 [0164.033] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x19f0, lpOverlapped=0x0) returned 1 [0164.034] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.034] CloseHandle (hObject=0x38c) returned 1 [0164.035] CloseHandle (hObject=0x384) returned 1 [0164.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0 [0164.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.040] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3144) returned 1 [0164.040] CloseHandle (hObject=0x380) returned 1 [0164.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0164.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0164.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.041] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.041] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.042] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc48, lpOverlapped=0x0) returned 1 [0164.045] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc50, lpOverlapped=0x0) returned 1 [0164.046] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.046] CloseHandle (hObject=0x380) returned 1 [0164.046] CloseHandle (hObject=0x39c) returned 1 [0164.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0 [0164.047] SetEvent (hEvent=0x2fc) returned 1 [0164.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.047] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8492) returned 1 [0164.047] CloseHandle (hObject=0x39c) returned 1 [0164.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0164.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0164.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.048] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.048] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.049] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x212c, lpOverlapped=0x0) returned 1 [0164.051] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2130, lpOverlapped=0x0) returned 1 [0164.052] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.052] CloseHandle (hObject=0x39c) returned 1 [0164.052] CloseHandle (hObject=0x380) returned 1 [0164.052] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0 [0164.052] SetEvent (hEvent=0x2fc) returned 1 [0164.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.053] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7804) returned 1 [0164.053] CloseHandle (hObject=0x380) returned 1 [0164.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0164.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0164.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.054] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.054] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.055] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1e7c, lpOverlapped=0x0) returned 1 [0164.060] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1e80, lpOverlapped=0x0) returned 1 [0164.061] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.061] CloseHandle (hObject=0x380) returned 1 [0164.061] CloseHandle (hObject=0x39c) returned 1 [0164.062] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0 [0164.062] SetEvent (hEvent=0x2fc) returned 1 [0164.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.062] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7804) returned 1 [0164.063] CloseHandle (hObject=0x39c) returned 1 [0164.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0164.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0164.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.063] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.063] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.064] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1e7c, lpOverlapped=0x0) returned 1 [0164.067] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1e80, lpOverlapped=0x0) returned 1 [0164.068] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.068] CloseHandle (hObject=0x39c) returned 1 [0164.069] CloseHandle (hObject=0x380) returned 1 [0164.069] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0 [0164.069] SetEvent (hEvent=0x2fc) returned 1 [0164.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.070] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2016) returned 1 [0164.070] CloseHandle (hObject=0x380) returned 1 [0164.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0164.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0164.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.070] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.070] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.072] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7e0, lpOverlapped=0x0) returned 1 [0164.084] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7f0, lpOverlapped=0x0) returned 1 [0164.085] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.085] CloseHandle (hObject=0x380) returned 1 [0164.086] CloseHandle (hObject=0x39c) returned 1 [0164.086] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0 [0164.086] SetEvent (hEvent=0x2fc) returned 1 [0164.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.087] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2492) returned 1 [0164.087] CloseHandle (hObject=0x39c) returned 1 [0164.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0164.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0164.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.087] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.088] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.088] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9bc, lpOverlapped=0x0) returned 1 [0164.091] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9c0, lpOverlapped=0x0) returned 1 [0164.092] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.092] CloseHandle (hObject=0x39c) returned 1 [0164.092] CloseHandle (hObject=0x380) returned 1 [0164.093] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0 [0164.094] SetEvent (hEvent=0x2fc) returned 1 [0164.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.094] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3348) returned 1 [0164.094] CloseHandle (hObject=0x380) returned 1 [0164.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0164.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0164.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.095] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.095] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.096] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd14, lpOverlapped=0x0) returned 1 [0164.147] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd20, lpOverlapped=0x0) returned 1 [0164.148] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.148] CloseHandle (hObject=0x380) returned 1 [0164.149] CloseHandle (hObject=0x39c) returned 1 [0164.149] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0 [0164.149] SetEvent (hEvent=0x2fc) returned 1 [0164.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.150] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4296) returned 1 [0164.150] CloseHandle (hObject=0x39c) returned 1 [0164.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0164.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0164.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.151] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.151] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.152] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x10c8, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x10d0, lpOverlapped=0x0) returned 1 [0164.166] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.166] CloseHandle (hObject=0x39c) returned 1 [0164.166] CloseHandle (hObject=0x380) returned 1 [0164.167] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0 [0164.167] SetEvent (hEvent=0x2fc) returned 1 [0164.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.168] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3228) returned 1 [0164.168] CloseHandle (hObject=0x380) returned 1 [0164.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0164.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0164.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.168] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.169] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.172] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc9c, lpOverlapped=0x0) returned 1 [0164.180] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xca0, lpOverlapped=0x0) returned 1 [0164.181] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.181] CloseHandle (hObject=0x380) returned 1 [0164.182] CloseHandle (hObject=0x39c) returned 1 [0164.182] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0 [0164.183] SetEvent (hEvent=0x2fc) returned 1 [0164.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.184] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4808) returned 1 [0164.184] CloseHandle (hObject=0x39c) returned 1 [0164.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0164.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0164.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.185] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.185] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.186] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x12c8, lpOverlapped=0x0) returned 1 [0164.197] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x12d0, lpOverlapped=0x0) returned 1 [0164.198] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.198] CloseHandle (hObject=0x39c) returned 1 [0164.198] CloseHandle (hObject=0x380) returned 1 [0164.199] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0 [0164.199] SetEvent (hEvent=0x2fc) returned 1 [0164.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.202] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4996) returned 1 [0164.202] CloseHandle (hObject=0x380) returned 1 [0164.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0164.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0164.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.203] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.203] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.204] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1384, lpOverlapped=0x0) returned 1 [0164.209] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1390, lpOverlapped=0x0) returned 1 [0164.210] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.210] CloseHandle (hObject=0x380) returned 1 [0164.210] CloseHandle (hObject=0x39c) returned 1 [0164.210] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0 [0164.211] SetEvent (hEvent=0x2fc) returned 1 [0164.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.211] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5004) returned 1 [0164.211] CloseHandle (hObject=0x39c) returned 1 [0164.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0164.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0164.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.212] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.212] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.213] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x138c, lpOverlapped=0x0) returned 1 [0164.254] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1390, lpOverlapped=0x0) returned 1 [0164.255] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.255] CloseHandle (hObject=0x39c) returned 1 [0164.255] CloseHandle (hObject=0x380) returned 1 [0164.256] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0 [0164.256] SetEvent (hEvent=0x2fc) returned 1 [0164.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.334] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7384) returned 1 [0164.334] CloseHandle (hObject=0x380) returned 1 [0164.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0164.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0164.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.335] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.335] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0164.336] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1cd8, lpOverlapped=0x0) returned 1 [0164.343] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ce0, lpOverlapped=0x0) returned 1 [0164.344] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.345] CloseHandle (hObject=0x380) returned 1 [0164.345] CloseHandle (hObject=0x39c) returned 1 [0164.345] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0 [0164.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.512] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26886) returned 1 [0164.512] CloseHandle (hObject=0x398) returned 1 [0164.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0164.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0164.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0164.513] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.513] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0164.514] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6906, lpOverlapped=0x0) returned 1 [0164.522] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6910, lpOverlapped=0x0) returned 1 [0164.524] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.524] CloseHandle (hObject=0x398) returned 1 [0164.524] CloseHandle (hObject=0x388) returned 1 [0164.524] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0 [0164.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.525] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22516) returned 1 [0164.525] CloseHandle (hObject=0x388) returned 1 [0164.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0164.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0164.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0164.526] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.526] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0164.527] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x57f4, lpOverlapped=0x0) returned 1 [0164.535] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5800, lpOverlapped=0x0) returned 1 [0164.536] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.536] CloseHandle (hObject=0x388) returned 1 [0164.536] CloseHandle (hObject=0x398) returned 1 [0164.537] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0 [0164.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.543] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17236) returned 1 [0164.543] CloseHandle (hObject=0x384) returned 1 [0164.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0164.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0164.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.544] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.544] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.545] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4354, lpOverlapped=0x0) returned 1 [0164.553] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4360, lpOverlapped=0x0) returned 1 [0164.555] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.555] CloseHandle (hObject=0x384) returned 1 [0164.555] CloseHandle (hObject=0x380) returned 1 [0164.555] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0 [0164.556] SetEvent (hEvent=0x2fc) returned 1 [0164.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.560] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16676) returned 1 [0164.560] CloseHandle (hObject=0x380) returned 1 [0164.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0164.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0164.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.561] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.561] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0164.562] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4124, lpOverlapped=0x0) returned 1 [0164.564] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4130, lpOverlapped=0x0) returned 1 [0164.746] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.746] CloseHandle (hObject=0x380) returned 1 [0164.746] CloseHandle (hObject=0x384) returned 1 [0164.747] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0 [0164.863] SetEvent (hEvent=0x2fc) returned 1 [0164.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.864] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24320) returned 1 [0164.864] CloseHandle (hObject=0x384) returned 1 [0164.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0164.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0164.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.865] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.865] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.866] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5f00, lpOverlapped=0x0) returned 1 [0164.868] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5f10, lpOverlapped=0x0) returned 1 [0164.869] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.869] CloseHandle (hObject=0x384) returned 1 [0164.870] CloseHandle (hObject=0x380) returned 1 [0164.870] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0 [0164.870] SetEvent (hEvent=0x2fc) returned 1 [0164.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.871] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24778) returned 1 [0164.871] CloseHandle (hObject=0x380) returned 1 [0164.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0164.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0164.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.872] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.872] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0164.873] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x60ca, lpOverlapped=0x0) returned 1 [0164.875] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x60d0, lpOverlapped=0x0) returned 1 [0164.877] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.877] CloseHandle (hObject=0x380) returned 1 [0164.877] CloseHandle (hObject=0x384) returned 1 [0164.877] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0 [0164.878] SetEvent (hEvent=0x2fc) returned 1 [0164.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.878] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=47996) returned 1 [0164.879] CloseHandle (hObject=0x384) returned 1 [0164.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0164.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0164.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.879] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.880] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.880] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbb7c, lpOverlapped=0x0) returned 1 [0164.883] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbb80, lpOverlapped=0x0) returned 1 [0164.885] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.885] CloseHandle (hObject=0x384) returned 1 [0164.885] CloseHandle (hObject=0x380) returned 1 [0164.885] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0 [0164.885] SetEvent (hEvent=0x2fc) returned 1 [0164.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.886] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=40206) returned 1 [0164.886] CloseHandle (hObject=0x380) returned 1 [0164.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0164.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0164.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0164.887] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.887] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0164.888] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9d0e, lpOverlapped=0x0) returned 1 [0164.890] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9d10, lpOverlapped=0x0) returned 1 [0164.891] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.892] CloseHandle (hObject=0x380) returned 1 [0164.892] CloseHandle (hObject=0x384) returned 1 [0164.892] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0 [0164.892] SetEvent (hEvent=0x2fc) returned 1 [0164.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.894] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=47786) returned 1 [0164.894] CloseHandle (hObject=0x384) returned 1 [0164.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0164.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0164.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0164.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0164.895] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.895] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0164.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0164.895] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbaaa, lpOverlapped=0x0) returned 1 [0164.898] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbab0, lpOverlapped=0x0) returned 1 [0164.899] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0164.900] CloseHandle (hObject=0x384) returned 1 [0164.900] CloseHandle (hObject=0x380) returned 1 [0164.900] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0 [0164.900] SetEvent (hEvent=0x2fc) returned 1 [0164.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.025] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14540) returned 1 [0165.025] CloseHandle (hObject=0x388) returned 1 [0165.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0165.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0165.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.179] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.179] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.180] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x38cc, lpOverlapped=0x0) returned 1 [0165.184] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x38d0, lpOverlapped=0x0) returned 1 [0165.185] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.185] CloseHandle (hObject=0x38c) returned 1 [0165.186] CloseHandle (hObject=0x388) returned 1 [0165.186] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0 [0165.186] SetEvent (hEvent=0x2fc) returned 1 [0165.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.187] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12982) returned 1 [0165.187] CloseHandle (hObject=0x388) returned 1 [0165.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0165.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0165.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.188] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.188] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.189] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x32b6, lpOverlapped=0x0) returned 1 [0165.193] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x32c0, lpOverlapped=0x0) returned 1 [0165.194] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.194] CloseHandle (hObject=0x388) returned 1 [0165.194] CloseHandle (hObject=0x38c) returned 1 [0165.194] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0 [0165.195] SetEvent (hEvent=0x2fc) returned 1 [0165.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.195] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9710) returned 1 [0165.195] CloseHandle (hObject=0x38c) returned 1 [0165.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0165.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0165.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.196] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.196] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.197] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x25ee, lpOverlapped=0x0) returned 1 [0165.198] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x25f0, lpOverlapped=0x0) returned 1 [0165.199] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.200] CloseHandle (hObject=0x38c) returned 1 [0165.200] CloseHandle (hObject=0x388) returned 1 [0165.200] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0 [0165.200] SetEvent (hEvent=0x2fc) returned 1 [0165.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.201] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8772) returned 1 [0165.201] CloseHandle (hObject=0x388) returned 1 [0165.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0165.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0165.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.203] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2244, lpOverlapped=0x0) returned 1 [0165.205] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2250, lpOverlapped=0x0) returned 1 [0165.206] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.207] CloseHandle (hObject=0x388) returned 1 [0165.207] CloseHandle (hObject=0x38c) returned 1 [0165.207] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0 [0165.207] SetEvent (hEvent=0x2fc) returned 1 [0165.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.208] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14486) returned 1 [0165.208] CloseHandle (hObject=0x38c) returned 1 [0165.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0165.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0165.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.209] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.209] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.491] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3896, lpOverlapped=0x0) returned 1 [0165.493] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x38a0, lpOverlapped=0x0) returned 1 [0165.494] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.494] CloseHandle (hObject=0x38c) returned 1 [0165.494] CloseHandle (hObject=0x388) returned 1 [0165.495] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0 [0165.495] SetEvent (hEvent=0x2fc) returned 1 [0165.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.496] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18304) returned 1 [0165.496] CloseHandle (hObject=0x388) returned 1 [0165.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0165.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0165.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.497] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.497] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.497] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4780, lpOverlapped=0x0) returned 1 [0165.499] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4790, lpOverlapped=0x0) returned 1 [0165.501] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.501] CloseHandle (hObject=0x388) returned 1 [0165.501] CloseHandle (hObject=0x38c) returned 1 [0165.501] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0 [0165.502] SetEvent (hEvent=0x2fc) returned 1 [0165.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.503] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11058) returned 1 [0165.503] CloseHandle (hObject=0x38c) returned 1 [0165.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0165.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0165.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.504] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.504] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2b32, lpOverlapped=0x0) returned 1 [0165.506] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2b40, lpOverlapped=0x0) returned 1 [0165.507] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.507] CloseHandle (hObject=0x38c) returned 1 [0165.507] CloseHandle (hObject=0x388) returned 1 [0165.507] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0 [0165.509] SetEvent (hEvent=0x2fc) returned 1 [0165.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.510] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9818) returned 1 [0165.510] CloseHandle (hObject=0x388) returned 1 [0165.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0165.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0165.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.511] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.511] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.511] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x265a, lpOverlapped=0x0) returned 1 [0165.513] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2660, lpOverlapped=0x0) returned 1 [0165.514] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.515] CloseHandle (hObject=0x388) returned 1 [0165.515] CloseHandle (hObject=0x38c) returned 1 [0165.515] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0 [0165.515] SetEvent (hEvent=0x2fc) returned 1 [0165.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.516] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7862) returned 1 [0165.516] CloseHandle (hObject=0x38c) returned 1 [0165.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0165.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0165.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.517] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.517] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.518] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1eb6, lpOverlapped=0x0) returned 1 [0165.520] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ec0, lpOverlapped=0x0) returned 1 [0165.521] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.521] CloseHandle (hObject=0x38c) returned 1 [0165.521] CloseHandle (hObject=0x388) returned 1 [0165.521] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0 [0165.522] SetEvent (hEvent=0x2fc) returned 1 [0165.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.522] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1012) returned 1 [0165.522] CloseHandle (hObject=0x388) returned 1 [0165.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0165.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0165.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.523] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.523] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0165.524] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3f4, lpOverlapped=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x400, lpOverlapped=0x0) returned 1 [0165.527] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.527] CloseHandle (hObject=0x388) returned 1 [0165.527] CloseHandle (hObject=0x38c) returned 1 [0165.528] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0 [0165.528] SetEvent (hEvent=0x2fc) returned 1 [0165.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0165.529] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=880) returned 1 [0165.529] CloseHandle (hObject=0x38c) returned 1 [0165.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0165.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0165.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.644] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.650] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0165.670] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x370, lpOverlapped=0x0) returned 1 [0165.682] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x380, lpOverlapped=0x0) returned 1 [0165.683] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.683] CloseHandle (hObject=0x388) returned 1 [0165.683] CloseHandle (hObject=0x398) returned 1 [0165.684] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0 [0165.684] SetEvent (hEvent=0x2fc) returned 1 [0165.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0165.684] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9304) returned 1 [0165.684] CloseHandle (hObject=0x398) returned 1 [0165.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0165.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0165.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0165.688] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.688] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.689] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2458, lpOverlapped=0x0) returned 1 [0165.691] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2460, lpOverlapped=0x0) returned 1 [0165.692] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.692] CloseHandle (hObject=0x398) returned 1 [0165.692] CloseHandle (hObject=0x388) returned 1 [0165.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0 [0165.693] SetEvent (hEvent=0x2fc) returned 1 [0165.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.694] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4024) returned 1 [0165.694] CloseHandle (hObject=0x388) returned 1 [0165.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0165.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0165.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.695] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.695] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0165.696] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfb8, lpOverlapped=0x0) returned 1 [0165.699] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfc0, lpOverlapped=0x0) returned 1 [0165.700] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.700] CloseHandle (hObject=0x388) returned 1 [0165.700] CloseHandle (hObject=0x398) returned 1 [0165.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0 [0165.701] SetEvent (hEvent=0x2fc) returned 1 [0165.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0165.702] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14444) returned 1 [0165.702] CloseHandle (hObject=0x398) returned 1 [0165.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0165.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0165.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0165.702] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.703] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.703] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x386c, lpOverlapped=0x0) returned 1 [0165.705] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3870, lpOverlapped=0x0) returned 1 [0165.706] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.706] CloseHandle (hObject=0x398) returned 1 [0165.707] CloseHandle (hObject=0x388) returned 1 [0165.707] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0 [0165.707] SetEvent (hEvent=0x2fc) returned 1 [0165.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.708] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1536) returned 1 [0165.708] CloseHandle (hObject=0x388) returned 1 [0165.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0165.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0165.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0165.710] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x600, lpOverlapped=0x0) returned 1 [0165.712] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x610, lpOverlapped=0x0) returned 1 [0165.713] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.713] CloseHandle (hObject=0x388) returned 1 [0165.713] CloseHandle (hObject=0x398) returned 1 [0165.714] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0 [0165.714] SetEvent (hEvent=0x2fc) returned 1 [0165.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0165.714] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4708) returned 1 [0165.715] CloseHandle (hObject=0x398) returned 1 [0165.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0165.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0165.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0165.715] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0165.718] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1264, lpOverlapped=0x0) returned 1 [0165.720] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1270, lpOverlapped=0x0) returned 1 [0165.721] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.721] CloseHandle (hObject=0x398) returned 1 [0165.721] CloseHandle (hObject=0x388) returned 1 [0165.721] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0 [0165.722] SetEvent (hEvent=0x2fc) returned 1 [0165.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.723] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1736) returned 1 [0165.723] CloseHandle (hObject=0x388) returned 1 [0165.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0165.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0165.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0165.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0165.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.724] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0165.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0165.871] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6c8, lpOverlapped=0x0) returned 1 [0165.882] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6d0, lpOverlapped=0x0) returned 1 [0165.883] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0165.883] CloseHandle (hObject=0x388) returned 1 [0165.884] CloseHandle (hObject=0x380) returned 1 [0165.884] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0 [0165.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0166.080] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2644) returned 1 [0166.080] CloseHandle (hObject=0x398) returned 1 [0166.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0166.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0166.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0166.081] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.081] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.082] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa54, lpOverlapped=0x0) returned 1 [0166.083] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa60, lpOverlapped=0x0) returned 1 [0166.084] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.084] CloseHandle (hObject=0x398) returned 1 [0166.085] CloseHandle (hObject=0x38c) returned 1 [0166.085] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0 [0166.085] SetEvent (hEvent=0x2fc) returned 1 [0166.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.086] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3780) returned 1 [0166.086] CloseHandle (hObject=0x38c) returned 1 [0166.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0166.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0166.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.087] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.087] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.471] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xec4, lpOverlapped=0x0) returned 1 [0166.473] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xed0, lpOverlapped=0x0) returned 1 [0166.474] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.474] CloseHandle (hObject=0x38c) returned 1 [0166.474] CloseHandle (hObject=0x39c) returned 1 [0166.475] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0 [0166.475] SetEvent (hEvent=0x2fc) returned 1 [0166.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.476] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4164) returned 1 [0166.476] CloseHandle (hObject=0x39c) returned 1 [0166.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0166.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0166.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.476] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.477] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.477] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1044, lpOverlapped=0x0) returned 1 [0166.479] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1050, lpOverlapped=0x0) returned 1 [0166.480] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.480] CloseHandle (hObject=0x39c) returned 1 [0166.480] CloseHandle (hObject=0x38c) returned 1 [0166.481] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0 [0166.481] SetEvent (hEvent=0x2fc) returned 1 [0166.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.484] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13102) returned 1 [0166.484] CloseHandle (hObject=0x38c) returned 1 [0166.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0166.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0166.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.485] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.485] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.486] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x332e, lpOverlapped=0x0) returned 1 [0166.487] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3330, lpOverlapped=0x0) returned 1 [0166.489] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.489] CloseHandle (hObject=0x38c) returned 1 [0166.489] CloseHandle (hObject=0x39c) returned 1 [0166.489] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0 [0166.489] SetEvent (hEvent=0x2fc) returned 1 [0166.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.490] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27050) returned 1 [0166.490] CloseHandle (hObject=0x39c) returned 1 [0166.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0166.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0166.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.491] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.491] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.492] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x69aa, lpOverlapped=0x0) returned 1 [0166.494] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x69b0, lpOverlapped=0x0) returned 1 [0166.495] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.496] CloseHandle (hObject=0x39c) returned 1 [0166.496] CloseHandle (hObject=0x38c) returned 1 [0166.496] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0 [0166.496] SetEvent (hEvent=0x2fc) returned 1 [0166.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.497] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6996) returned 1 [0166.497] CloseHandle (hObject=0x38c) returned 1 [0166.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0166.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0166.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.498] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.498] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0166.498] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b54, lpOverlapped=0x0) returned 1 [0166.501] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b60, lpOverlapped=0x0) returned 1 [0166.502] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.502] CloseHandle (hObject=0x38c) returned 1 [0166.502] CloseHandle (hObject=0x39c) returned 1 [0166.502] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0 [0166.503] SetEvent (hEvent=0x2fc) returned 1 [0166.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.503] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9590) returned 1 [0166.503] CloseHandle (hObject=0x39c) returned 1 [0166.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0166.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0166.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0166.504] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.504] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.505] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2576, lpOverlapped=0x0) returned 1 [0166.507] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2580, lpOverlapped=0x0) returned 1 [0166.508] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.508] CloseHandle (hObject=0x39c) returned 1 [0166.508] CloseHandle (hObject=0x38c) returned 1 [0166.508] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0 [0166.509] SetEvent (hEvent=0x2fc) returned 1 [0166.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.510] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27552) returned 1 [0166.510] CloseHandle (hObject=0x38c) returned 1 [0166.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0166.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0166.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.511] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.511] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.675] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6ba0, lpOverlapped=0x0) returned 1 [0166.677] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6bb0, lpOverlapped=0x0) returned 1 [0166.679] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.679] CloseHandle (hObject=0x38c) returned 1 [0166.679] CloseHandle (hObject=0x380) returned 1 [0166.679] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0 [0166.679] SetEvent (hEvent=0x2fc) returned 1 [0166.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.680] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29004) returned 1 [0166.680] CloseHandle (hObject=0x380) returned 1 [0166.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0166.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0166.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.681] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.681] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.683] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x714c, lpOverlapped=0x0) returned 1 [0166.685] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7150, lpOverlapped=0x0) returned 1 [0166.687] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.687] CloseHandle (hObject=0x380) returned 1 [0166.687] CloseHandle (hObject=0x38c) returned 1 [0166.687] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0 [0166.687] SetEvent (hEvent=0x2fc) returned 1 [0166.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.688] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1330) returned 1 [0166.688] CloseHandle (hObject=0x38c) returned 1 [0166.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0166.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0166.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.690] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x532, lpOverlapped=0x0) returned 1 [0166.691] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x540, lpOverlapped=0x0) returned 1 [0166.692] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.692] CloseHandle (hObject=0x38c) returned 1 [0166.692] CloseHandle (hObject=0x380) returned 1 [0166.692] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0 [0166.693] SetEvent (hEvent=0x2fc) returned 1 [0166.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.694] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1444) returned 1 [0166.694] CloseHandle (hObject=0x380) returned 1 [0166.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0166.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0166.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.695] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.695] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.696] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5a4, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5b0, lpOverlapped=0x0) returned 1 [0166.699] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.700] CloseHandle (hObject=0x380) returned 1 [0166.700] CloseHandle (hObject=0x38c) returned 1 [0166.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0 [0166.701] SetEvent (hEvent=0x2fc) returned 1 [0166.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.702] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7974) returned 1 [0166.702] CloseHandle (hObject=0x38c) returned 1 [0166.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0166.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0166.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.703] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.703] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.704] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f26, lpOverlapped=0x0) returned 1 [0166.705] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f30, lpOverlapped=0x0) returned 1 [0166.707] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.707] CloseHandle (hObject=0x38c) returned 1 [0166.707] CloseHandle (hObject=0x380) returned 1 [0166.707] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0 [0166.707] SetEvent (hEvent=0x2fc) returned 1 [0166.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.708] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2378) returned 1 [0166.708] CloseHandle (hObject=0x380) returned 1 [0166.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0166.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0166.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.709] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.709] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0166.711] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x94a, lpOverlapped=0x0) returned 1 [0166.713] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x950, lpOverlapped=0x0) returned 1 [0166.714] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.714] CloseHandle (hObject=0x380) returned 1 [0166.715] CloseHandle (hObject=0x38c) returned 1 [0166.715] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0 [0166.715] SetEvent (hEvent=0x2fc) returned 1 [0166.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0166.716] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1044) returned 1 [0166.716] CloseHandle (hObject=0x38c) returned 1 [0166.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0166.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0166.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.933] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0166.934] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x414, lpOverlapped=0x0) returned 1 [0166.935] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x420, lpOverlapped=0x0) returned 1 [0166.942] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.942] CloseHandle (hObject=0x380) returned 1 [0166.943] CloseHandle (hObject=0x37c) returned 1 [0166.943] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0 [0166.943] SetEvent (hEvent=0x2fc) returned 1 [0166.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0166.944] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1212) returned 1 [0166.944] CloseHandle (hObject=0x37c) returned 1 [0166.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0166.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0166.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0166.945] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.945] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.946] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4bc, lpOverlapped=0x0) returned 1 [0166.948] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4c0, lpOverlapped=0x0) returned 1 [0166.949] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.949] CloseHandle (hObject=0x37c) returned 1 [0166.949] CloseHandle (hObject=0x380) returned 1 [0166.949] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0 [0166.950] SetEvent (hEvent=0x2fc) returned 1 [0166.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.951] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2052) returned 1 [0166.951] CloseHandle (hObject=0x380) returned 1 [0166.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0166.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0166.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.952] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.952] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0166.952] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x804, lpOverlapped=0x0) returned 1 [0166.954] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x810, lpOverlapped=0x0) returned 1 [0166.955] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.955] CloseHandle (hObject=0x380) returned 1 [0166.955] CloseHandle (hObject=0x37c) returned 1 [0166.955] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0 [0166.956] SetEvent (hEvent=0x2fc) returned 1 [0166.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0166.957] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5580) returned 1 [0166.957] CloseHandle (hObject=0x37c) returned 1 [0166.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0166.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0166.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0166.958] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.958] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.959] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x15cc, lpOverlapped=0x0) returned 1 [0166.960] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x15d0, lpOverlapped=0x0) returned 1 [0166.962] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.962] CloseHandle (hObject=0x37c) returned 1 [0166.962] CloseHandle (hObject=0x380) returned 1 [0166.962] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0 [0166.962] SetEvent (hEvent=0x2fc) returned 1 [0166.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.963] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3524) returned 1 [0166.963] CloseHandle (hObject=0x380) returned 1 [0166.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0166.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0166.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0166.964] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.964] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0166.964] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xdc4, lpOverlapped=0x0) returned 1 [0166.966] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xdd0, lpOverlapped=0x0) returned 1 [0166.967] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0166.968] CloseHandle (hObject=0x380) returned 1 [0166.968] CloseHandle (hObject=0x37c) returned 1 [0166.968] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0 [0166.968] SetEvent (hEvent=0x2fc) returned 1 [0166.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0166.969] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2488) returned 1 [0166.969] CloseHandle (hObject=0x37c) returned 1 [0166.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0166.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0166.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0166.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0166.970] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.970] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0166.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0166.970] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9b8, lpOverlapped=0x0) returned 1 [0167.270] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9c0, lpOverlapped=0x0) returned 1 [0167.271] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.272] CloseHandle (hObject=0x37c) returned 1 [0167.272] CloseHandle (hObject=0x380) returned 1 [0167.273] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0 [0167.273] SetEvent (hEvent=0x2fc) returned 1 [0167.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.274] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3494) returned 1 [0167.274] CloseHandle (hObject=0x380) returned 1 [0167.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0167.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0167.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.275] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.275] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.276] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xda6, lpOverlapped=0x0) returned 1 [0167.278] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xdb0, lpOverlapped=0x0) returned 1 [0167.279] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.279] CloseHandle (hObject=0x380) returned 1 [0167.279] CloseHandle (hObject=0x37c) returned 1 [0167.279] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0 [0167.279] SetEvent (hEvent=0x2fc) returned 1 [0167.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.281] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14996) returned 1 [0167.281] CloseHandle (hObject=0x37c) returned 1 [0167.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0167.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0167.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.282] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.282] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.283] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3a94, lpOverlapped=0x0) returned 1 [0167.285] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3aa0, lpOverlapped=0x0) returned 1 [0167.286] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.286] CloseHandle (hObject=0x37c) returned 1 [0167.287] CloseHandle (hObject=0x380) returned 1 [0167.287] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0 [0167.287] SetEvent (hEvent=0x2fc) returned 1 [0167.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.288] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1874) returned 1 [0167.288] CloseHandle (hObject=0x380) returned 1 [0167.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0167.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0167.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.289] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.289] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.290] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x752, lpOverlapped=0x0) returned 1 [0167.291] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x760, lpOverlapped=0x0) returned 1 [0167.292] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.292] CloseHandle (hObject=0x380) returned 1 [0167.293] CloseHandle (hObject=0x37c) returned 1 [0167.293] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0 [0167.293] SetEvent (hEvent=0x2fc) returned 1 [0167.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.294] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3948) returned 1 [0167.294] CloseHandle (hObject=0x37c) returned 1 [0167.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0167.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0167.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.295] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.295] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.296] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf6c, lpOverlapped=0x0) returned 1 [0167.298] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf70, lpOverlapped=0x0) returned 1 [0167.299] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.299] CloseHandle (hObject=0x37c) returned 1 [0167.299] CloseHandle (hObject=0x380) returned 1 [0167.299] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0 [0167.299] SetEvent (hEvent=0x2fc) returned 1 [0167.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.300] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10538) returned 1 [0167.300] CloseHandle (hObject=0x380) returned 1 [0167.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0167.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0167.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0167.301] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.301] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.302] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x292a, lpOverlapped=0x0) returned 1 [0167.304] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2930, lpOverlapped=0x0) returned 1 [0167.305] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.305] CloseHandle (hObject=0x380) returned 1 [0167.305] CloseHandle (hObject=0x37c) returned 1 [0167.305] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0 [0167.306] SetEvent (hEvent=0x2fc) returned 1 [0167.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.307] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4236) returned 1 [0167.307] CloseHandle (hObject=0x37c) returned 1 [0167.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0167.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0167.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.308] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.308] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0167.308] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x108c, lpOverlapped=0x0) returned 1 [0167.531] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1090, lpOverlapped=0x0) returned 1 [0167.532] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.532] CloseHandle (hObject=0x37c) returned 1 [0167.532] CloseHandle (hObject=0x380) returned 1 [0167.535] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0 [0167.549] SetEvent (hEvent=0x2fc) returned 1 [0167.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.609] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2966) returned 1 [0167.610] CloseHandle (hObject=0x37c) returned 1 [0167.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0167.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0167.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.611] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.611] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0167.611] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb96, lpOverlapped=0x0) returned 1 [0167.613] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xba0, lpOverlapped=0x0) returned 1 [0167.614] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2, lpOverlapped=0x0) returned 1 [0167.614] CloseHandle (hObject=0x37c) returned 1 [0167.614] CloseHandle (hObject=0x398) returned 1 [0167.614] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0 [0167.615] SetEvent (hEvent=0x2fc) returned 1 [0167.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.616] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29628) returned 1 [0167.616] CloseHandle (hObject=0x398) returned 1 [0167.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0167.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0167.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.617] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.617] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.617] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x73bc, lpOverlapped=0x0) returned 1 [0167.619] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x73c0, lpOverlapped=0x0) returned 1 [0167.621] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.621] CloseHandle (hObject=0x398) returned 1 [0167.621] CloseHandle (hObject=0x37c) returned 1 [0167.621] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0 [0167.621] SetEvent (hEvent=0x2fc) returned 1 [0167.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.623] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2690) returned 1 [0167.623] CloseHandle (hObject=0x37c) returned 1 [0167.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0167.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0167.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.624] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.624] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0167.625] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa82, lpOverlapped=0x0) returned 1 [0167.627] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa90, lpOverlapped=0x0) returned 1 [0167.628] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.628] CloseHandle (hObject=0x37c) returned 1 [0167.628] CloseHandle (hObject=0x398) returned 1 [0167.628] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0 [0167.629] SetEvent (hEvent=0x2fc) returned 1 [0167.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.629] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2832) returned 1 [0167.629] CloseHandle (hObject=0x398) returned 1 [0167.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0167.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0167.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.630] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.630] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.632] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb10, lpOverlapped=0x0) returned 1 [0167.634] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb20, lpOverlapped=0x0) returned 1 [0167.635] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.635] CloseHandle (hObject=0x398) returned 1 [0167.635] CloseHandle (hObject=0x37c) returned 1 [0167.635] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0 [0167.635] SetEvent (hEvent=0x2fc) returned 1 [0167.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.636] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=37974) returned 1 [0167.636] CloseHandle (hObject=0x37c) returned 1 [0167.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0167.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0167.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.637] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.637] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0167.638] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9456, lpOverlapped=0x0) returned 1 [0167.640] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9460, lpOverlapped=0x0) returned 1 [0167.642] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.642] CloseHandle (hObject=0x37c) returned 1 [0167.642] CloseHandle (hObject=0x398) returned 1 [0167.642] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0 [0167.642] SetEvent (hEvent=0x2fc) returned 1 [0167.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.643] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=40030) returned 1 [0167.643] CloseHandle (hObject=0x398) returned 1 [0167.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0167.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0167.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.644] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.644] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.645] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9c5e, lpOverlapped=0x0) returned 1 [0167.807] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9c60, lpOverlapped=0x0) returned 1 [0167.850] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.850] CloseHandle (hObject=0x398) returned 1 [0167.850] CloseHandle (hObject=0x37c) returned 1 [0167.850] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0 [0167.851] SetEvent (hEvent=0x2fc) returned 1 [0167.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.852] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=712) returned 1 [0167.852] CloseHandle (hObject=0x37c) returned 1 [0167.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0167.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0167.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.853] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.853] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0167.858] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2c8, lpOverlapped=0x0) returned 1 [0167.859] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2d0, lpOverlapped=0x0) returned 1 [0167.860] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.860] CloseHandle (hObject=0x37c) returned 1 [0167.860] CloseHandle (hObject=0x398) returned 1 [0167.860] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0 [0167.861] SetEvent (hEvent=0x2fc) returned 1 [0167.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.861] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1932) returned 1 [0167.861] CloseHandle (hObject=0x398) returned 1 [0167.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0167.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0167.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.862] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.862] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.863] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x78c, lpOverlapped=0x0) returned 1 [0167.864] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x790, lpOverlapped=0x0) returned 1 [0167.865] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.865] CloseHandle (hObject=0x398) returned 1 [0167.865] CloseHandle (hObject=0x37c) returned 1 [0167.865] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0 [0167.866] SetEvent (hEvent=0x2fc) returned 1 [0167.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.866] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2952) returned 1 [0167.866] CloseHandle (hObject=0x37c) returned 1 [0167.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0167.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0167.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.867] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.867] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0167.868] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb88, lpOverlapped=0x0) returned 1 [0167.870] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb90, lpOverlapped=0x0) returned 1 [0167.870] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.871] CloseHandle (hObject=0x37c) returned 1 [0167.871] CloseHandle (hObject=0x398) returned 1 [0167.871] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0 [0167.871] SetEvent (hEvent=0x2fc) returned 1 [0167.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.872] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9992) returned 1 [0167.872] CloseHandle (hObject=0x398) returned 1 [0167.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0167.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0167.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.872] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.873] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0167.873] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2708, lpOverlapped=0x0) returned 1 [0167.875] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2710, lpOverlapped=0x0) returned 1 [0167.877] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.877] CloseHandle (hObject=0x398) returned 1 [0167.877] CloseHandle (hObject=0x37c) returned 1 [0167.877] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0 [0167.877] SetEvent (hEvent=0x2fc) returned 1 [0167.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.878] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20784) returned 1 [0167.878] CloseHandle (hObject=0x37c) returned 1 [0167.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0167.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0167.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0167.879] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.879] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0167.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0167.880] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5130, lpOverlapped=0x0) returned 1 [0167.882] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5140, lpOverlapped=0x0) returned 1 [0167.883] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0167.883] CloseHandle (hObject=0x37c) returned 1 [0167.883] CloseHandle (hObject=0x398) returned 1 [0167.883] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0 [0167.884] SetEvent (hEvent=0x2fc) returned 1 [0167.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0167.884] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24588) returned 1 [0167.885] CloseHandle (hObject=0x398) returned 1 [0167.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0167.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0167.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0167.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.046] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.046] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0168.222] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x600c, lpOverlapped=0x0) returned 1 [0168.253] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6010, lpOverlapped=0x0) returned 1 [0168.255] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.255] CloseHandle (hObject=0x380) returned 1 [0168.255] CloseHandle (hObject=0x39c) returned 1 [0168.255] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0 [0168.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.256] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3616) returned 1 [0168.256] CloseHandle (hObject=0x39c) returned 1 [0168.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0168.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0168.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.257] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.257] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.258] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe20, lpOverlapped=0x0) returned 1 [0168.263] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe30, lpOverlapped=0x0) returned 1 [0168.264] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.264] CloseHandle (hObject=0x39c) returned 1 [0168.265] CloseHandle (hObject=0x380) returned 1 [0168.265] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0 [0168.265] SetEvent (hEvent=0x2fc) returned 1 [0168.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.446] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2780) returned 1 [0168.446] CloseHandle (hObject=0x360) returned 1 [0168.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0168.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0168.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0168.447] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.447] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0168.448] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xadc, lpOverlapped=0x0) returned 1 [0168.461] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xae0, lpOverlapped=0x0) returned 1 [0168.463] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.463] CloseHandle (hObject=0x360) returned 1 [0168.463] CloseHandle (hObject=0x368) returned 1 [0168.463] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0 [0168.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.618] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2300) returned 1 [0168.618] CloseHandle (hObject=0x380) returned 1 [0168.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0168.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0168.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.619] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.619] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0168.620] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8fc, lpOverlapped=0x0) returned 1 [0168.622] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x900, lpOverlapped=0x0) returned 1 [0168.623] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.623] CloseHandle (hObject=0x380) returned 1 [0168.623] CloseHandle (hObject=0x39c) returned 1 [0168.623] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0 [0168.624] SetEvent (hEvent=0x2fc) returned 1 [0168.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.624] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2020) returned 1 [0168.624] CloseHandle (hObject=0x39c) returned 1 [0168.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0168.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0168.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.625] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.625] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0168.626] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7e4, lpOverlapped=0x0) returned 1 [0168.628] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7f0, lpOverlapped=0x0) returned 1 [0168.629] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.629] CloseHandle (hObject=0x39c) returned 1 [0168.629] CloseHandle (hObject=0x380) returned 1 [0168.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0 [0168.630] SetEvent (hEvent=0x2fc) returned 1 [0168.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.631] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2404) returned 1 [0168.631] CloseHandle (hObject=0x380) returned 1 [0168.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0168.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0168.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0168.631] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.631] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0168.632] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x964, lpOverlapped=0x0) returned 1 [0168.634] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x970, lpOverlapped=0x0) returned 1 [0168.635] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.635] CloseHandle (hObject=0x380) returned 1 [0168.635] CloseHandle (hObject=0x39c) returned 1 [0168.635] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0 [0168.636] SetEvent (hEvent=0x2fc) returned 1 [0168.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.636] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2052) returned 1 [0168.636] CloseHandle (hObject=0x39c) returned 1 [0168.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0168.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0168.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0168.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0168.848] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.848] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0168.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0168.849] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x804, lpOverlapped=0x0) returned 1 [0168.940] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x810, lpOverlapped=0x0) returned 1 [0168.941] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0168.941] CloseHandle (hObject=0x39c) returned 1 [0168.942] CloseHandle (hObject=0x338) returned 1 [0169.098] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0 [0169.098] SetEvent (hEvent=0x2fc) returned 1 [0169.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.099] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1448) returned 1 [0169.099] CloseHandle (hObject=0x368) returned 1 [0169.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0169.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0169.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.100] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.100] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0169.100] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5a8, lpOverlapped=0x0) returned 1 [0169.117] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5b0, lpOverlapped=0x0) returned 1 [0169.119] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.119] CloseHandle (hObject=0x368) returned 1 [0169.119] CloseHandle (hObject=0x380) returned 1 [0169.119] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0 [0169.119] SetEvent (hEvent=0x2fc) returned 1 [0169.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.120] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2296) returned 1 [0169.120] CloseHandle (hObject=0x380) returned 1 [0169.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0169.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0169.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.121] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.121] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.128] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8f8, lpOverlapped=0x0) returned 1 [0169.134] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x900, lpOverlapped=0x0) returned 1 [0169.135] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.135] CloseHandle (hObject=0x380) returned 1 [0169.135] CloseHandle (hObject=0x344) returned 1 [0169.135] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0 [0169.136] SetEvent (hEvent=0x2fc) returned 1 [0169.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.136] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1768) returned 1 [0169.136] CloseHandle (hObject=0x344) returned 1 [0169.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0169.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0169.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.137] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.137] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0169.138] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6e8, lpOverlapped=0x0) returned 1 [0169.141] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6f0, lpOverlapped=0x0) returned 1 [0169.142] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.142] CloseHandle (hObject=0x344) returned 1 [0169.142] CloseHandle (hObject=0x380) returned 1 [0169.142] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0 [0169.143] SetEvent (hEvent=0x2fc) returned 1 [0169.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.145] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=900) returned 1 [0169.145] CloseHandle (hObject=0x380) returned 1 [0169.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0169.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0169.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.146] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.146] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.147] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x384, lpOverlapped=0x0) returned 1 [0169.153] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x390, lpOverlapped=0x0) returned 1 [0169.154] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.154] CloseHandle (hObject=0x380) returned 1 [0169.156] CloseHandle (hObject=0x344) returned 1 [0169.156] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0 [0169.156] SetEvent (hEvent=0x2fc) returned 1 [0169.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.157] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2524) returned 1 [0169.157] CloseHandle (hObject=0x344) returned 1 [0169.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0169.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0169.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0169.157] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.158] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0169.159] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9dc, lpOverlapped=0x0) returned 1 [0169.176] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9e0, lpOverlapped=0x0) returned 1 [0169.177] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.177] CloseHandle (hObject=0x344) returned 1 [0169.177] CloseHandle (hObject=0x380) returned 1 [0169.177] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0 [0169.178] SetEvent (hEvent=0x2fc) returned 1 [0169.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.178] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2324) returned 1 [0169.178] CloseHandle (hObject=0x380) returned 1 [0169.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0169.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0169.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0169.179] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.179] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0169.180] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x914, lpOverlapped=0x0) returned 1 [0169.187] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x920, lpOverlapped=0x0) returned 1 [0169.189] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.189] CloseHandle (hObject=0x380) returned 1 [0169.189] CloseHandle (hObject=0x344) returned 1 [0169.300] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0 [0169.320] SetEvent (hEvent=0x2fc) returned 1 [0169.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.321] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=296) returned 1 [0169.321] CloseHandle (hObject=0x338) returned 1 [0169.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0169.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0169.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.322] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.322] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.323] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x128, lpOverlapped=0x0) returned 1 [0169.324] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x130, lpOverlapped=0x0) returned 1 [0169.325] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.327] CloseHandle (hObject=0x338) returned 1 [0169.327] CloseHandle (hObject=0x368) returned 1 [0169.327] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0 [0169.327] SetEvent (hEvent=0x2fc) returned 1 [0169.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.328] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=552) returned 1 [0169.328] CloseHandle (hObject=0x368) returned 1 [0169.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0169.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0169.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.329] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.329] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.329] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x228, lpOverlapped=0x0) returned 1 [0169.331] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x230, lpOverlapped=0x0) returned 1 [0169.332] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.332] CloseHandle (hObject=0x368) returned 1 [0169.332] CloseHandle (hObject=0x338) returned 1 [0169.332] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0 [0169.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.333] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4148) returned 1 [0169.333] CloseHandle (hObject=0x338) returned 1 [0169.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0169.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0169.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.334] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1034, lpOverlapped=0x0) returned 1 [0169.336] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1040, lpOverlapped=0x0) returned 1 [0169.337] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.337] CloseHandle (hObject=0x338) returned 1 [0169.337] CloseHandle (hObject=0x368) returned 1 [0169.338] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0 [0169.338] SetEvent (hEvent=0x2fc) returned 1 [0169.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.339] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2300) returned 1 [0169.339] CloseHandle (hObject=0x368) returned 1 [0169.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0169.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0169.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.340] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.340] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.341] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8fc, lpOverlapped=0x0) returned 1 [0169.342] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x900, lpOverlapped=0x0) returned 1 [0169.344] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.344] CloseHandle (hObject=0x368) returned 1 [0169.344] CloseHandle (hObject=0x338) returned 1 [0169.344] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0 [0169.344] SetEvent (hEvent=0x2fc) returned 1 [0169.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.345] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3252) returned 1 [0169.345] CloseHandle (hObject=0x338) returned 1 [0169.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0169.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0169.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.346] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.346] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0169.346] ReadFile (in: hFile=0x338, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcb4, lpOverlapped=0x0) returned 1 [0169.351] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcc0, lpOverlapped=0x0) returned 1 [0169.352] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.352] CloseHandle (hObject=0x338) returned 1 [0169.353] CloseHandle (hObject=0x368) returned 1 [0169.353] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0 [0169.353] SetEvent (hEvent=0x2fc) returned 1 [0169.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.354] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6165) returned 1 [0169.354] CloseHandle (hObject=0x368) returned 1 [0169.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0169.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0169.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0169.355] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.355] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x338 [0169.356] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1815, lpOverlapped=0x0) returned 1 [0169.358] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1820, lpOverlapped=0x0) returned 1 [0169.359] WriteFile (in: hFile=0x338, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.359] CloseHandle (hObject=0x368) returned 1 [0169.359] CloseHandle (hObject=0x338) returned 1 [0169.359] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0 [0169.360] SetEvent (hEvent=0x2fc) returned 1 [0169.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0169.361] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1382) returned 1 [0169.361] CloseHandle (hObject=0x338) returned 1 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0169.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.667] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.667] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0169.668] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x566, lpOverlapped=0x0) returned 1 [0169.676] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x570, lpOverlapped=0x0) returned 1 [0169.677] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.677] CloseHandle (hObject=0x370) returned 1 [0169.678] CloseHandle (hObject=0x394) returned 1 [0169.678] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0 [0169.678] SetEvent (hEvent=0x2fc) returned 1 [0169.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.816] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2280) returned 1 [0169.816] CloseHandle (hObject=0x39c) returned 1 [0169.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0169.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0169.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.817] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.817] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0169.818] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8e8, lpOverlapped=0x0) returned 1 [0169.820] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8f0, lpOverlapped=0x0) returned 1 [0169.821] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.821] CloseHandle (hObject=0x39c) returned 1 [0169.821] CloseHandle (hObject=0x360) returned 1 [0169.821] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0 [0169.822] SetEvent (hEvent=0x2fc) returned 1 [0169.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0169.823] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17850) returned 1 [0169.823] CloseHandle (hObject=0x360) returned 1 [0169.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0169.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0169.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0169.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0169.825] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x45ba, lpOverlapped=0x0) returned 1 [0169.829] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x45c0, lpOverlapped=0x0) returned 1 [0169.830] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.830] CloseHandle (hObject=0x360) returned 1 [0169.830] CloseHandle (hObject=0x39c) returned 1 [0169.830] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0 [0169.831] SetEvent (hEvent=0x2fc) returned 1 [0169.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.831] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11994) returned 1 [0169.832] CloseHandle (hObject=0x39c) returned 1 [0169.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0169.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0169.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.832] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.832] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0169.833] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2eda, lpOverlapped=0x0) returned 1 [0169.835] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2ee0, lpOverlapped=0x0) returned 1 [0169.836] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.836] CloseHandle (hObject=0x39c) returned 1 [0169.836] CloseHandle (hObject=0x360) returned 1 [0169.836] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0 [0169.837] SetEvent (hEvent=0x2fc) returned 1 [0169.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0169.837] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=30240) returned 1 [0169.837] CloseHandle (hObject=0x360) returned 1 [0169.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0169.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0169.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0169.838] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.838] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0169.839] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7620, lpOverlapped=0x0) returned 1 [0169.841] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7630, lpOverlapped=0x0) returned 1 [0169.843] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.843] CloseHandle (hObject=0x360) returned 1 [0169.843] CloseHandle (hObject=0x39c) returned 1 [0169.843] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0 [0169.844] SetEvent (hEvent=0x2fc) returned 1 [0169.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.845] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29212) returned 1 [0169.845] CloseHandle (hObject=0x39c) returned 1 [0169.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0169.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0169.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0169.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0169.846] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.846] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0169.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0169.847] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x721c, lpOverlapped=0x0) returned 1 [0169.851] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7220, lpOverlapped=0x0) returned 1 [0169.852] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0169.852] CloseHandle (hObject=0x39c) returned 1 [0169.852] CloseHandle (hObject=0x360) returned 1 [0169.852] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0 [0169.987] SetEvent (hEvent=0x2fc) returned 1 [0169.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.005] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18194) returned 1 [0170.005] CloseHandle (hObject=0x394) returned 1 [0170.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0170.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0170.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.006] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.006] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0170.007] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4712, lpOverlapped=0x0) returned 1 [0170.009] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4720, lpOverlapped=0x0) returned 1 [0170.011] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.011] CloseHandle (hObject=0x394) returned 1 [0170.011] CloseHandle (hObject=0x360) returned 1 [0170.011] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0 [0170.012] SetEvent (hEvent=0x2fc) returned 1 [0170.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.012] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4074) returned 1 [0170.012] CloseHandle (hObject=0x360) returned 1 [0170.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0170.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0170.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.013] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.013] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.014] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfea, lpOverlapped=0x0) returned 1 [0170.016] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xff0, lpOverlapped=0x0) returned 1 [0170.017] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.017] CloseHandle (hObject=0x360) returned 1 [0170.017] CloseHandle (hObject=0x394) returned 1 [0170.017] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0 [0170.018] SetEvent (hEvent=0x2fc) returned 1 [0170.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.018] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8552) returned 1 [0170.018] CloseHandle (hObject=0x394) returned 1 [0170.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0170.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0170.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.019] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.019] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0170.020] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2168, lpOverlapped=0x0) returned 1 [0170.022] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2170, lpOverlapped=0x0) returned 1 [0170.023] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.023] CloseHandle (hObject=0x394) returned 1 [0170.023] CloseHandle (hObject=0x360) returned 1 [0170.023] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0 [0170.023] SetEvent (hEvent=0x2fc) returned 1 [0170.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.024] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8424) returned 1 [0170.024] CloseHandle (hObject=0x360) returned 1 [0170.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0170.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0170.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.025] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.025] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.026] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x20e8, lpOverlapped=0x0) returned 1 [0170.028] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x20f0, lpOverlapped=0x0) returned 1 [0170.029] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.029] CloseHandle (hObject=0x360) returned 1 [0170.029] CloseHandle (hObject=0x394) returned 1 [0170.029] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0 [0170.029] SetEvent (hEvent=0x2fc) returned 1 [0170.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.030] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10816) returned 1 [0170.030] CloseHandle (hObject=0x394) returned 1 [0170.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0170.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0170.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.031] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.031] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0170.031] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a40, lpOverlapped=0x0) returned 1 [0170.033] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a50, lpOverlapped=0x0) returned 1 [0170.035] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.035] CloseHandle (hObject=0x394) returned 1 [0170.035] CloseHandle (hObject=0x360) returned 1 [0170.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0 [0170.036] SetEvent (hEvent=0x2fc) returned 1 [0170.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.036] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7878) returned 1 [0170.036] CloseHandle (hObject=0x360) returned 1 [0170.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0170.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0170.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.037] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.037] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0170.038] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1ec6, lpOverlapped=0x0) returned 1 [0170.039] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ed0, lpOverlapped=0x0) returned 1 [0170.040] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.040] CloseHandle (hObject=0x360) returned 1 [0170.041] CloseHandle (hObject=0x394) returned 1 [0170.041] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0 [0170.041] SetEvent (hEvent=0x2fc) returned 1 [0170.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.042] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11002) returned 1 [0170.042] CloseHandle (hObject=0x394) returned 1 [0170.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0170.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0170.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0170.171] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.171] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0170.172] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2afa, lpOverlapped=0x0) returned 1 [0170.205] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2b00, lpOverlapped=0x0) returned 1 [0170.206] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.206] CloseHandle (hObject=0x360) returned 1 [0170.206] CloseHandle (hObject=0x39c) returned 1 [0170.207] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0 [0170.207] SetEvent (hEvent=0x2fc) returned 1 [0170.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.208] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2108) returned 1 [0170.208] CloseHandle (hObject=0x39c) returned 1 [0170.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0170.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0170.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.208] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.208] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.213] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x83c, lpOverlapped=0x0) returned 1 [0170.257] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x840, lpOverlapped=0x0) returned 1 [0170.258] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.259] CloseHandle (hObject=0x39c) returned 1 [0170.259] CloseHandle (hObject=0x380) returned 1 [0170.263] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0 [0170.264] SetEvent (hEvent=0x2fc) returned 1 [0170.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.278] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8926) returned 1 [0170.278] CloseHandle (hObject=0x36c) returned 1 [0170.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0170.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0170.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.279] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.279] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0170.280] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x22de, lpOverlapped=0x0) returned 1 [0170.287] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x22e0, lpOverlapped=0x0) returned 1 [0170.289] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.289] CloseHandle (hObject=0x36c) returned 1 [0170.289] CloseHandle (hObject=0x344) returned 1 [0170.289] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0 [0170.289] SetEvent (hEvent=0x2fc) returned 1 [0170.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.290] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17406) returned 1 [0170.290] CloseHandle (hObject=0x344) returned 1 [0170.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0170.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0170.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.291] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.291] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.292] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x43fe, lpOverlapped=0x0) returned 1 [0170.336] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4400, lpOverlapped=0x0) returned 1 [0170.337] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.337] CloseHandle (hObject=0x344) returned 1 [0170.337] CloseHandle (hObject=0x36c) returned 1 [0170.338] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0 [0170.338] SetEvent (hEvent=0x2fc) returned 1 [0170.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.339] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1472) returned 1 [0170.339] CloseHandle (hObject=0x36c) returned 1 [0170.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0170.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0170.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0170.340] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.340] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0170.340] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5c0, lpOverlapped=0x0) returned 1 [0170.356] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5d0, lpOverlapped=0x0) returned 1 [0170.357] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.357] CloseHandle (hObject=0x36c) returned 1 [0170.357] CloseHandle (hObject=0x344) returned 1 [0170.357] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0 [0170.357] SetEvent (hEvent=0x2fc) returned 1 [0170.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.358] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5260) returned 1 [0170.358] CloseHandle (hObject=0x344) returned 1 [0170.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0170.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0170.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0170.359] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.359] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0170.360] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x148c, lpOverlapped=0x0) returned 1 [0170.380] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1490, lpOverlapped=0x0) returned 1 [0170.381] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.381] CloseHandle (hObject=0x344) returned 1 [0170.381] CloseHandle (hObject=0x36c) returned 1 [0170.381] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0 [0170.381] SetEvent (hEvent=0x2fc) returned 1 [0170.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.386] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=752) returned 1 [0170.386] CloseHandle (hObject=0x394) returned 1 [0170.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0170.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0170.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0170.389] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.389] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0170.390] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2f0, lpOverlapped=0x0) returned 1 [0170.398] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x300, lpOverlapped=0x0) returned 1 [0170.399] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.399] CloseHandle (hObject=0x394) returned 1 [0170.400] CloseHandle (hObject=0x358) returned 1 [0170.400] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0 [0170.400] SetEvent (hEvent=0x2fc) returned 1 [0170.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0170.401] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9010) returned 1 [0170.401] CloseHandle (hObject=0x358) returned 1 [0170.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0170.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0170.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0170.402] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.402] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.404] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2332, lpOverlapped=0x0) returned 1 [0170.406] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2340, lpOverlapped=0x0) returned 1 [0170.407] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.408] CloseHandle (hObject=0x358) returned 1 [0170.408] CloseHandle (hObject=0x380) returned 1 [0170.408] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0 [0170.408] SetEvent (hEvent=0x2fc) returned 1 [0170.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.409] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13968) returned 1 [0170.409] CloseHandle (hObject=0x380) returned 1 [0170.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0170.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0170.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.410] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.410] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0170.411] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3690, lpOverlapped=0x0) returned 1 [0170.417] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x36a0, lpOverlapped=0x0) returned 1 [0170.418] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.419] CloseHandle (hObject=0x380) returned 1 [0170.419] CloseHandle (hObject=0x358) returned 1 [0170.419] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0 [0170.419] SetEvent (hEvent=0x2fc) returned 1 [0170.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0170.423] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42704) returned 1 [0170.423] CloseHandle (hObject=0x358) returned 1 [0170.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0170.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0170.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0170.424] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.424] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.425] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa6d0, lpOverlapped=0x0) returned 1 [0170.565] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa6e0, lpOverlapped=0x0) returned 1 [0170.567] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.567] CloseHandle (hObject=0x358) returned 1 [0170.567] CloseHandle (hObject=0x380) returned 1 [0170.567] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0 [0170.567] SetEvent (hEvent=0x2fc) returned 1 [0170.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.568] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15164) returned 1 [0170.568] CloseHandle (hObject=0x380) returned 1 [0170.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0170.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0170.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.569] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.569] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0170.686] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3b3c, lpOverlapped=0x0) returned 1 [0170.691] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3b40, lpOverlapped=0x0) returned 1 [0170.692] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.692] CloseHandle (hObject=0x380) returned 1 [0170.693] CloseHandle (hObject=0x364) returned 1 [0170.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0 [0170.693] SetEvent (hEvent=0x2fc) returned 1 [0170.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.694] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2412) returned 1 [0170.694] CloseHandle (hObject=0x364) returned 1 [0170.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0170.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0170.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.695] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.695] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.696] ReadFile (in: hFile=0x364, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x96c, lpOverlapped=0x0) returned 1 [0170.697] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x970, lpOverlapped=0x0) returned 1 [0170.698] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.698] CloseHandle (hObject=0x364) returned 1 [0170.699] CloseHandle (hObject=0x380) returned 1 [0170.699] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0 [0170.699] SetEvent (hEvent=0x2fc) returned 1 [0170.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.700] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4984) returned 1 [0170.700] CloseHandle (hObject=0x380) returned 1 [0170.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0170.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0170.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.701] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.701] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0170.701] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1378, lpOverlapped=0x0) returned 1 [0170.703] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1380, lpOverlapped=0x0) returned 1 [0170.704] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.704] CloseHandle (hObject=0x380) returned 1 [0170.705] CloseHandle (hObject=0x364) returned 1 [0170.705] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0 [0170.705] SetEvent (hEvent=0x2fc) returned 1 [0170.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.706] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3964) returned 1 [0170.706] CloseHandle (hObject=0x364) returned 1 [0170.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0170.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0170.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.706] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.707] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.708] ReadFile (in: hFile=0x364, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf7c, lpOverlapped=0x0) returned 1 [0170.710] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf80, lpOverlapped=0x0) returned 1 [0170.711] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.711] CloseHandle (hObject=0x364) returned 1 [0170.711] CloseHandle (hObject=0x380) returned 1 [0170.711] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0 [0170.712] SetEvent (hEvent=0x2fc) returned 1 [0170.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.713] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1160) returned 1 [0170.713] CloseHandle (hObject=0x380) returned 1 [0170.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0170.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0170.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.714] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.714] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0170.715] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x488, lpOverlapped=0x0) returned 1 [0170.719] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x490, lpOverlapped=0x0) returned 1 [0170.720] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.720] CloseHandle (hObject=0x380) returned 1 [0170.720] CloseHandle (hObject=0x364) returned 1 [0170.720] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0 [0170.720] SetEvent (hEvent=0x2fc) returned 1 [0170.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.721] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2332) returned 1 [0170.721] CloseHandle (hObject=0x364) returned 1 [0170.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0170.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0170.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.722] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.722] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.723] ReadFile (in: hFile=0x364, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x91c, lpOverlapped=0x0) returned 1 [0170.724] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x920, lpOverlapped=0x0) returned 1 [0170.725] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.726] CloseHandle (hObject=0x364) returned 1 [0170.726] CloseHandle (hObject=0x380) returned 1 [0170.726] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0 [0170.726] SetEvent (hEvent=0x2fc) returned 1 [0170.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.727] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10316) returned 1 [0170.727] CloseHandle (hObject=0x380) returned 1 [0170.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0170.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0170.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0170.728] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.728] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0170.729] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x284c, lpOverlapped=0x0) returned 1 [0170.946] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2850, lpOverlapped=0x0) returned 1 [0170.947] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0170.947] CloseHandle (hObject=0x380) returned 1 [0170.948] CloseHandle (hObject=0x364) returned 1 [0170.948] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0 [0170.948] SetEvent (hEvent=0x2fc) returned 1 [0170.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.949] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3988) returned 1 [0170.949] CloseHandle (hObject=0x364) returned 1 [0170.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0170.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0170.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0170.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0170.950] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.951] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0170.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x380 [0170.952] ReadFile (in: hFile=0x364, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf94, lpOverlapped=0x0) returned 1 [0171.013] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfa0, lpOverlapped=0x0) returned 1 [0171.015] WriteFile (in: hFile=0x380, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.015] CloseHandle (hObject=0x364) returned 1 [0171.015] CloseHandle (hObject=0x380) returned 1 [0171.016] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0 [0171.016] SetEvent (hEvent=0x2fc) returned 1 [0171.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.179] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1648) returned 1 [0171.179] CloseHandle (hObject=0x380) returned 1 [0171.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0171.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0171.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0171.180] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.180] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x364 [0171.182] ReadFile (in: hFile=0x380, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x670, lpOverlapped=0x0) returned 1 [0171.202] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x680, lpOverlapped=0x0) returned 1 [0171.203] WriteFile (in: hFile=0x364, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.203] CloseHandle (hObject=0x380) returned 1 [0171.203] CloseHandle (hObject=0x364) returned 1 [0171.205] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0 [0171.205] SetEvent (hEvent=0x2fc) returned 1 [0171.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.407] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2472) returned 1 [0171.407] CloseHandle (hObject=0x39c) returned 1 [0171.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0171.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0171.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.408] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.408] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.409] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9a8, lpOverlapped=0x0) returned 1 [0171.411] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9b0, lpOverlapped=0x0) returned 1 [0171.412] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.412] CloseHandle (hObject=0x39c) returned 1 [0171.412] CloseHandle (hObject=0x36c) returned 1 [0171.412] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0 [0171.413] SetEvent (hEvent=0x2fc) returned 1 [0171.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.414] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3662) returned 1 [0171.414] CloseHandle (hObject=0x36c) returned 1 [0171.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0171.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0171.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.415] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.415] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.416] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe4e, lpOverlapped=0x0) returned 1 [0171.417] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe50, lpOverlapped=0x0) returned 1 [0171.418] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.418] CloseHandle (hObject=0x36c) returned 1 [0171.419] CloseHandle (hObject=0x39c) returned 1 [0171.419] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0 [0171.419] SetEvent (hEvent=0x2fc) returned 1 [0171.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.420] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3016) returned 1 [0171.420] CloseHandle (hObject=0x39c) returned 1 [0171.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0171.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0171.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.421] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.421] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0171.421] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbc8, lpOverlapped=0x0) returned 1 [0171.423] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbd0, lpOverlapped=0x0) returned 1 [0171.424] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.424] CloseHandle (hObject=0x39c) returned 1 [0171.424] CloseHandle (hObject=0x36c) returned 1 [0171.424] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0 [0171.425] SetEvent (hEvent=0x2fc) returned 1 [0171.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.425] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1528) returned 1 [0171.425] CloseHandle (hObject=0x36c) returned 1 [0171.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0171.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0171.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.426] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.426] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.427] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5f8, lpOverlapped=0x0) returned 1 [0171.429] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x600, lpOverlapped=0x0) returned 1 [0171.430] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.430] CloseHandle (hObject=0x36c) returned 1 [0171.430] CloseHandle (hObject=0x39c) returned 1 [0171.430] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0 [0171.430] SetEvent (hEvent=0x2fc) returned 1 [0171.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.431] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3298) returned 1 [0171.431] CloseHandle (hObject=0x39c) returned 1 [0171.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0171.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0171.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.432] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.432] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0171.587] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xce2, lpOverlapped=0x0) returned 1 [0171.589] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcf0, lpOverlapped=0x0) returned 1 [0171.590] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.590] CloseHandle (hObject=0x39c) returned 1 [0171.591] CloseHandle (hObject=0x344) returned 1 [0171.591] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0 [0171.591] SetEvent (hEvent=0x2fc) returned 1 [0171.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.592] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1468) returned 1 [0171.592] CloseHandle (hObject=0x344) returned 1 [0171.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0171.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0171.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.593] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.593] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.593] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5bc, lpOverlapped=0x0) returned 1 [0171.595] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5c0, lpOverlapped=0x0) returned 1 [0171.596] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.596] CloseHandle (hObject=0x344) returned 1 [0171.596] CloseHandle (hObject=0x39c) returned 1 [0171.597] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0 [0171.597] SetEvent (hEvent=0x2fc) returned 1 [0171.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.598] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1400) returned 1 [0171.598] CloseHandle (hObject=0x39c) returned 1 [0171.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0171.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0171.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.598] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.599] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0171.600] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x578, lpOverlapped=0x0) returned 1 [0171.601] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x580, lpOverlapped=0x0) returned 1 [0171.604] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.604] CloseHandle (hObject=0x39c) returned 1 [0171.604] CloseHandle (hObject=0x344) returned 1 [0171.604] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0 [0171.604] SetEvent (hEvent=0x2fc) returned 1 [0171.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.605] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12632) returned 1 [0171.605] CloseHandle (hObject=0x344) returned 1 [0171.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0171.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0171.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.606] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.606] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.607] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3158, lpOverlapped=0x0) returned 1 [0171.609] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3160, lpOverlapped=0x0) returned 1 [0171.610] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.611] CloseHandle (hObject=0x344) returned 1 [0171.611] CloseHandle (hObject=0x39c) returned 1 [0171.611] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0 [0171.611] SetEvent (hEvent=0x2fc) returned 1 [0171.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.612] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10644) returned 1 [0171.612] CloseHandle (hObject=0x39c) returned 1 [0171.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0171.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0171.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.613] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.613] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0171.613] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2994, lpOverlapped=0x0) returned 1 [0171.615] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x29a0, lpOverlapped=0x0) returned 1 [0171.619] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.619] CloseHandle (hObject=0x39c) returned 1 [0171.619] CloseHandle (hObject=0x344) returned 1 [0171.619] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0 [0171.619] SetEvent (hEvent=0x2fc) returned 1 [0171.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.620] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2116) returned 1 [0171.620] CloseHandle (hObject=0x344) returned 1 [0171.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0171.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0171.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0171.621] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.621] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.622] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x844, lpOverlapped=0x0) returned 1 [0171.623] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x850, lpOverlapped=0x0) returned 1 [0171.624] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.624] CloseHandle (hObject=0x344) returned 1 [0171.625] CloseHandle (hObject=0x39c) returned 1 [0171.625] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0 [0171.625] SetEvent (hEvent=0x2fc) returned 1 [0171.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.626] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1568) returned 1 [0171.626] CloseHandle (hObject=0x39c) returned 1 [0171.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0171.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0171.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.627] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.627] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0171.771] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x620, lpOverlapped=0x0) returned 1 [0171.773] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x630, lpOverlapped=0x0) returned 1 [0171.774] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.774] CloseHandle (hObject=0x39c) returned 1 [0171.774] CloseHandle (hObject=0x358) returned 1 [0171.774] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0 [0171.775] SetEvent (hEvent=0x2fc) returned 1 [0171.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.776] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11490) returned 1 [0171.776] CloseHandle (hObject=0x358) returned 1 [0171.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0171.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0171.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.777] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.777] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.778] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2ce2, lpOverlapped=0x0) returned 1 [0171.780] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2cf0, lpOverlapped=0x0) returned 1 [0171.781] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.781] CloseHandle (hObject=0x358) returned 1 [0171.782] CloseHandle (hObject=0x39c) returned 1 [0171.782] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0 [0171.782] SetEvent (hEvent=0x2fc) returned 1 [0171.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.783] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4032) returned 1 [0171.783] CloseHandle (hObject=0x39c) returned 1 [0171.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0171.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0171.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.784] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.784] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0171.784] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfc0, lpOverlapped=0x0) returned 1 [0171.786] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfd0, lpOverlapped=0x0) returned 1 [0171.787] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.788] CloseHandle (hObject=0x39c) returned 1 [0171.788] CloseHandle (hObject=0x358) returned 1 [0171.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0 [0171.788] SetEvent (hEvent=0x2fc) returned 1 [0171.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.789] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4340) returned 1 [0171.789] CloseHandle (hObject=0x358) returned 1 [0171.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0171.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0171.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.790] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.790] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.791] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x10f4, lpOverlapped=0x0) returned 1 [0171.792] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1100, lpOverlapped=0x0) returned 1 [0171.793] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.794] CloseHandle (hObject=0x358) returned 1 [0171.794] CloseHandle (hObject=0x39c) returned 1 [0171.794] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0 [0171.794] SetEvent (hEvent=0x2fc) returned 1 [0171.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.795] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7084) returned 1 [0171.795] CloseHandle (hObject=0x39c) returned 1 [0171.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0171.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0171.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.799] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.799] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0171.800] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1bac, lpOverlapped=0x0) returned 1 [0171.802] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1bb0, lpOverlapped=0x0) returned 1 [0171.805] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.805] CloseHandle (hObject=0x39c) returned 1 [0171.805] CloseHandle (hObject=0x358) returned 1 [0171.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0 [0171.805] SetEvent (hEvent=0x2fc) returned 1 [0171.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.806] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7098) returned 1 [0171.806] CloseHandle (hObject=0x358) returned 1 [0171.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0171.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0171.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.807] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.807] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.808] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1bba, lpOverlapped=0x0) returned 1 [0171.809] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1bc0, lpOverlapped=0x0) returned 1 [0171.811] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.811] CloseHandle (hObject=0x358) returned 1 [0171.811] CloseHandle (hObject=0x39c) returned 1 [0171.811] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0 [0171.812] SetEvent (hEvent=0x2fc) returned 1 [0171.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.940] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2848) returned 1 [0171.940] CloseHandle (hObject=0x39c) returned 1 [0171.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0171.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0171.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.964] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.964] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0171.965] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb20, lpOverlapped=0x0) returned 1 [0171.967] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb30, lpOverlapped=0x0) returned 1 [0171.968] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.968] CloseHandle (hObject=0x39c) returned 1 [0171.969] CloseHandle (hObject=0x358) returned 1 [0171.969] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0 [0171.969] SetEvent (hEvent=0x2fc) returned 1 [0171.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.970] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15806) returned 1 [0171.970] CloseHandle (hObject=0x358) returned 1 [0171.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0171.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0171.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.970] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.970] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.971] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3dbe, lpOverlapped=0x0) returned 1 [0171.973] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3dc0, lpOverlapped=0x0) returned 1 [0171.975] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.975] CloseHandle (hObject=0x358) returned 1 [0171.975] CloseHandle (hObject=0x39c) returned 1 [0171.975] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0 [0171.975] SetEvent (hEvent=0x2fc) returned 1 [0171.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.976] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6016) returned 1 [0171.976] CloseHandle (hObject=0x39c) returned 1 [0171.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0171.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0171.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.977] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.977] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0171.978] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1780, lpOverlapped=0x0) returned 1 [0171.980] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1790, lpOverlapped=0x0) returned 1 [0171.981] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.981] CloseHandle (hObject=0x39c) returned 1 [0171.981] CloseHandle (hObject=0x358) returned 1 [0171.981] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0 [0171.981] SetEvent (hEvent=0x2fc) returned 1 [0171.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.982] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5958) returned 1 [0171.982] CloseHandle (hObject=0x358) returned 1 [0171.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0171.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0171.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.983] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.983] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.984] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1746, lpOverlapped=0x0) returned 1 [0171.985] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1750, lpOverlapped=0x0) returned 1 [0171.986] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.987] CloseHandle (hObject=0x358) returned 1 [0171.987] CloseHandle (hObject=0x39c) returned 1 [0171.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0 [0171.987] SetEvent (hEvent=0x2fc) returned 1 [0171.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.988] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7296) returned 1 [0171.988] CloseHandle (hObject=0x39c) returned 1 [0171.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0171.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0171.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0171.989] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.989] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0171.990] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1c80, lpOverlapped=0x0) returned 1 [0171.991] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1c90, lpOverlapped=0x0) returned 1 [0171.993] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0171.993] CloseHandle (hObject=0x39c) returned 1 [0171.993] CloseHandle (hObject=0x358) returned 1 [0171.993] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0 [0171.993] SetEvent (hEvent=0x2fc) returned 1 [0171.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.995] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5414) returned 1 [0171.995] CloseHandle (hObject=0x358) returned 1 [0171.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0171.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0171.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0171.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0171.995] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.995] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0171.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0171.996] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1526, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1530, lpOverlapped=0x0) returned 1 [0172.000] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.000] CloseHandle (hObject=0x358) returned 1 [0172.000] CloseHandle (hObject=0x39c) returned 1 [0172.000] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0 [0172.000] SetEvent (hEvent=0x2fc) returned 1 [0172.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0172.001] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2616) returned 1 [0172.001] CloseHandle (hObject=0x39c) returned 1 [0172.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0172.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0172.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.206] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.206] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0172.207] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa38, lpOverlapped=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa40, lpOverlapped=0x0) returned 1 [0172.210] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.210] CloseHandle (hObject=0x36c) returned 1 [0172.210] CloseHandle (hObject=0x344) returned 1 [0172.210] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0 [0172.211] SetEvent (hEvent=0x2fc) returned 1 [0172.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.212] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5552) returned 1 [0172.212] CloseHandle (hObject=0x344) returned 1 [0172.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0172.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0172.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.212] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.212] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0172.213] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x15b0, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x15c0, lpOverlapped=0x0) returned 1 [0172.219] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.219] CloseHandle (hObject=0x344) returned 1 [0172.219] CloseHandle (hObject=0x36c) returned 1 [0172.219] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0 [0172.219] SetEvent (hEvent=0x2fc) returned 1 [0172.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.220] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4970) returned 1 [0172.220] CloseHandle (hObject=0x36c) returned 1 [0172.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0172.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0172.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.221] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0172.235] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x136a, lpOverlapped=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1370, lpOverlapped=0x0) returned 1 [0172.238] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.238] CloseHandle (hObject=0x36c) returned 1 [0172.238] CloseHandle (hObject=0x344) returned 1 [0172.238] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0 [0172.238] SetEvent (hEvent=0x2fc) returned 1 [0172.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.239] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3082) returned 1 [0172.239] CloseHandle (hObject=0x344) returned 1 [0172.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0172.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0172.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.240] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.240] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0172.240] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc0a, lpOverlapped=0x0) returned 1 [0172.242] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc10, lpOverlapped=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.243] CloseHandle (hObject=0x344) returned 1 [0172.243] CloseHandle (hObject=0x36c) returned 1 [0172.243] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0 [0172.244] SetEvent (hEvent=0x2fc) returned 1 [0172.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.244] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23300) returned 1 [0172.244] CloseHandle (hObject=0x36c) returned 1 [0172.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0172.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0172.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.245] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.245] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0172.246] ReadFile (in: hFile=0x36c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5b04, lpOverlapped=0x0) returned 1 [0172.248] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5b10, lpOverlapped=0x0) returned 1 [0172.250] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.250] CloseHandle (hObject=0x36c) returned 1 [0172.250] CloseHandle (hObject=0x344) returned 1 [0172.250] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0 [0172.250] SetEvent (hEvent=0x2fc) returned 1 [0172.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.251] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22116) returned 1 [0172.251] CloseHandle (hObject=0x344) returned 1 [0172.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0172.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0172.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0172.252] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.252] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x36c [0172.253] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5664, lpOverlapped=0x0) returned 1 [0172.255] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5670, lpOverlapped=0x0) returned 1 [0172.256] WriteFile (in: hFile=0x36c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.256] CloseHandle (hObject=0x344) returned 1 [0172.257] CloseHandle (hObject=0x36c) returned 1 [0172.257] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0 [0172.257] SetEvent (hEvent=0x2fc) returned 1 [0172.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.258] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15852) returned 1 [0172.258] CloseHandle (hObject=0x36c) returned 1 [0172.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0172.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0172.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0172.580] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.580] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x358 [0172.787] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3dec, lpOverlapped=0x0) returned 1 [0172.794] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3df0, lpOverlapped=0x0) returned 1 [0172.796] WriteFile (in: hFile=0x358, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.796] CloseHandle (hObject=0x360) returned 1 [0172.796] CloseHandle (hObject=0x358) returned 1 [0172.796] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0 [0172.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0172.797] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7178) returned 1 [0172.797] CloseHandle (hObject=0x358) returned 1 [0172.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0172.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0172.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0172.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0172.798] ReadFile (in: hFile=0x358, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1c0a, lpOverlapped=0x0) returned 1 [0172.807] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1c10, lpOverlapped=0x0) returned 1 [0172.808] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.808] CloseHandle (hObject=0x358) returned 1 [0172.808] CloseHandle (hObject=0x360) returned 1 [0172.808] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0 [0172.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0172.950] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=792) returned 1 [0172.950] CloseHandle (hObject=0x25c) returned 1 [0172.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0172.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0172.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0172.951] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.951] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0172.952] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x318, lpOverlapped=0x0) returned 1 [0172.982] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x320, lpOverlapped=0x0) returned 1 [0172.983] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.983] CloseHandle (hObject=0x25c) returned 1 [0172.984] CloseHandle (hObject=0x2ac) returned 1 [0172.984] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0 [0172.985] SetEvent (hEvent=0x2fc) returned 1 [0172.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0172.986] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1892) returned 1 [0172.986] CloseHandle (hObject=0x2ac) returned 1 [0172.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0172.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0172.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0172.987] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.987] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0172.988] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x764, lpOverlapped=0x0) returned 1 [0172.990] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x770, lpOverlapped=0x0) returned 1 [0172.991] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.991] CloseHandle (hObject=0x2ac) returned 1 [0172.991] CloseHandle (hObject=0x25c) returned 1 [0172.991] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0 [0172.992] SetEvent (hEvent=0x2fc) returned 1 [0172.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0172.993] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=696) returned 1 [0172.993] CloseHandle (hObject=0x25c) returned 1 [0172.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0172.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0172.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0172.994] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.994] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0172.995] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2b8, lpOverlapped=0x0) returned 1 [0172.996] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2c0, lpOverlapped=0x0) returned 1 [0172.997] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0172.997] CloseHandle (hObject=0x25c) returned 1 [0172.997] CloseHandle (hObject=0x2ac) returned 1 [0172.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0 [0172.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0172.998] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1928) returned 1 [0172.999] CloseHandle (hObject=0x2ac) returned 1 [0172.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0172.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0172.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0172.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0172.999] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.999] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0172.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0173.000] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x788, lpOverlapped=0x0) returned 1 [0173.002] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x790, lpOverlapped=0x0) returned 1 [0173.004] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.004] CloseHandle (hObject=0x2ac) returned 1 [0173.004] CloseHandle (hObject=0x25c) returned 1 [0173.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0 [0173.005] SetEvent (hEvent=0x2fc) returned 1 [0173.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.005] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9172) returned 1 [0173.005] CloseHandle (hObject=0x25c) returned 1 [0173.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0173.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0173.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.006] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.006] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0173.008] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x23d4, lpOverlapped=0x0) returned 1 [0173.009] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x23e0, lpOverlapped=0x0) returned 1 [0173.010] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.011] CloseHandle (hObject=0x25c) returned 1 [0173.011] CloseHandle (hObject=0x2ac) returned 1 [0173.011] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0 [0173.011] SetEvent (hEvent=0x2fc) returned 1 [0173.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.012] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12748) returned 1 [0173.013] CloseHandle (hObject=0x2ac) returned 1 [0173.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0173.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0173.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.013] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.013] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0173.014] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x31cc, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x31d0, lpOverlapped=0x0) returned 1 [0173.017] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.017] CloseHandle (hObject=0x2ac) returned 1 [0173.017] CloseHandle (hObject=0x25c) returned 1 [0173.018] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0 [0173.018] SetEvent (hEvent=0x2fc) returned 1 [0173.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.019] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6920) returned 1 [0173.019] CloseHandle (hObject=0x25c) returned 1 [0173.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0173.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0173.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0173.020] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.020] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0173.020] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b08, lpOverlapped=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b10, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.170] CloseHandle (hObject=0x25c) returned 1 [0173.171] CloseHandle (hObject=0x2ac) returned 1 [0173.171] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0 [0173.171] SetEvent (hEvent=0x2fc) returned 1 [0173.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.173] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17016) returned 1 [0173.173] CloseHandle (hObject=0x2ac) returned 1 [0173.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0173.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0173.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.174] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.174] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.292] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4278, lpOverlapped=0x0) returned 1 [0173.294] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4280, lpOverlapped=0x0) returned 1 [0173.296] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.296] CloseHandle (hObject=0x2ac) returned 1 [0173.296] CloseHandle (hObject=0x394) returned 1 [0173.296] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0 [0173.297] SetEvent (hEvent=0x2fc) returned 1 [0173.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.299] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21782) returned 1 [0173.299] CloseHandle (hObject=0x394) returned 1 [0173.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0173.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0173.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.300] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.300] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0173.301] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5516, lpOverlapped=0x0) returned 1 [0173.303] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5520, lpOverlapped=0x0) returned 1 [0173.304] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.304] CloseHandle (hObject=0x394) returned 1 [0173.304] CloseHandle (hObject=0x2ac) returned 1 [0173.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0 [0173.305] SetEvent (hEvent=0x2fc) returned 1 [0173.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.305] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35346) returned 1 [0173.305] CloseHandle (hObject=0x2ac) returned 1 [0173.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0173.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0173.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.306] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.306] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.307] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8a12, lpOverlapped=0x0) returned 1 [0173.309] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8a20, lpOverlapped=0x0) returned 1 [0173.311] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.311] CloseHandle (hObject=0x2ac) returned 1 [0173.311] CloseHandle (hObject=0x394) returned 1 [0173.311] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0 [0173.311] SetEvent (hEvent=0x2fc) returned 1 [0173.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.313] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33434) returned 1 [0173.313] CloseHandle (hObject=0x394) returned 1 [0173.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0173.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0173.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.313] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.314] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0173.315] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x829a, lpOverlapped=0x0) returned 1 [0173.318] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x82a0, lpOverlapped=0x0) returned 1 [0173.319] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.320] CloseHandle (hObject=0x394) returned 1 [0173.320] CloseHandle (hObject=0x2ac) returned 1 [0173.320] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0 [0173.320] SetEvent (hEvent=0x2fc) returned 1 [0173.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.321] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14174) returned 1 [0173.321] CloseHandle (hObject=0x2ac) returned 1 [0173.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0173.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0173.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.322] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.323] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x375e, lpOverlapped=0x0) returned 1 [0173.325] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3760, lpOverlapped=0x0) returned 1 [0173.326] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.326] CloseHandle (hObject=0x2ac) returned 1 [0173.327] CloseHandle (hObject=0x394) returned 1 [0173.327] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0 [0173.327] SetEvent (hEvent=0x2fc) returned 1 [0173.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.328] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19898) returned 1 [0173.328] CloseHandle (hObject=0x394) returned 1 [0173.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0173.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0173.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.329] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.329] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0173.542] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4dba, lpOverlapped=0x0) returned 1 [0173.551] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4dc0, lpOverlapped=0x0) returned 1 [0173.553] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.553] CloseHandle (hObject=0x394) returned 1 [0173.553] CloseHandle (hObject=0x2ac) returned 1 [0173.553] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0 [0173.554] SetEvent (hEvent=0x2fc) returned 1 [0173.554] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.555] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3332) returned 1 [0173.555] CloseHandle (hObject=0x2ac) returned 1 [0173.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0173.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0173.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.556] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.556] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.557] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd04, lpOverlapped=0x0) returned 1 [0173.568] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd10, lpOverlapped=0x0) returned 1 [0173.569] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.569] CloseHandle (hObject=0x2ac) returned 1 [0173.570] CloseHandle (hObject=0x394) returned 1 [0173.570] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0 [0173.570] SetEvent (hEvent=0x2fc) returned 1 [0173.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.571] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1456) returned 1 [0173.571] CloseHandle (hObject=0x394) returned 1 [0173.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0173.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0173.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x2ac [0173.573] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5b0, lpOverlapped=0x0) returned 1 [0173.576] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5c0, lpOverlapped=0x0) returned 1 [0173.577] WriteFile (in: hFile=0x2ac, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.577] CloseHandle (hObject=0x394) returned 1 [0173.577] CloseHandle (hObject=0x2ac) returned 1 [0173.577] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0 [0173.578] SetEvent (hEvent=0x2fc) returned 1 [0173.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.579] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5314) returned 1 [0173.579] CloseHandle (hObject=0x2ac) returned 1 [0173.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0173.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0173.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0173.580] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.580] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0173.586] ReadFile (in: hFile=0x2ac, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x14c2, lpOverlapped=0x0) returned 1 [0173.594] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x14d0, lpOverlapped=0x0) returned 1 [0173.596] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.596] CloseHandle (hObject=0x2ac) returned 1 [0173.596] CloseHandle (hObject=0x344) returned 1 [0173.596] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0 [0173.596] SetEvent (hEvent=0x2fc) returned 1 [0173.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0173.597] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6934) returned 1 [0173.597] CloseHandle (hObject=0x344) returned 1 [0173.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0173.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0173.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0173.598] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.598] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.601] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b16, lpOverlapped=0x0) returned 1 [0173.607] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b20, lpOverlapped=0x0) returned 1 [0173.608] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.608] CloseHandle (hObject=0x344) returned 1 [0173.610] CloseHandle (hObject=0x394) returned 1 [0173.611] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0 [0173.611] SetEvent (hEvent=0x2fc) returned 1 [0173.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.612] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42050) returned 1 [0173.612] CloseHandle (hObject=0x394) returned 1 [0173.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0173.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0173.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.613] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.613] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0173.751] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa442, lpOverlapped=0x0) returned 1 [0173.779] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa450, lpOverlapped=0x0) returned 1 [0173.781] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.781] CloseHandle (hObject=0x394) returned 1 [0173.781] CloseHandle (hObject=0x368) returned 1 [0173.781] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0 [0173.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0173.783] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=73214) returned 1 [0173.783] CloseHandle (hObject=0x368) returned 1 [0173.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0173.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0173.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0173.783] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.784] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.784] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x11dfe, lpOverlapped=0x0) returned 1 [0173.787] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x11e00, lpOverlapped=0x0) returned 1 [0173.789] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.789] CloseHandle (hObject=0x368) returned 1 [0173.790] CloseHandle (hObject=0x394) returned 1 [0173.790] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0 [0173.790] SetEvent (hEvent=0x2fc) returned 1 [0173.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.791] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21914) returned 1 [0173.791] CloseHandle (hObject=0x394) returned 1 [0173.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0173.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0173.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.792] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.792] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0173.794] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x559a, lpOverlapped=0x0) returned 1 [0173.796] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x55a0, lpOverlapped=0x0) returned 1 [0173.797] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.797] CloseHandle (hObject=0x394) returned 1 [0173.798] CloseHandle (hObject=0x368) returned 1 [0173.798] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0 [0173.798] SetEvent (hEvent=0x2fc) returned 1 [0173.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0173.799] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26086) returned 1 [0173.799] CloseHandle (hObject=0x368) returned 1 [0173.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0173.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0173.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0173.800] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.800] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.800] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x65e6, lpOverlapped=0x0) returned 1 [0173.803] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x65f0, lpOverlapped=0x0) returned 1 [0173.804] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.804] CloseHandle (hObject=0x368) returned 1 [0173.804] CloseHandle (hObject=0x394) returned 1 [0173.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0 [0173.805] SetEvent (hEvent=0x2fc) returned 1 [0173.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.806] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11694) returned 1 [0173.806] CloseHandle (hObject=0x394) returned 1 [0173.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0173.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0173.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0173.806] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.807] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0173.807] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2dae, lpOverlapped=0x0) returned 1 [0173.809] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2db0, lpOverlapped=0x0) returned 1 [0173.810] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0173.810] CloseHandle (hObject=0x394) returned 1 [0173.811] CloseHandle (hObject=0x368) returned 1 [0173.811] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0 [0173.811] SetEvent (hEvent=0x2fc) returned 1 [0173.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0173.812] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13874) returned 1 [0173.812] CloseHandle (hObject=0x368) returned 1 [0173.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0173.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0173.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0173.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0173.812] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.812] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0173.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0173.814] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3632, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3640, lpOverlapped=0x0) returned 1 [0174.031] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.031] CloseHandle (hObject=0x368) returned 1 [0174.031] CloseHandle (hObject=0x394) returned 1 [0174.031] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0 [0174.032] SetEvent (hEvent=0x2fc) returned 1 [0174.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.128] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8826) returned 1 [0174.128] CloseHandle (hObject=0x368) returned 1 [0174.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0174.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0174.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.129] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.129] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.130] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x227a, lpOverlapped=0x0) returned 1 [0174.152] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2280, lpOverlapped=0x0) returned 1 [0174.159] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.159] CloseHandle (hObject=0x368) returned 1 [0174.160] CloseHandle (hObject=0x398) returned 1 [0174.160] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0 [0174.160] SetEvent (hEvent=0x2fc) returned 1 [0174.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.161] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9671) returned 1 [0174.161] CloseHandle (hObject=0x398) returned 1 [0174.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0174.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0174.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.162] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.162] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.163] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x25c7, lpOverlapped=0x0) returned 1 [0174.174] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x25d0, lpOverlapped=0x0) returned 1 [0174.176] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.176] CloseHandle (hObject=0x398) returned 1 [0174.176] CloseHandle (hObject=0x368) returned 1 [0174.176] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0 [0174.176] SetEvent (hEvent=0x2fc) returned 1 [0174.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.177] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26160) returned 1 [0174.177] CloseHandle (hObject=0x368) returned 1 [0174.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0174.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0174.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.178] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.178] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0174.204] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6630, lpOverlapped=0x0) returned 1 [0174.241] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6640, lpOverlapped=0x0) returned 1 [0174.243] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.243] CloseHandle (hObject=0x368) returned 1 [0174.243] CloseHandle (hObject=0x360) returned 1 [0174.243] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0 [0174.244] SetEvent (hEvent=0x2fc) returned 1 [0174.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.245] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15145) returned 1 [0174.245] CloseHandle (hObject=0x360) returned 1 [0174.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0174.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0174.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.246] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.246] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.247] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3b29, lpOverlapped=0x0) returned 1 [0174.255] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3b30, lpOverlapped=0x0) returned 1 [0174.256] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.256] CloseHandle (hObject=0x360) returned 1 [0174.257] CloseHandle (hObject=0x368) returned 1 [0174.257] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0 [0174.257] SetEvent (hEvent=0x2fc) returned 1 [0174.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.258] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7154) returned 1 [0174.259] CloseHandle (hObject=0x368) returned 1 [0174.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0174.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0174.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.259] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.260] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0174.261] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1bf2, lpOverlapped=0x0) returned 1 [0174.263] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1c00, lpOverlapped=0x0) returned 1 [0174.264] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.264] CloseHandle (hObject=0x368) returned 1 [0174.264] CloseHandle (hObject=0x360) returned 1 [0174.264] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0 [0174.265] SetEvent (hEvent=0x2fc) returned 1 [0174.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.265] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19656) returned 1 [0174.265] CloseHandle (hObject=0x360) returned 1 [0174.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0174.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0174.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.266] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.266] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.267] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4cc8, lpOverlapped=0x0) returned 1 [0174.269] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4cd0, lpOverlapped=0x0) returned 1 [0174.271] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.271] CloseHandle (hObject=0x360) returned 1 [0174.271] CloseHandle (hObject=0x368) returned 1 [0174.271] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0 [0174.272] SetEvent (hEvent=0x2fc) returned 1 [0174.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.272] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22356) returned 1 [0174.272] CloseHandle (hObject=0x368) returned 1 [0174.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0174.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0174.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0174.273] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.273] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0174.274] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5754, lpOverlapped=0x0) returned 1 [0174.277] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5760, lpOverlapped=0x0) returned 1 [0174.279] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.279] CloseHandle (hObject=0x368) returned 1 [0174.279] CloseHandle (hObject=0x360) returned 1 [0174.279] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0 [0174.279] SetEvent (hEvent=0x2fc) returned 1 [0174.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.280] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21946) returned 1 [0174.280] CloseHandle (hObject=0x360) returned 1 [0174.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0174.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0174.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0174.281] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.281] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0174.282] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x55ba, lpOverlapped=0x0) returned 1 [0174.285] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x55c0, lpOverlapped=0x0) returned 1 [0174.286] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.286] CloseHandle (hObject=0x360) returned 1 [0174.286] CloseHandle (hObject=0x368) returned 1 [0174.286] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0 [0174.444] SetEvent (hEvent=0x2fc) returned 1 [0174.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.445] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10192) returned 1 [0174.445] CloseHandle (hObject=0x394) returned 1 [0174.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0174.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0174.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.446] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.446] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.447] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x27d0, lpOverlapped=0x0) returned 1 [0174.448] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x27e0, lpOverlapped=0x0) returned 1 [0174.450] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.450] CloseHandle (hObject=0x394) returned 1 [0174.450] CloseHandle (hObject=0x398) returned 1 [0174.450] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0 [0174.451] SetEvent (hEvent=0x2fc) returned 1 [0174.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.452] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24292) returned 1 [0174.452] CloseHandle (hObject=0x398) returned 1 [0174.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0174.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0174.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.453] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.453] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.454] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5ee4, lpOverlapped=0x0) returned 1 [0174.456] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5ef0, lpOverlapped=0x0) returned 1 [0174.457] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.457] CloseHandle (hObject=0x398) returned 1 [0174.458] CloseHandle (hObject=0x394) returned 1 [0174.458] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0 [0174.458] SetEvent (hEvent=0x2fc) returned 1 [0174.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.459] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8754) returned 1 [0174.459] CloseHandle (hObject=0x394) returned 1 [0174.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0174.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0174.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.459] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.460] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.461] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2232, lpOverlapped=0x0) returned 1 [0174.463] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2240, lpOverlapped=0x0) returned 1 [0174.464] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.464] CloseHandle (hObject=0x394) returned 1 [0174.464] CloseHandle (hObject=0x398) returned 1 [0174.464] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0 [0174.465] SetEvent (hEvent=0x2fc) returned 1 [0174.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.465] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=58258) returned 1 [0174.465] CloseHandle (hObject=0x398) returned 1 [0174.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0174.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0174.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.466] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.466] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0174.467] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe392, lpOverlapped=0x0) returned 1 [0174.470] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe3a0, lpOverlapped=0x0) returned 1 [0174.472] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.472] CloseHandle (hObject=0x398) returned 1 [0174.472] CloseHandle (hObject=0x394) returned 1 [0174.472] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0 [0174.472] SetEvent (hEvent=0x2fc) returned 1 [0174.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.473] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=37140) returned 1 [0174.473] CloseHandle (hObject=0x394) returned 1 [0174.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0174.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0174.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0174.474] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.474] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.475] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9114, lpOverlapped=0x0) returned 1 [0174.477] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9120, lpOverlapped=0x0) returned 1 [0174.479] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.479] CloseHandle (hObject=0x394) returned 1 [0174.479] CloseHandle (hObject=0x398) returned 1 [0174.480] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0 [0174.480] SetEvent (hEvent=0x2fc) returned 1 [0174.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.481] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6214) returned 1 [0174.481] CloseHandle (hObject=0x398) returned 1 [0174.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0174.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0174.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.481] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.718] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0174.719] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1846, lpOverlapped=0x0) returned 1 [0174.721] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1850, lpOverlapped=0x0) returned 1 [0174.722] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.722] CloseHandle (hObject=0x398) returned 1 [0174.722] CloseHandle (hObject=0x37c) returned 1 [0174.722] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0 [0174.723] SetEvent (hEvent=0x2fc) returned 1 [0174.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.724] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3394) returned 1 [0174.724] CloseHandle (hObject=0x37c) returned 1 [0174.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0174.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0174.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.724] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.725] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.725] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd42, lpOverlapped=0x0) returned 1 [0174.728] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd50, lpOverlapped=0x0) returned 1 [0174.729] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.729] CloseHandle (hObject=0x37c) returned 1 [0174.729] CloseHandle (hObject=0x398) returned 1 [0174.734] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0 [0174.734] SetEvent (hEvent=0x2fc) returned 1 [0174.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.735] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1198) returned 1 [0174.735] CloseHandle (hObject=0x398) returned 1 [0174.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0174.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0174.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.736] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.736] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0174.737] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ae, lpOverlapped=0x0) returned 1 [0174.739] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4b0, lpOverlapped=0x0) returned 1 [0174.740] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.740] CloseHandle (hObject=0x398) returned 1 [0174.740] CloseHandle (hObject=0x37c) returned 1 [0174.740] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0 [0174.740] SetEvent (hEvent=0x2fc) returned 1 [0174.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.741] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3840) returned 1 [0174.741] CloseHandle (hObject=0x37c) returned 1 [0174.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0174.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0174.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.742] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.742] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.743] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf00, lpOverlapped=0x0) returned 1 [0174.744] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf10, lpOverlapped=0x0) returned 1 [0174.746] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.746] CloseHandle (hObject=0x37c) returned 1 [0174.746] CloseHandle (hObject=0x398) returned 1 [0174.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0 [0174.746] SetEvent (hEvent=0x2fc) returned 1 [0174.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.747] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4946) returned 1 [0174.747] CloseHandle (hObject=0x398) returned 1 [0174.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0174.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0174.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.748] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.748] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0174.749] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1352, lpOverlapped=0x0) returned 1 [0174.750] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1360, lpOverlapped=0x0) returned 1 [0174.752] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.752] CloseHandle (hObject=0x398) returned 1 [0174.752] CloseHandle (hObject=0x37c) returned 1 [0174.752] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0 [0174.752] SetEvent (hEvent=0x2fc) returned 1 [0174.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.753] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4118) returned 1 [0174.753] CloseHandle (hObject=0x37c) returned 1 [0174.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0174.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0174.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.754] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.754] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.755] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1016, lpOverlapped=0x0) returned 1 [0174.941] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1020, lpOverlapped=0x0) returned 1 [0174.942] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.942] CloseHandle (hObject=0x37c) returned 1 [0174.943] CloseHandle (hObject=0x398) returned 1 [0174.943] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0 [0174.943] SetEvent (hEvent=0x2fc) returned 1 [0174.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.944] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8076) returned 1 [0174.944] CloseHandle (hObject=0x398) returned 1 [0174.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0174.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0174.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.945] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.945] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0174.947] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f8c, lpOverlapped=0x0) returned 1 [0174.948] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f90, lpOverlapped=0x0) returned 1 [0174.949] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.950] CloseHandle (hObject=0x398) returned 1 [0174.950] CloseHandle (hObject=0x37c) returned 1 [0174.950] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0 [0174.950] SetEvent (hEvent=0x2fc) returned 1 [0174.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.952] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=43892) returned 1 [0174.952] CloseHandle (hObject=0x37c) returned 1 [0174.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0174.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0174.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.953] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.953] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.954] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xab74, lpOverlapped=0x0) returned 1 [0174.956] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xab80, lpOverlapped=0x0) returned 1 [0174.958] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.958] CloseHandle (hObject=0x37c) returned 1 [0174.958] CloseHandle (hObject=0x398) returned 1 [0174.958] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0 [0174.959] SetEvent (hEvent=0x2fc) returned 1 [0174.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.959] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=62367) returned 1 [0174.959] CloseHandle (hObject=0x398) returned 1 [0174.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0174.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0174.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.960] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.960] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0174.961] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf39f, lpOverlapped=0x0) returned 1 [0174.963] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf3a0, lpOverlapped=0x0) returned 1 [0174.966] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.967] CloseHandle (hObject=0x398) returned 1 [0174.967] CloseHandle (hObject=0x37c) returned 1 [0174.967] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0 [0174.967] SetEvent (hEvent=0x2fc) returned 1 [0174.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.968] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17964) returned 1 [0174.968] CloseHandle (hObject=0x37c) returned 1 [0174.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0174.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0174.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0174.968] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.969] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0174.970] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x462c, lpOverlapped=0x0) returned 1 [0174.972] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4630, lpOverlapped=0x0) returned 1 [0174.973] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0174.973] CloseHandle (hObject=0x37c) returned 1 [0174.973] CloseHandle (hObject=0x398) returned 1 [0174.973] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0 [0174.974] SetEvent (hEvent=0x2fc) returned 1 [0174.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.974] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35546) returned 1 [0174.974] CloseHandle (hObject=0x398) returned 1 [0174.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0174.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0174.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0174.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0174.975] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.975] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0174.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0174.976] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8ada, lpOverlapped=0x0) returned 1 [0174.978] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8ae0, lpOverlapped=0x0) returned 1 [0175.199] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0175.200] CloseHandle (hObject=0x398) returned 1 [0175.200] CloseHandle (hObject=0x37c) returned 1 [0175.200] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0 [0175.200] SetEvent (hEvent=0x2fc) returned 1 [0175.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0175.604] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5259) returned 1 [0175.605] CloseHandle (hObject=0x394) returned 1 [0175.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0176.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0176.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.558] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.559] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0176.560] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x148b, lpOverlapped=0x0) returned 1 [0176.561] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1490, lpOverlapped=0x0) returned 1 [0176.563] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.563] CloseHandle (hObject=0x394) returned 1 [0176.563] CloseHandle (hObject=0x368) returned 1 [0176.563] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0 [0176.563] SetEvent (hEvent=0x2fc) returned 1 [0176.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.565] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17854) returned 1 [0176.565] CloseHandle (hObject=0x368) returned 1 [0176.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0176.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0176.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.565] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.566] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0176.567] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x45be, lpOverlapped=0x0) returned 1 [0176.569] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x45c0, lpOverlapped=0x0) returned 1 [0176.570] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.570] CloseHandle (hObject=0x368) returned 1 [0176.571] CloseHandle (hObject=0x394) returned 1 [0176.571] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0 [0176.571] SetEvent (hEvent=0x2fc) returned 1 [0176.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.572] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=78840) returned 1 [0176.572] CloseHandle (hObject=0x394) returned 1 [0176.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0176.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0176.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0176.573] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x133f8, lpOverlapped=0x0) returned 1 [0176.576] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13400, lpOverlapped=0x0) returned 1 [0176.579] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.579] CloseHandle (hObject=0x394) returned 1 [0176.579] CloseHandle (hObject=0x368) returned 1 [0176.579] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0 [0176.579] SetEvent (hEvent=0x2fc) returned 1 [0176.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.580] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32184) returned 1 [0176.580] CloseHandle (hObject=0x368) returned 1 [0176.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0176.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0176.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.581] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.581] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0176.582] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7db8, lpOverlapped=0x0) returned 1 [0176.584] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.586] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.586] CloseHandle (hObject=0x368) returned 1 [0176.586] CloseHandle (hObject=0x394) returned 1 [0176.586] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0 [0176.587] SetEvent (hEvent=0x2fc) returned 1 [0176.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.587] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32184) returned 1 [0176.588] CloseHandle (hObject=0x394) returned 1 [0176.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0176.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0176.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.588] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.588] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0176.590] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7db8, lpOverlapped=0x0) returned 1 [0176.592] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.593] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.593] CloseHandle (hObject=0x394) returned 1 [0176.593] CloseHandle (hObject=0x368) returned 1 [0176.593] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0 [0176.594] SetEvent (hEvent=0x2fc) returned 1 [0176.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.594] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31968) returned 1 [0176.594] CloseHandle (hObject=0x368) returned 1 [0176.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0176.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0176.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.595] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.595] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0176.596] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7ce0, lpOverlapped=0x0) returned 1 [0176.786] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7cf0, lpOverlapped=0x0) returned 1 [0176.787] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.788] CloseHandle (hObject=0x368) returned 1 [0176.788] CloseHandle (hObject=0x394) returned 1 [0176.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0 [0176.788] SetEvent (hEvent=0x2fc) returned 1 [0176.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.790] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32184) returned 1 [0176.790] CloseHandle (hObject=0x394) returned 1 [0176.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0176.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0176.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.791] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.791] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0176.792] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7db8, lpOverlapped=0x0) returned 1 [0176.806] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7dc0, lpOverlapped=0x0) returned 1 [0176.807] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.808] CloseHandle (hObject=0x394) returned 1 [0176.808] CloseHandle (hObject=0x368) returned 1 [0176.808] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0 [0176.808] SetEvent (hEvent=0x2fc) returned 1 [0176.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.809] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32616) returned 1 [0176.809] CloseHandle (hObject=0x368) returned 1 [0176.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0176.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0176.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.810] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.810] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0176.810] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7f68, lpOverlapped=0x0) returned 1 [0176.822] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7f70, lpOverlapped=0x0) returned 1 [0176.825] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.825] CloseHandle (hObject=0x368) returned 1 [0176.825] CloseHandle (hObject=0x394) returned 1 [0176.826] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0 [0176.826] SetEvent (hEvent=0x2fc) returned 1 [0176.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.827] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15988) returned 1 [0176.827] CloseHandle (hObject=0x394) returned 1 [0176.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0176.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0176.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0176.828] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.828] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0176.829] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3e74, lpOverlapped=0x0) returned 1 [0176.839] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3e80, lpOverlapped=0x0) returned 1 [0176.840] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.840] CloseHandle (hObject=0x394) returned 1 [0176.840] CloseHandle (hObject=0x368) returned 1 [0176.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0 [0176.841] SetEvent (hEvent=0x2fc) returned 1 [0176.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.841] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27000) returned 1 [0176.841] CloseHandle (hObject=0x368) returned 1 [0176.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0176.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0176.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0176.844] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.844] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0176.876] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6978, lpOverlapped=0x0) returned 1 [0176.882] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6980, lpOverlapped=0x0) returned 1 [0176.884] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0176.884] CloseHandle (hObject=0x368) returned 1 [0176.884] CloseHandle (hObject=0x37c) returned 1 [0176.884] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0 [0176.885] SetEvent (hEvent=0x2fc) returned 1 [0176.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.885] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17040) returned 1 [0176.885] CloseHandle (hObject=0x37c) returned 1 [0176.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0176.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0176.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0176.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0176.886] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.886] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0176.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0176.887] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4290, lpOverlapped=0x0) returned 1 [0176.890] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x42a0, lpOverlapped=0x0) returned 1 [0177.017] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.017] CloseHandle (hObject=0x37c) returned 1 [0177.018] CloseHandle (hObject=0x368) returned 1 [0177.018] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0 [0177.018] SetEvent (hEvent=0x2fc) returned 1 [0177.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.019] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17344) returned 1 [0177.019] CloseHandle (hObject=0x368) returned 1 [0177.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0177.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0177.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.020] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.020] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0177.021] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x43c0, lpOverlapped=0x0) returned 1 [0177.044] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x43d0, lpOverlapped=0x0) returned 1 [0177.045] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.045] CloseHandle (hObject=0x368) returned 1 [0177.046] CloseHandle (hObject=0x37c) returned 1 [0177.061] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0 [0177.061] SetEvent (hEvent=0x2fc) returned 1 [0177.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.125] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=44948) returned 1 [0177.125] CloseHandle (hObject=0x37c) returned 1 [0177.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0177.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0177.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0177.168] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.168] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0177.210] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xaf94, lpOverlapped=0x0) returned 1 [0177.213] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xafa0, lpOverlapped=0x0) returned 1 [0177.216] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.216] CloseHandle (hObject=0x37c) returned 1 [0177.216] CloseHandle (hObject=0x384) returned 1 [0177.216] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0 [0177.217] SetEvent (hEvent=0x2fc) returned 1 [0177.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0177.460] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11532) returned 1 [0177.460] CloseHandle (hObject=0x384) returned 1 [0177.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0177.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0177.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0177.461] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.461] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.461] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2d0c, lpOverlapped=0x0) returned 1 [0177.468] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2d10, lpOverlapped=0x0) returned 1 [0177.469] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.470] CloseHandle (hObject=0x384) returned 1 [0177.470] CloseHandle (hObject=0x368) returned 1 [0177.470] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0 [0177.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.474] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4628) returned 1 [0177.474] CloseHandle (hObject=0x394) returned 1 [0177.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0177.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0177.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.475] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.475] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.476] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1214, lpOverlapped=0x0) returned 1 [0177.477] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1220, lpOverlapped=0x0) returned 1 [0177.478] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.478] CloseHandle (hObject=0x394) returned 1 [0177.479] CloseHandle (hObject=0x370) returned 1 [0177.479] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0 [0177.480] SetEvent (hEvent=0x2fc) returned 1 [0177.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.481] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17728) returned 1 [0177.482] CloseHandle (hObject=0x370) returned 1 [0177.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0177.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0177.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.482] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.483] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.484] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4540, lpOverlapped=0x0) returned 1 [0177.486] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4550, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.487] CloseHandle (hObject=0x370) returned 1 [0177.488] CloseHandle (hObject=0x394) returned 1 [0177.488] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0 [0177.488] SetEvent (hEvent=0x2fc) returned 1 [0177.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.489] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19240) returned 1 [0177.489] CloseHandle (hObject=0x394) returned 1 [0177.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0177.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0177.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.489] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.489] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.490] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4b28, lpOverlapped=0x0) returned 1 [0177.492] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4b30, lpOverlapped=0x0) returned 1 [0177.493] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.493] CloseHandle (hObject=0x394) returned 1 [0177.494] CloseHandle (hObject=0x370) returned 1 [0177.494] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0 [0177.494] SetEvent (hEvent=0x2fc) returned 1 [0177.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.495] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11540) returned 1 [0177.495] CloseHandle (hObject=0x370) returned 1 [0177.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0177.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0177.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.496] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.496] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.496] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2d14, lpOverlapped=0x0) returned 1 [0177.498] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2d20, lpOverlapped=0x0) returned 1 [0177.500] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.500] CloseHandle (hObject=0x370) returned 1 [0177.500] CloseHandle (hObject=0x394) returned 1 [0177.500] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0 [0177.501] SetEvent (hEvent=0x2fc) returned 1 [0177.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.501] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4796) returned 1 [0177.501] CloseHandle (hObject=0x394) returned 1 [0177.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0177.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0177.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.502] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.502] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.503] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x12bc, lpOverlapped=0x0) returned 1 [0177.505] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x12c0, lpOverlapped=0x0) returned 1 [0177.506] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.506] CloseHandle (hObject=0x394) returned 1 [0177.506] CloseHandle (hObject=0x370) returned 1 [0177.506] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0 [0177.612] SetEvent (hEvent=0x2fc) returned 1 [0177.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.613] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5504) returned 1 [0177.613] CloseHandle (hObject=0x394) returned 1 [0177.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0177.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0177.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.614] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.614] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.615] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1580, lpOverlapped=0x0) returned 1 [0177.616] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1590, lpOverlapped=0x0) returned 1 [0177.617] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.617] CloseHandle (hObject=0x394) returned 1 [0177.618] CloseHandle (hObject=0x368) returned 1 [0177.618] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0 [0177.618] SetEvent (hEvent=0x2fc) returned 1 [0177.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.619] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6320) returned 1 [0177.619] CloseHandle (hObject=0x368) returned 1 [0177.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0177.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0177.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.620] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.620] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.621] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x18b0, lpOverlapped=0x0) returned 1 [0177.623] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x18c0, lpOverlapped=0x0) returned 1 [0177.624] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.624] CloseHandle (hObject=0x368) returned 1 [0177.625] CloseHandle (hObject=0x394) returned 1 [0177.625] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0 [0177.627] SetEvent (hEvent=0x2fc) returned 1 [0177.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.627] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4320) returned 1 [0177.627] CloseHandle (hObject=0x394) returned 1 [0177.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0177.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0177.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.628] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.628] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.629] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x10e0, lpOverlapped=0x0) returned 1 [0177.631] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x10f0, lpOverlapped=0x0) returned 1 [0177.632] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.632] CloseHandle (hObject=0x394) returned 1 [0177.632] CloseHandle (hObject=0x368) returned 1 [0177.632] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0 [0177.633] SetEvent (hEvent=0x2fc) returned 1 [0177.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.633] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2020) returned 1 [0177.633] CloseHandle (hObject=0x368) returned 1 [0177.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0177.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0177.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.634] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.634] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.635] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7e4, lpOverlapped=0x0) returned 1 [0177.637] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7f0, lpOverlapped=0x0) returned 1 [0177.638] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.641] CloseHandle (hObject=0x368) returned 1 [0177.641] CloseHandle (hObject=0x394) returned 1 [0177.667] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0 [0177.667] SetEvent (hEvent=0x2fc) returned 1 [0177.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.668] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7992) returned 1 [0177.668] CloseHandle (hObject=0x394) returned 1 [0177.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0177.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0177.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.680] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.680] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.682] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f38, lpOverlapped=0x0) returned 1 [0177.684] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f40, lpOverlapped=0x0) returned 1 [0177.685] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.685] CloseHandle (hObject=0x394) returned 1 [0177.685] CloseHandle (hObject=0x368) returned 1 [0177.685] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0 [0177.686] SetEvent (hEvent=0x2fc) returned 1 [0177.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.687] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10508) returned 1 [0177.687] CloseHandle (hObject=0x368) returned 1 [0177.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0177.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0177.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.688] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.688] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.689] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x290c, lpOverlapped=0x0) returned 1 [0177.691] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2910, lpOverlapped=0x0) returned 1 [0177.788] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.788] CloseHandle (hObject=0x368) returned 1 [0177.788] CloseHandle (hObject=0x394) returned 1 [0177.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0 [0177.788] SetEvent (hEvent=0x2fc) returned 1 [0177.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.792] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4964) returned 1 [0177.792] CloseHandle (hObject=0x394) returned 1 [0177.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0177.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0177.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.793] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.793] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.794] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1364, lpOverlapped=0x0) returned 1 [0177.796] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1370, lpOverlapped=0x0) returned 1 [0177.797] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.797] CloseHandle (hObject=0x394) returned 1 [0177.798] CloseHandle (hObject=0x368) returned 1 [0177.798] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0 [0177.798] SetEvent (hEvent=0x2fc) returned 1 [0177.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.799] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4964) returned 1 [0177.799] CloseHandle (hObject=0x368) returned 1 [0177.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0177.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0177.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.800] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.800] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.801] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1364, lpOverlapped=0x0) returned 1 [0177.803] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1370, lpOverlapped=0x0) returned 1 [0177.805] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.805] CloseHandle (hObject=0x368) returned 1 [0177.805] CloseHandle (hObject=0x394) returned 1 [0177.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0 [0177.806] SetEvent (hEvent=0x2fc) returned 1 [0177.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.807] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4624) returned 1 [0177.807] CloseHandle (hObject=0x394) returned 1 [0177.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0177.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0177.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.807] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.807] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.808] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1210, lpOverlapped=0x0) returned 1 [0177.810] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1220, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.812] CloseHandle (hObject=0x394) returned 1 [0177.812] CloseHandle (hObject=0x368) returned 1 [0177.812] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0 [0177.812] SetEvent (hEvent=0x2fc) returned 1 [0177.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.813] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5880) returned 1 [0177.813] CloseHandle (hObject=0x368) returned 1 [0177.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0177.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0177.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.814] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.814] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.815] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x16f8, lpOverlapped=0x0) returned 1 [0177.817] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1700, lpOverlapped=0x0) returned 1 [0177.818] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.818] CloseHandle (hObject=0x368) returned 1 [0177.818] CloseHandle (hObject=0x394) returned 1 [0177.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0 [0177.818] SetEvent (hEvent=0x2fc) returned 1 [0177.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.819] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5980) returned 1 [0177.819] CloseHandle (hObject=0x394) returned 1 [0177.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0177.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0177.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.820] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.820] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.821] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x175c, lpOverlapped=0x0) returned 1 [0177.823] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1760, lpOverlapped=0x0) returned 1 [0177.825] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.825] CloseHandle (hObject=0x394) returned 1 [0177.825] CloseHandle (hObject=0x368) returned 1 [0177.826] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0 [0177.826] SetEvent (hEvent=0x2fc) returned 1 [0177.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.827] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8252) returned 1 [0177.827] CloseHandle (hObject=0x368) returned 1 [0177.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0177.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0177.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.828] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.828] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.829] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x203c, lpOverlapped=0x0) returned 1 [0177.831] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2040, lpOverlapped=0x0) returned 1 [0177.896] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.896] CloseHandle (hObject=0x368) returned 1 [0177.896] CloseHandle (hObject=0x394) returned 1 [0177.896] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0 [0177.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.914] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11012) returned 1 [0177.914] CloseHandle (hObject=0x394) returned 1 [0177.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0177.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0177.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.915] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.915] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0177.916] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2b04, lpOverlapped=0x0) returned 1 [0177.918] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2b10, lpOverlapped=0x0) returned 1 [0177.919] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.919] CloseHandle (hObject=0x394) returned 1 [0177.919] CloseHandle (hObject=0x368) returned 1 [0177.919] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0 [0177.920] SetEvent (hEvent=0x2fc) returned 1 [0177.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.920] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3328) returned 1 [0177.920] CloseHandle (hObject=0x368) returned 1 [0177.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0177.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0177.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.922] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.922] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.922] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd00, lpOverlapped=0x0) returned 1 [0177.931] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd10, lpOverlapped=0x0) returned 1 [0177.933] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.933] CloseHandle (hObject=0x368) returned 1 [0177.933] CloseHandle (hObject=0x394) returned 1 [0177.933] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0 [0177.933] SetEvent (hEvent=0x2fc) returned 1 [0177.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.934] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20444) returned 1 [0177.934] CloseHandle (hObject=0x394) returned 1 [0177.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0177.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0177.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.935] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.935] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.939] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4fdc, lpOverlapped=0x0) returned 1 [0177.941] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4fe0, lpOverlapped=0x0) returned 1 [0177.949] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.949] CloseHandle (hObject=0x394) returned 1 [0177.950] CloseHandle (hObject=0x370) returned 1 [0177.950] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0 [0177.950] SetEvent (hEvent=0x2fc) returned 1 [0177.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.951] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6244) returned 1 [0177.951] CloseHandle (hObject=0x370) returned 1 [0177.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0177.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0177.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.953] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.953] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0177.953] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1864, lpOverlapped=0x0) returned 1 [0177.955] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1870, lpOverlapped=0x0) returned 1 [0177.956] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0177.956] CloseHandle (hObject=0x370) returned 1 [0177.957] CloseHandle (hObject=0x394) returned 1 [0177.957] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0 [0177.957] SetEvent (hEvent=0x2fc) returned 1 [0177.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.958] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18728) returned 1 [0177.958] CloseHandle (hObject=0x394) returned 1 [0177.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0177.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0177.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0177.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0177.959] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.959] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0177.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0177.960] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4928, lpOverlapped=0x0) returned 1 [0178.046] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4930, lpOverlapped=0x0) returned 1 [0178.047] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.047] CloseHandle (hObject=0x394) returned 1 [0178.048] CloseHandle (hObject=0x370) returned 1 [0178.048] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0 [0178.048] SetEvent (hEvent=0x2fc) returned 1 [0178.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.049] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31812) returned 1 [0178.049] CloseHandle (hObject=0x370) returned 1 [0178.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0178.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0178.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.050] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.050] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.051] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7c44, lpOverlapped=0x0) returned 1 [0178.053] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7c50, lpOverlapped=0x0) returned 1 [0178.055] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.056] CloseHandle (hObject=0x370) returned 1 [0178.056] CloseHandle (hObject=0x394) returned 1 [0178.056] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0 [0178.056] SetEvent (hEvent=0x2fc) returned 1 [0178.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.057] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17332) returned 1 [0178.057] CloseHandle (hObject=0x394) returned 1 [0178.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0178.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0178.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.057] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.064] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.065] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x43b4, lpOverlapped=0x0) returned 1 [0178.067] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x43c0, lpOverlapped=0x0) returned 1 [0178.069] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.069] CloseHandle (hObject=0x394) returned 1 [0178.070] CloseHandle (hObject=0x370) returned 1 [0178.070] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0 [0178.070] SetEvent (hEvent=0x2fc) returned 1 [0178.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.071] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7384) returned 1 [0178.071] CloseHandle (hObject=0x370) returned 1 [0178.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0178.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0178.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.072] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.072] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.072] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1cd8, lpOverlapped=0x0) returned 1 [0178.074] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ce0, lpOverlapped=0x0) returned 1 [0178.076] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.076] CloseHandle (hObject=0x370) returned 1 [0178.076] CloseHandle (hObject=0x394) returned 1 [0178.076] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0 [0178.077] SetEvent (hEvent=0x2fc) returned 1 [0178.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.078] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21548) returned 1 [0178.078] CloseHandle (hObject=0x394) returned 1 [0178.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0178.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0178.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.078] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.079] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.080] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x542c, lpOverlapped=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5430, lpOverlapped=0x0) returned 1 [0178.083] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.083] CloseHandle (hObject=0x394) returned 1 [0178.083] CloseHandle (hObject=0x370) returned 1 [0178.084] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0 [0178.084] SetEvent (hEvent=0x2fc) returned 1 [0178.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.085] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8680) returned 1 [0178.085] CloseHandle (hObject=0x370) returned 1 [0178.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0178.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0178.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.086] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.086] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.087] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x21e8, lpOverlapped=0x0) returned 1 [0178.088] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x21f0, lpOverlapped=0x0) returned 1 [0178.090] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.090] CloseHandle (hObject=0x370) returned 1 [0178.090] CloseHandle (hObject=0x394) returned 1 [0178.090] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0 [0178.090] SetEvent (hEvent=0x2fc) returned 1 [0178.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.091] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10364) returned 1 [0178.091] CloseHandle (hObject=0x394) returned 1 [0178.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0178.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0178.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.092] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.092] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.200] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x287c, lpOverlapped=0x0) returned 1 [0178.259] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2880, lpOverlapped=0x0) returned 1 [0178.261] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.261] CloseHandle (hObject=0x394) returned 1 [0178.261] CloseHandle (hObject=0x370) returned 1 [0178.261] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0 [0178.261] SetEvent (hEvent=0x2fc) returned 1 [0178.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.262] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23548) returned 1 [0178.262] CloseHandle (hObject=0x370) returned 1 [0178.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0178.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0178.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.263] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.263] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.264] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5bfc, lpOverlapped=0x0) returned 1 [0178.266] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5c00, lpOverlapped=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.268] CloseHandle (hObject=0x370) returned 1 [0178.269] CloseHandle (hObject=0x394) returned 1 [0178.269] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0 [0178.269] SetEvent (hEvent=0x2fc) returned 1 [0178.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.270] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11900) returned 1 [0178.270] CloseHandle (hObject=0x394) returned 1 [0178.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0178.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0178.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.271] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.271] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.272] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2e7c, lpOverlapped=0x0) returned 1 [0178.274] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2e80, lpOverlapped=0x0) returned 1 [0178.275] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.275] CloseHandle (hObject=0x394) returned 1 [0178.276] CloseHandle (hObject=0x370) returned 1 [0178.276] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0 [0178.276] SetEvent (hEvent=0x2fc) returned 1 [0178.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.277] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19600) returned 1 [0178.277] CloseHandle (hObject=0x370) returned 1 [0178.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0178.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0178.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.278] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.278] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.279] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4c90, lpOverlapped=0x0) returned 1 [0178.281] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4ca0, lpOverlapped=0x0) returned 1 [0178.282] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.282] CloseHandle (hObject=0x370) returned 1 [0178.283] CloseHandle (hObject=0x394) returned 1 [0178.283] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0 [0178.283] SetEvent (hEvent=0x2fc) returned 1 [0178.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.284] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2148) returned 1 [0178.284] CloseHandle (hObject=0x394) returned 1 [0178.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0178.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0178.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.285] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.285] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.291] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x864, lpOverlapped=0x0) returned 1 [0178.292] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x870, lpOverlapped=0x0) returned 1 [0178.293] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.293] CloseHandle (hObject=0x394) returned 1 [0178.293] CloseHandle (hObject=0x370) returned 1 [0178.294] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0 [0178.294] SetEvent (hEvent=0x2fc) returned 1 [0178.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.295] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3332) returned 1 [0178.295] CloseHandle (hObject=0x370) returned 1 [0178.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0178.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0178.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.296] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.296] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.297] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd04, lpOverlapped=0x0) returned 1 [0178.394] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd10, lpOverlapped=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.396] CloseHandle (hObject=0x370) returned 1 [0178.396] CloseHandle (hObject=0x394) returned 1 [0178.396] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0 [0178.396] SetEvent (hEvent=0x2fc) returned 1 [0178.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.397] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=48380) returned 1 [0178.397] CloseHandle (hObject=0x394) returned 1 [0178.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0178.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0178.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.398] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.398] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.399] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbcfc, lpOverlapped=0x0) returned 1 [0178.402] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbd00, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.404] CloseHandle (hObject=0x394) returned 1 [0178.405] CloseHandle (hObject=0x370) returned 1 [0178.405] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0 [0178.405] SetEvent (hEvent=0x2fc) returned 1 [0178.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.406] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=48388) returned 1 [0178.406] CloseHandle (hObject=0x370) returned 1 [0178.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0178.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0178.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.407] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.407] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.408] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbd04, lpOverlapped=0x0) returned 1 [0178.412] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbd10, lpOverlapped=0x0) returned 1 [0178.413] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.414] CloseHandle (hObject=0x370) returned 1 [0178.414] CloseHandle (hObject=0x394) returned 1 [0178.414] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0 [0178.414] SetEvent (hEvent=0x2fc) returned 1 [0178.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.415] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17200) returned 1 [0178.415] CloseHandle (hObject=0x394) returned 1 [0178.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0178.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0178.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.416] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.416] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.416] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4330, lpOverlapped=0x0) returned 1 [0178.418] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4340, lpOverlapped=0x0) returned 1 [0178.420] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.420] CloseHandle (hObject=0x394) returned 1 [0178.420] CloseHandle (hObject=0x370) returned 1 [0178.420] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0 [0178.421] SetEvent (hEvent=0x2fc) returned 1 [0178.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.422] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14996) returned 1 [0178.422] CloseHandle (hObject=0x370) returned 1 [0178.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0178.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0178.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.423] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.423] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.424] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3a94, lpOverlapped=0x0) returned 1 [0178.425] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3aa0, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.427] CloseHandle (hObject=0x370) returned 1 [0178.427] CloseHandle (hObject=0x394) returned 1 [0178.427] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0 [0178.427] SetEvent (hEvent=0x2fc) returned 1 [0178.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.428] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20136) returned 1 [0178.428] CloseHandle (hObject=0x394) returned 1 [0178.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0178.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0178.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.429] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.429] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0178.430] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ea8, lpOverlapped=0x0) returned 1 [0178.433] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4eb0, lpOverlapped=0x0) returned 1 [0178.434] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.434] CloseHandle (hObject=0x394) returned 1 [0178.495] CloseHandle (hObject=0x370) returned 1 [0178.510] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0 [0178.523] SetEvent (hEvent=0x2fc) returned 1 [0178.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.526] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16100) returned 1 [0178.526] CloseHandle (hObject=0x394) returned 1 [0178.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0178.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0178.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.527] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.527] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.527] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3ee4, lpOverlapped=0x0) returned 1 [0178.529] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3ef0, lpOverlapped=0x0) returned 1 [0178.531] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.531] CloseHandle (hObject=0x394) returned 1 [0178.531] CloseHandle (hObject=0x37c) returned 1 [0178.531] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0 [0178.532] SetEvent (hEvent=0x2fc) returned 1 [0178.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.532] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9968) returned 1 [0178.532] CloseHandle (hObject=0x37c) returned 1 [0178.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0178.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0178.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.535] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x26f0, lpOverlapped=0x0) returned 1 [0178.537] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2700, lpOverlapped=0x0) returned 1 [0178.538] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.538] CloseHandle (hObject=0x37c) returned 1 [0178.538] CloseHandle (hObject=0x394) returned 1 [0178.538] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0 [0178.539] SetEvent (hEvent=0x2fc) returned 1 [0178.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.540] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20212) returned 1 [0178.540] CloseHandle (hObject=0x394) returned 1 [0178.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0178.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0178.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.541] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.541] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.542] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ef4, lpOverlapped=0x0) returned 1 [0178.544] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f00, lpOverlapped=0x0) returned 1 [0178.546] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.546] CloseHandle (hObject=0x394) returned 1 [0178.546] CloseHandle (hObject=0x37c) returned 1 [0178.546] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0 [0178.546] SetEvent (hEvent=0x2fc) returned 1 [0178.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.547] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8552) returned 1 [0178.547] CloseHandle (hObject=0x37c) returned 1 [0178.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0178.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0178.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.548] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.549] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2168, lpOverlapped=0x0) returned 1 [0178.553] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2170, lpOverlapped=0x0) returned 1 [0178.554] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.554] CloseHandle (hObject=0x37c) returned 1 [0178.556] CloseHandle (hObject=0x394) returned 1 [0178.556] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0 [0178.556] SetEvent (hEvent=0x2fc) returned 1 [0178.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.557] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7996) returned 1 [0178.557] CloseHandle (hObject=0x394) returned 1 [0178.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0178.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0178.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.558] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.558] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.559] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f3c, lpOverlapped=0x0) returned 1 [0178.560] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f40, lpOverlapped=0x0) returned 1 [0178.562] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.562] CloseHandle (hObject=0x394) returned 1 [0178.563] CloseHandle (hObject=0x37c) returned 1 [0178.563] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0 [0178.563] SetEvent (hEvent=0x2fc) returned 1 [0178.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.564] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5272) returned 1 [0178.564] CloseHandle (hObject=0x37c) returned 1 [0178.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0178.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0178.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.565] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.565] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.690] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1498, lpOverlapped=0x0) returned 1 [0178.691] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x14a0, lpOverlapped=0x0) returned 1 [0178.693] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.693] CloseHandle (hObject=0x37c) returned 1 [0178.693] CloseHandle (hObject=0x394) returned 1 [0178.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0 [0178.694] SetEvent (hEvent=0x2fc) returned 1 [0178.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.695] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2460) returned 1 [0178.695] CloseHandle (hObject=0x394) returned 1 [0178.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0178.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0178.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.696] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.696] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.697] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x99c, lpOverlapped=0x0) returned 1 [0178.699] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9a0, lpOverlapped=0x0) returned 1 [0178.700] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.700] CloseHandle (hObject=0x394) returned 1 [0178.700] CloseHandle (hObject=0x37c) returned 1 [0178.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0 [0178.700] SetEvent (hEvent=0x2fc) returned 1 [0178.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.701] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4136) returned 1 [0178.702] CloseHandle (hObject=0x37c) returned 1 [0178.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0178.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0178.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.703] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.703] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.704] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1028, lpOverlapped=0x0) returned 1 [0178.706] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1030, lpOverlapped=0x0) returned 1 [0178.707] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.707] CloseHandle (hObject=0x37c) returned 1 [0178.708] CloseHandle (hObject=0x394) returned 1 [0178.708] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0 [0178.708] SetEvent (hEvent=0x2fc) returned 1 [0178.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.709] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15888) returned 1 [0178.709] CloseHandle (hObject=0x394) returned 1 [0178.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0178.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0178.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.710] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.710] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.711] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3e10, lpOverlapped=0x0) returned 1 [0178.713] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3e20, lpOverlapped=0x0) returned 1 [0178.715] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.715] CloseHandle (hObject=0x394) returned 1 [0178.715] CloseHandle (hObject=0x37c) returned 1 [0178.715] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0 [0178.715] SetEvent (hEvent=0x2fc) returned 1 [0178.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.717] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10852) returned 1 [0178.717] CloseHandle (hObject=0x37c) returned 1 [0178.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0178.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0178.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.717] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.718] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.718] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a64, lpOverlapped=0x0) returned 1 [0178.720] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a70, lpOverlapped=0x0) returned 1 [0178.721] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.722] CloseHandle (hObject=0x37c) returned 1 [0178.722] CloseHandle (hObject=0x394) returned 1 [0178.722] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0 [0178.722] SetEvent (hEvent=0x2fc) returned 1 [0178.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.724] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11288) returned 1 [0178.724] CloseHandle (hObject=0x394) returned 1 [0178.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0178.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0178.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.725] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.725] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.725] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2c18, lpOverlapped=0x0) returned 1 [0178.727] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2c20, lpOverlapped=0x0) returned 1 [0178.728] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.728] CloseHandle (hObject=0x394) returned 1 [0178.729] CloseHandle (hObject=0x37c) returned 1 [0178.729] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0 [0178.729] SetEvent (hEvent=0x2fc) returned 1 [0178.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.730] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6532) returned 1 [0178.730] CloseHandle (hObject=0x37c) returned 1 [0178.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0178.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0178.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.884] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1984, lpOverlapped=0x0) returned 1 [0178.886] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1990, lpOverlapped=0x0) returned 1 [0178.888] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.888] CloseHandle (hObject=0x37c) returned 1 [0178.888] CloseHandle (hObject=0x394) returned 1 [0178.888] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0 [0178.888] SetEvent (hEvent=0x2fc) returned 1 [0178.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.889] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5076) returned 1 [0178.889] CloseHandle (hObject=0x394) returned 1 [0178.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0178.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0178.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.890] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.890] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.891] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x13d4, lpOverlapped=0x0) returned 1 [0178.893] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13e0, lpOverlapped=0x0) returned 1 [0178.894] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.894] CloseHandle (hObject=0x394) returned 1 [0178.894] CloseHandle (hObject=0x37c) returned 1 [0178.895] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0 [0178.895] SetEvent (hEvent=0x2fc) returned 1 [0178.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.897] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23672) returned 1 [0178.897] CloseHandle (hObject=0x37c) returned 1 [0178.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0178.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0178.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.897] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.897] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.898] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5c78, lpOverlapped=0x0) returned 1 [0178.900] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5c80, lpOverlapped=0x0) returned 1 [0178.902] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.902] CloseHandle (hObject=0x37c) returned 1 [0178.902] CloseHandle (hObject=0x394) returned 1 [0178.902] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0 [0178.902] SetEvent (hEvent=0x2fc) returned 1 [0178.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.904] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7964) returned 1 [0178.904] CloseHandle (hObject=0x394) returned 1 [0178.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0178.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0178.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.904] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.905] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.906] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f1c, lpOverlapped=0x0) returned 1 [0178.908] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f20, lpOverlapped=0x0) returned 1 [0178.909] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.910] CloseHandle (hObject=0x394) returned 1 [0178.910] CloseHandle (hObject=0x37c) returned 1 [0178.910] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0 [0178.910] SetEvent (hEvent=0x2fc) returned 1 [0178.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.911] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16588) returned 1 [0178.911] CloseHandle (hObject=0x37c) returned 1 [0178.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0178.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0178.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0178.912] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.912] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0178.912] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x40cc, lpOverlapped=0x0) returned 1 [0178.914] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x40d0, lpOverlapped=0x0) returned 1 [0178.916] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.916] CloseHandle (hObject=0x37c) returned 1 [0178.916] CloseHandle (hObject=0x394) returned 1 [0178.917] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0 [0178.917] SetEvent (hEvent=0x2fc) returned 1 [0178.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.918] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11492) returned 1 [0178.918] CloseHandle (hObject=0x394) returned 1 [0178.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0178.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0178.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0178.919] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.919] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0178.920] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2ce4, lpOverlapped=0x0) returned 1 [0178.922] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2cf0, lpOverlapped=0x0) returned 1 [0178.973] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0178.974] CloseHandle (hObject=0x394) returned 1 [0178.974] CloseHandle (hObject=0x37c) returned 1 [0178.974] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0 [0178.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.986] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4920) returned 1 [0178.986] CloseHandle (hObject=0x368) returned 1 [0178.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0178.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0178.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0178.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0178.987] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.987] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0178.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0178.988] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1338, lpOverlapped=0x0) returned 1 [0178.999] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1340, lpOverlapped=0x0) returned 1 [0179.000] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.000] CloseHandle (hObject=0x368) returned 1 [0179.000] CloseHandle (hObject=0x384) returned 1 [0179.000] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0 [0179.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.063] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3724) returned 1 [0179.063] CloseHandle (hObject=0x39c) returned 1 [0179.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0179.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0179.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0179.064] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.064] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0179.065] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe8c, lpOverlapped=0x0) returned 1 [0179.247] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe90, lpOverlapped=0x0) returned 1 [0179.248] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.248] CloseHandle (hObject=0x39c) returned 1 [0179.248] CloseHandle (hObject=0x370) returned 1 [0179.260] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0 [0179.260] SetEvent (hEvent=0x2fc) returned 1 [0179.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0179.281] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4980) returned 1 [0179.287] CloseHandle (hObject=0x390) returned 1 [0179.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0179.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0179.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0179.288] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.288] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0179.289] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1374, lpOverlapped=0x0) returned 1 [0179.305] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1380, lpOverlapped=0x0) returned 1 [0179.306] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.306] CloseHandle (hObject=0x390) returned 1 [0179.307] CloseHandle (hObject=0x37c) returned 1 [0179.307] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0 [0179.307] SetEvent (hEvent=0x2fc) returned 1 [0179.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.328] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6860) returned 1 [0179.328] CloseHandle (hObject=0x360) returned 1 [0179.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0179.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0179.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.330] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.330] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.331] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1acc, lpOverlapped=0x0) returned 1 [0179.368] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ad0, lpOverlapped=0x0) returned 1 [0179.371] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.371] CloseHandle (hObject=0x360) returned 1 [0179.371] CloseHandle (hObject=0x384) returned 1 [0179.371] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0 [0179.372] SetEvent (hEvent=0x2fc) returned 1 [0179.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.373] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8864) returned 1 [0179.373] CloseHandle (hObject=0x384) returned 1 [0179.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0179.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0179.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.374] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.374] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0179.375] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x22a0, lpOverlapped=0x0) returned 1 [0179.390] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x22b0, lpOverlapped=0x0) returned 1 [0179.391] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.391] CloseHandle (hObject=0x384) returned 1 [0179.391] CloseHandle (hObject=0x360) returned 1 [0179.391] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0 [0179.392] SetEvent (hEvent=0x2fc) returned 1 [0179.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.392] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4200) returned 1 [0179.392] CloseHandle (hObject=0x360) returned 1 [0179.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0179.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0179.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0179.393] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.393] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x384 [0179.395] ReadFile (in: hFile=0x360, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1068, lpOverlapped=0x0) returned 1 [0179.415] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1070, lpOverlapped=0x0) returned 1 [0179.416] WriteFile (in: hFile=0x384, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.416] CloseHandle (hObject=0x360) returned 1 [0179.416] CloseHandle (hObject=0x384) returned 1 [0179.416] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0 [0179.417] SetEvent (hEvent=0x2fc) returned 1 [0179.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.417] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10836) returned 1 [0179.418] CloseHandle (hObject=0x384) returned 1 [0179.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0179.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0179.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.418] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.418] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0179.419] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a54, lpOverlapped=0x0) returned 1 [0179.466] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a60, lpOverlapped=0x0) returned 1 [0179.468] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.468] CloseHandle (hObject=0x384) returned 1 [0179.468] CloseHandle (hObject=0x360) returned 1 [0179.592] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0 [0179.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.595] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12204) returned 1 [0179.595] CloseHandle (hObject=0x384) returned 1 [0179.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0179.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0179.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0179.596] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.596] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0179.597] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2fac, lpOverlapped=0x0) returned 1 [0179.603] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2fb0, lpOverlapped=0x0) returned 1 [0179.604] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.604] CloseHandle (hObject=0x384) returned 1 [0179.605] CloseHandle (hObject=0x37c) returned 1 [0179.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0 [0179.605] SetEvent (hEvent=0x2fc) returned 1 [0179.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0179.610] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14008) returned 1 [0179.610] CloseHandle (hObject=0x390) returned 1 [0179.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0179.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0179.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0179.611] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.611] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0179.612] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x36b8, lpOverlapped=0x0) returned 1 [0179.616] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x36c0, lpOverlapped=0x0) returned 1 [0179.619] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.619] CloseHandle (hObject=0x390) returned 1 [0179.619] CloseHandle (hObject=0x370) returned 1 [0179.619] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0 [0179.619] SetEvent (hEvent=0x2fc) returned 1 [0179.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.659] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6792) returned 1 [0179.659] CloseHandle (hObject=0x370) returned 1 [0179.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0179.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0179.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0179.662] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.662] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0179.663] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1a88, lpOverlapped=0x0) returned 1 [0179.665] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1a90, lpOverlapped=0x0) returned 1 [0179.667] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.667] CloseHandle (hObject=0x370) returned 1 [0179.667] CloseHandle (hObject=0x37c) returned 1 [0179.667] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0 [0179.668] SetEvent (hEvent=0x2fc) returned 1 [0179.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.670] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26768) returned 1 [0179.670] CloseHandle (hObject=0x37c) returned 1 [0179.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0179.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0179.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0179.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0179.671] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0179.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0179.672] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6890, lpOverlapped=0x0) returned 1 [0179.674] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x68a0, lpOverlapped=0x0) returned 1 [0179.676] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0179.676] CloseHandle (hObject=0x37c) returned 1 [0179.677] CloseHandle (hObject=0x370) returned 1 [0179.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0 [0180.566] SetEvent (hEvent=0x2fc) returned 1 [0180.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.567] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8260) returned 1 [0180.567] CloseHandle (hObject=0x37c) returned 1 [0180.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0180.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0180.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.568] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.568] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0180.569] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2044, lpOverlapped=0x0) returned 1 [0180.571] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2050, lpOverlapped=0x0) returned 1 [0180.572] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.573] CloseHandle (hObject=0x37c) returned 1 [0180.573] CloseHandle (hObject=0x390) returned 1 [0180.573] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0 [0180.574] SetEvent (hEvent=0x2fc) returned 1 [0180.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.575] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7016) returned 1 [0180.575] CloseHandle (hObject=0x390) returned 1 [0180.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0180.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0180.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.577] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b68, lpOverlapped=0x0) returned 1 [0180.578] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b70, lpOverlapped=0x0) returned 1 [0180.579] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.579] CloseHandle (hObject=0x390) returned 1 [0180.580] CloseHandle (hObject=0x37c) returned 1 [0180.580] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0 [0180.580] SetEvent (hEvent=0x2fc) returned 1 [0180.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.581] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5492) returned 1 [0180.581] CloseHandle (hObject=0x37c) returned 1 [0180.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0180.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0180.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.582] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.582] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0180.584] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1574, lpOverlapped=0x0) returned 1 [0180.585] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1580, lpOverlapped=0x0) returned 1 [0180.586] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.587] CloseHandle (hObject=0x37c) returned 1 [0180.587] CloseHandle (hObject=0x390) returned 1 [0180.587] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0 [0180.587] SetEvent (hEvent=0x2fc) returned 1 [0180.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.588] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3060) returned 1 [0180.588] CloseHandle (hObject=0x390) returned 1 [0180.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0180.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0180.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.588] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.589] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.589] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbf4, lpOverlapped=0x0) returned 1 [0180.591] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc00, lpOverlapped=0x0) returned 1 [0180.592] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.592] CloseHandle (hObject=0x390) returned 1 [0180.592] CloseHandle (hObject=0x37c) returned 1 [0180.592] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0 [0180.593] SetEvent (hEvent=0x2fc) returned 1 [0180.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.593] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3140) returned 1 [0180.594] CloseHandle (hObject=0x37c) returned 1 [0180.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0180.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0180.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0180.595] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.595] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0180.596] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc44, lpOverlapped=0x0) returned 1 [0180.597] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc50, lpOverlapped=0x0) returned 1 [0180.598] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.598] CloseHandle (hObject=0x37c) returned 1 [0180.598] CloseHandle (hObject=0x390) returned 1 [0180.598] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0 [0180.599] SetEvent (hEvent=0x2fc) returned 1 [0180.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.599] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3644) returned 1 [0180.599] CloseHandle (hObject=0x390) returned 1 [0180.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0180.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0180.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.600] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.602] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe3c, lpOverlapped=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe40, lpOverlapped=0x0) returned 1 [0180.605] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.605] CloseHandle (hObject=0x390) returned 1 [0180.605] CloseHandle (hObject=0x37c) returned 1 [0180.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0 [0180.606] SetEvent (hEvent=0x2fc) returned 1 [0180.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.730] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5004) returned 1 [0180.730] CloseHandle (hObject=0x370) returned 1 [0180.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0180.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0180.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.731] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.731] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0180.732] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x138c, lpOverlapped=0x0) returned 1 [0180.737] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1390, lpOverlapped=0x0) returned 1 [0180.738] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.738] CloseHandle (hObject=0x370) returned 1 [0180.738] CloseHandle (hObject=0x37c) returned 1 [0180.738] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0 [0180.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.774] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=40231) returned 1 [0180.774] CloseHandle (hObject=0x398) returned 1 [0180.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0180.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0180.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0180.775] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.775] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0180.775] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9d27, lpOverlapped=0x0) returned 1 [0180.785] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9d30, lpOverlapped=0x0) returned 1 [0180.787] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.788] CloseHandle (hObject=0x398) returned 1 [0180.788] CloseHandle (hObject=0x390) returned 1 [0180.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0 [0180.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.789] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=49238) returned 1 [0180.789] CloseHandle (hObject=0x390) returned 1 [0180.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0180.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0180.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0180.790] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.790] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.812] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc056, lpOverlapped=0x0) returned 1 [0180.818] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc060, lpOverlapped=0x0) returned 1 [0180.820] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.820] CloseHandle (hObject=0x390) returned 1 [0180.820] CloseHandle (hObject=0x368) returned 1 [0180.820] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0 [0180.821] SetEvent (hEvent=0x2fc) returned 1 [0180.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.824] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17867) returned 1 [0180.825] CloseHandle (hObject=0x370) returned 1 [0180.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0180.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0180.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.826] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x45cb, lpOverlapped=0x0) returned 1 [0180.835] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x45d0, lpOverlapped=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.836] CloseHandle (hObject=0x370) returned 1 [0180.836] CloseHandle (hObject=0x368) returned 1 [0180.836] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0 [0180.837] SetEvent (hEvent=0x2fc) returned 1 [0180.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.837] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31850) returned 1 [0180.837] CloseHandle (hObject=0x368) returned 1 [0180.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0180.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0180.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.838] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.838] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0180.839] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7c6a, lpOverlapped=0x0) returned 1 [0180.843] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7c70, lpOverlapped=0x0) returned 1 [0180.844] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.844] CloseHandle (hObject=0x368) returned 1 [0180.844] CloseHandle (hObject=0x370) returned 1 [0180.845] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0 [0180.845] SetEvent (hEvent=0x2fc) returned 1 [0180.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.846] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=36820) returned 1 [0180.846] CloseHandle (hObject=0x370) returned 1 [0180.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0180.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0180.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.846] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.847] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.885] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8fd4, lpOverlapped=0x0) returned 1 [0180.943] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8fe0, lpOverlapped=0x0) returned 1 [0180.945] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.945] CloseHandle (hObject=0x370) returned 1 [0180.945] CloseHandle (hObject=0x368) returned 1 [0180.948] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0 [0180.949] SetEvent (hEvent=0x2fc) returned 1 [0180.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.952] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=39542) returned 1 [0180.952] CloseHandle (hObject=0x368) returned 1 [0180.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0180.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0180.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.953] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.953] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0180.960] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9a76, lpOverlapped=0x0) returned 1 [0180.966] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9a80, lpOverlapped=0x0) returned 1 [0180.967] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.967] CloseHandle (hObject=0x368) returned 1 [0180.968] CloseHandle (hObject=0x370) returned 1 [0180.968] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0 [0180.968] SetEvent (hEvent=0x2fc) returned 1 [0180.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.970] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=46508) returned 1 [0180.970] CloseHandle (hObject=0x370) returned 1 [0180.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0180.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0180.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0180.971] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.971] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0180.973] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb5ac, lpOverlapped=0x0) returned 1 [0180.975] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb5b0, lpOverlapped=0x0) returned 1 [0180.977] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0180.977] CloseHandle (hObject=0x370) returned 1 [0180.977] CloseHandle (hObject=0x368) returned 1 [0180.977] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0 [0180.978] SetEvent (hEvent=0x2fc) returned 1 [0180.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.979] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=43674) returned 1 [0180.979] CloseHandle (hObject=0x368) returned 1 [0180.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0180.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0180.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0180.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0180.980] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.980] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0180.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.070] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xaa9a, lpOverlapped=0x0) returned 1 [0181.072] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xaaa0, lpOverlapped=0x0) returned 1 [0181.075] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.075] CloseHandle (hObject=0x368) returned 1 [0181.075] CloseHandle (hObject=0x37c) returned 1 [0181.075] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0 [0181.076] SetEvent (hEvent=0x2fc) returned 1 [0181.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.079] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=67540) returned 1 [0181.079] CloseHandle (hObject=0x37c) returned 1 [0181.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0181.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0181.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.080] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.080] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.081] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x107d4, lpOverlapped=0x0) returned 1 [0181.084] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x107e0, lpOverlapped=0x0) returned 1 [0181.086] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.086] CloseHandle (hObject=0x37c) returned 1 [0181.086] CloseHandle (hObject=0x368) returned 1 [0181.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0 [0181.087] SetEvent (hEvent=0x2fc) returned 1 [0181.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.088] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=27393) returned 1 [0181.088] CloseHandle (hObject=0x368) returned 1 [0181.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0181.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0181.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.089] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.089] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.091] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6b01, lpOverlapped=0x0) returned 1 [0181.093] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6b10, lpOverlapped=0x0) returned 1 [0181.094] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.094] CloseHandle (hObject=0x368) returned 1 [0181.094] CloseHandle (hObject=0x37c) returned 1 [0181.095] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0 [0181.095] SetEvent (hEvent=0x2fc) returned 1 [0181.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.096] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=64802) returned 1 [0181.096] CloseHandle (hObject=0x37c) returned 1 [0181.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0181.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0181.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.097] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.097] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.098] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xfd22, lpOverlapped=0x0) returned 1 [0181.100] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xfd30, lpOverlapped=0x0) returned 1 [0181.115] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.115] CloseHandle (hObject=0x37c) returned 1 [0181.115] CloseHandle (hObject=0x368) returned 1 [0181.115] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0 [0181.116] SetEvent (hEvent=0x2fc) returned 1 [0181.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.117] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=46404) returned 1 [0181.117] CloseHandle (hObject=0x368) returned 1 [0181.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0181.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0181.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.118] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.118] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.204] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb544, lpOverlapped=0x0) returned 1 [0181.209] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb550, lpOverlapped=0x0) returned 1 [0181.211] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.211] CloseHandle (hObject=0x368) returned 1 [0181.212] CloseHandle (hObject=0x37c) returned 1 [0181.212] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0 [0181.212] SetEvent (hEvent=0x2fc) returned 1 [0181.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.213] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14632) returned 1 [0181.213] CloseHandle (hObject=0x37c) returned 1 [0181.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0181.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0181.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.214] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.214] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.216] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3928, lpOverlapped=0x0) returned 1 [0181.218] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3930, lpOverlapped=0x0) returned 1 [0181.219] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.219] CloseHandle (hObject=0x37c) returned 1 [0181.219] CloseHandle (hObject=0x368) returned 1 [0181.219] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0 [0181.220] SetEvent (hEvent=0x2fc) returned 1 [0181.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.221] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6752) returned 1 [0181.221] CloseHandle (hObject=0x368) returned 1 [0181.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0181.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0181.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.243] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.244] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.245] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1a60, lpOverlapped=0x0) returned 1 [0181.246] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1a70, lpOverlapped=0x0) returned 1 [0181.248] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.248] CloseHandle (hObject=0x368) returned 1 [0181.248] CloseHandle (hObject=0x37c) returned 1 [0181.248] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0 [0181.248] SetEvent (hEvent=0x2fc) returned 1 [0181.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.249] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10632) returned 1 [0181.249] CloseHandle (hObject=0x37c) returned 1 [0181.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0181.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0181.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.250] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.250] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.251] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2988, lpOverlapped=0x0) returned 1 [0181.253] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2990, lpOverlapped=0x0) returned 1 [0181.254] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.255] CloseHandle (hObject=0x37c) returned 1 [0181.255] CloseHandle (hObject=0x368) returned 1 [0181.255] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0 [0181.255] SetEvent (hEvent=0x2fc) returned 1 [0181.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.256] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13204) returned 1 [0181.256] CloseHandle (hObject=0x368) returned 1 [0181.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0181.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0181.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.257] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.257] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.258] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3394, lpOverlapped=0x0) returned 1 [0181.260] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x33a0, lpOverlapped=0x0) returned 1 [0181.261] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.261] CloseHandle (hObject=0x368) returned 1 [0181.261] CloseHandle (hObject=0x37c) returned 1 [0181.262] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0 [0181.262] SetEvent (hEvent=0x2fc) returned 1 [0181.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.263] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13336) returned 1 [0181.263] CloseHandle (hObject=0x37c) returned 1 [0181.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0181.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0181.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.263] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.264] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.511] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3418, lpOverlapped=0x0) returned 1 [0181.517] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3420, lpOverlapped=0x0) returned 1 [0181.519] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.519] CloseHandle (hObject=0x37c) returned 1 [0181.519] CloseHandle (hObject=0x344) returned 1 [0181.519] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0 [0181.520] SetEvent (hEvent=0x2fc) returned 1 [0181.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.521] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10752) returned 1 [0181.521] CloseHandle (hObject=0x344) returned 1 [0181.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0181.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0181.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.522] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.522] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.522] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a00, lpOverlapped=0x0) returned 1 [0181.525] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a10, lpOverlapped=0x0) returned 1 [0181.527] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.527] CloseHandle (hObject=0x344) returned 1 [0181.527] CloseHandle (hObject=0x37c) returned 1 [0181.527] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0 [0181.527] SetEvent (hEvent=0x2fc) returned 1 [0181.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.528] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24844) returned 1 [0181.528] CloseHandle (hObject=0x37c) returned 1 [0181.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0181.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0181.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.529] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.529] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.530] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x610c, lpOverlapped=0x0) returned 1 [0181.550] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6110, lpOverlapped=0x0) returned 1 [0181.552] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.552] CloseHandle (hObject=0x37c) returned 1 [0181.552] CloseHandle (hObject=0x344) returned 1 [0181.553] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0 [0181.553] SetEvent (hEvent=0x2fc) returned 1 [0181.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.554] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14132) returned 1 [0181.555] CloseHandle (hObject=0x344) returned 1 [0181.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0181.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0181.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.555] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.555] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.557] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3734, lpOverlapped=0x0) returned 1 [0181.558] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3740, lpOverlapped=0x0) returned 1 [0181.560] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.560] CloseHandle (hObject=0x344) returned 1 [0181.560] CloseHandle (hObject=0x37c) returned 1 [0181.560] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0 [0181.560] SetEvent (hEvent=0x2fc) returned 1 [0181.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.561] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16492) returned 1 [0181.561] CloseHandle (hObject=0x37c) returned 1 [0181.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0181.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0181.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.562] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.562] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.563] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x406c, lpOverlapped=0x0) returned 1 [0181.565] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4070, lpOverlapped=0x0) returned 1 [0181.566] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.567] CloseHandle (hObject=0x37c) returned 1 [0181.567] CloseHandle (hObject=0x344) returned 1 [0181.567] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0 [0181.567] SetEvent (hEvent=0x2fc) returned 1 [0181.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.568] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11340) returned 1 [0181.568] CloseHandle (hObject=0x344) returned 1 [0181.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0181.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0181.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.569] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.569] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.588] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2c4c, lpOverlapped=0x0) returned 1 [0181.593] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2c50, lpOverlapped=0x0) returned 1 [0181.595] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.595] CloseHandle (hObject=0x344) returned 1 [0181.595] CloseHandle (hObject=0x368) returned 1 [0181.596] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0 [0181.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.680] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10880) returned 1 [0181.680] CloseHandle (hObject=0x370) returned 1 [0181.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0181.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0181.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.681] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.681] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.682] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a80, lpOverlapped=0x0) returned 1 [0181.684] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a90, lpOverlapped=0x0) returned 1 [0181.685] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.686] CloseHandle (hObject=0x370) returned 1 [0181.686] CloseHandle (hObject=0x37c) returned 1 [0181.686] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0 [0181.686] SetEvent (hEvent=0x2fc) returned 1 [0181.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.688] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9768) returned 1 [0181.688] CloseHandle (hObject=0x37c) returned 1 [0181.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0181.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0181.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.689] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.689] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0181.690] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2628, lpOverlapped=0x0) returned 1 [0181.692] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2630, lpOverlapped=0x0) returned 1 [0181.693] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.694] CloseHandle (hObject=0x37c) returned 1 [0181.694] CloseHandle (hObject=0x370) returned 1 [0181.694] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0 [0181.694] SetEvent (hEvent=0x2fc) returned 1 [0181.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.699] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6276) returned 1 [0181.700] CloseHandle (hObject=0x370) returned 1 [0181.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0181.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0181.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.700] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.700] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.701] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1884, lpOverlapped=0x0) returned 1 [0181.703] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1890, lpOverlapped=0x0) returned 1 [0181.704] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.704] CloseHandle (hObject=0x370) returned 1 [0181.704] CloseHandle (hObject=0x37c) returned 1 [0181.704] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0 [0181.705] SetEvent (hEvent=0x2fc) returned 1 [0181.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.706] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16632) returned 1 [0181.706] CloseHandle (hObject=0x37c) returned 1 [0181.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0181.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0181.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.707] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.707] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0181.708] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x40f8, lpOverlapped=0x0) returned 1 [0181.709] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4100, lpOverlapped=0x0) returned 1 [0181.711] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.711] CloseHandle (hObject=0x37c) returned 1 [0181.711] CloseHandle (hObject=0x370) returned 1 [0181.711] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0 [0181.711] SetEvent (hEvent=0x2fc) returned 1 [0181.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.712] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12436) returned 1 [0181.712] CloseHandle (hObject=0x370) returned 1 [0181.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0181.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0181.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.799] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.799] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0181.803] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3094, lpOverlapped=0x0) returned 1 [0181.805] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x30a0, lpOverlapped=0x0) returned 1 [0181.806] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.806] CloseHandle (hObject=0x37c) returned 1 [0181.806] CloseHandle (hObject=0x398) returned 1 [0181.806] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0 [0181.807] SetEvent (hEvent=0x2fc) returned 1 [0181.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0181.808] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1268) returned 1 [0181.808] CloseHandle (hObject=0x398) returned 1 [0181.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0181.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0181.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0181.809] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.809] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.810] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4f4, lpOverlapped=0x0) returned 1 [0181.812] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x500, lpOverlapped=0x0) returned 1 [0181.813] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.813] CloseHandle (hObject=0x398) returned 1 [0181.813] CloseHandle (hObject=0x37c) returned 1 [0181.813] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0 [0181.814] SetEvent (hEvent=0x2fc) returned 1 [0181.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.816] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1348) returned 1 [0181.816] CloseHandle (hObject=0x37c) returned 1 [0181.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0181.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0181.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.816] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.816] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0181.817] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x544, lpOverlapped=0x0) returned 1 [0181.819] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x550, lpOverlapped=0x0) returned 1 [0181.820] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.820] CloseHandle (hObject=0x37c) returned 1 [0181.820] CloseHandle (hObject=0x398) returned 1 [0181.820] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0 [0181.821] SetEvent (hEvent=0x2fc) returned 1 [0181.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0181.821] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7320) returned 1 [0181.821] CloseHandle (hObject=0x398) returned 1 [0181.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0181.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0181.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0181.822] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.822] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0181.823] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1c98, lpOverlapped=0x0) returned 1 [0181.825] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ca0, lpOverlapped=0x0) returned 1 [0181.827] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.827] CloseHandle (hObject=0x398) returned 1 [0181.827] CloseHandle (hObject=0x37c) returned 1 [0181.833] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0 [0181.834] SetEvent (hEvent=0x2fc) returned 1 [0181.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.835] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1208) returned 1 [0181.835] CloseHandle (hObject=0x37c) returned 1 [0181.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0181.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0181.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0181.836] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.836] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0181.837] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4b8, lpOverlapped=0x0) returned 1 [0181.839] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4c0, lpOverlapped=0x0) returned 1 [0181.840] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.840] CloseHandle (hObject=0x37c) returned 1 [0181.841] CloseHandle (hObject=0x398) returned 1 [0181.841] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0 [0181.935] SetEvent (hEvent=0x2fc) returned 1 [0181.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.958] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14888) returned 1 [0181.959] CloseHandle (hObject=0x344) returned 1 [0181.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0181.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0181.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.959] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.960] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.961] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3a28, lpOverlapped=0x0) returned 1 [0181.964] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3a30, lpOverlapped=0x0) returned 1 [0181.965] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.966] CloseHandle (hObject=0x344) returned 1 [0181.966] CloseHandle (hObject=0x368) returned 1 [0181.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0 [0181.966] SetEvent (hEvent=0x2fc) returned 1 [0181.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.968] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9072) returned 1 [0181.968] CloseHandle (hObject=0x368) returned 1 [0181.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0181.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0181.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.968] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.968] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.969] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2370, lpOverlapped=0x0) returned 1 [0181.972] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2380, lpOverlapped=0x0) returned 1 [0181.973] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.974] CloseHandle (hObject=0x368) returned 1 [0181.974] CloseHandle (hObject=0x344) returned 1 [0181.974] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0 [0181.974] SetEvent (hEvent=0x2fc) returned 1 [0181.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.975] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6956) returned 1 [0181.975] CloseHandle (hObject=0x344) returned 1 [0181.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220 [0181.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220 [0181.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.976] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.976] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.977] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b2c, lpOverlapped=0x0) returned 1 [0181.979] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b30, lpOverlapped=0x0) returned 1 [0181.980] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.980] CloseHandle (hObject=0x344) returned 1 [0181.980] CloseHandle (hObject=0x368) returned 1 [0181.980] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0 [0181.981] SetEvent (hEvent=0x2fc) returned 1 [0181.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.981] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1940) returned 1 [0181.981] CloseHandle (hObject=0x368) returned 1 [0181.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220 [0181.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220 [0181.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.982] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.982] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0181.984] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x794, lpOverlapped=0x0) returned 1 [0181.985] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7a0, lpOverlapped=0x0) returned 1 [0181.986] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.986] CloseHandle (hObject=0x368) returned 1 [0181.987] CloseHandle (hObject=0x344) returned 1 [0181.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0 [0181.987] SetEvent (hEvent=0x2fc) returned 1 [0181.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.989] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10668) returned 1 [0181.989] CloseHandle (hObject=0x344) returned 1 [0181.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220 [0181.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220 [0181.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.989] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.989] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0181.990] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x29ac, lpOverlapped=0x0) returned 1 [0181.992] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x29b0, lpOverlapped=0x0) returned 1 [0181.993] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0181.994] CloseHandle (hObject=0x344) returned 1 [0181.994] CloseHandle (hObject=0x368) returned 1 [0181.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0 [0181.994] SetEvent (hEvent=0x2fc) returned 1 [0181.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.995] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11348) returned 1 [0181.995] CloseHandle (hObject=0x368) returned 1 [0181.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220 [0181.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220 [0181.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0181.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0181.996] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.996] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0181.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.092] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2c54, lpOverlapped=0x0) returned 1 [0182.094] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2c60, lpOverlapped=0x0) returned 1 [0182.095] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.095] CloseHandle (hObject=0x368) returned 1 [0182.095] CloseHandle (hObject=0x344) returned 1 [0182.096] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0 [0182.096] SetEvent (hEvent=0x2fc) returned 1 [0182.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.097] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8880) returned 1 [0182.097] CloseHandle (hObject=0x344) returned 1 [0182.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220 [0182.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220 [0182.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.098] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.098] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.099] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x22b0, lpOverlapped=0x0) returned 1 [0182.101] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x22c0, lpOverlapped=0x0) returned 1 [0182.102] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.102] CloseHandle (hObject=0x344) returned 1 [0182.102] CloseHandle (hObject=0x368) returned 1 [0182.103] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0 [0182.113] SetEvent (hEvent=0x2fc) returned 1 [0182.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.114] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3704) returned 1 [0182.114] CloseHandle (hObject=0x368) returned 1 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.115] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.115] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.116] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe78, lpOverlapped=0x0) returned 1 [0182.117] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe80, lpOverlapped=0x0) returned 1 [0182.119] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.119] CloseHandle (hObject=0x368) returned 1 [0182.119] CloseHandle (hObject=0x344) returned 1 [0182.119] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0 [0182.119] SetEvent (hEvent=0x2fc) returned 1 [0182.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.121] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3008) returned 1 [0182.121] CloseHandle (hObject=0x344) returned 1 [0182.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220 [0182.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220 [0182.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.121] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.121] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.122] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbc0, lpOverlapped=0x0) returned 1 [0182.124] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbd0, lpOverlapped=0x0) returned 1 [0182.125] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.125] CloseHandle (hObject=0x344) returned 1 [0182.125] CloseHandle (hObject=0x368) returned 1 [0182.125] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0 [0182.126] SetEvent (hEvent=0x2fc) returned 1 [0182.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.128] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20096) returned 1 [0182.128] CloseHandle (hObject=0x368) returned 1 [0182.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0x220 [0182.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0x220 [0182.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.129] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.258] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.259] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4e80, lpOverlapped=0x0) returned 1 [0182.263] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4e90, lpOverlapped=0x0) returned 1 [0182.264] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.264] CloseHandle (hObject=0x368) returned 1 [0182.264] CloseHandle (hObject=0x344) returned 1 [0182.264] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0 [0182.265] SetEvent (hEvent=0x2fc) returned 1 [0182.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.266] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17508) returned 1 [0182.266] CloseHandle (hObject=0x344) returned 1 [0182.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220 [0182.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220 [0182.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.267] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.267] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.268] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4464, lpOverlapped=0x0) returned 1 [0182.270] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4470, lpOverlapped=0x0) returned 1 [0182.271] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.271] CloseHandle (hObject=0x344) returned 1 [0182.271] CloseHandle (hObject=0x368) returned 1 [0182.271] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0 [0182.272] SetEvent (hEvent=0x2fc) returned 1 [0182.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.273] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=34256) returned 1 [0182.273] CloseHandle (hObject=0x368) returned 1 [0182.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220 [0182.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220 [0182.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.274] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.274] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.275] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x85d0, lpOverlapped=0x0) returned 1 [0182.277] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x85e0, lpOverlapped=0x0) returned 1 [0182.279] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.279] CloseHandle (hObject=0x368) returned 1 [0182.279] CloseHandle (hObject=0x344) returned 1 [0182.279] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0 [0182.279] SetEvent (hEvent=0x2fc) returned 1 [0182.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.280] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12752) returned 1 [0182.280] CloseHandle (hObject=0x344) returned 1 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0x220 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0x220 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.286] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.286] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.288] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x31d0, lpOverlapped=0x0) returned 1 [0182.290] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x31e0, lpOverlapped=0x0) returned 1 [0182.291] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.291] CloseHandle (hObject=0x344) returned 1 [0182.291] CloseHandle (hObject=0x368) returned 1 [0182.291] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0 [0182.292] SetEvent (hEvent=0x2fc) returned 1 [0182.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.295] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7432) returned 1 [0182.295] CloseHandle (hObject=0x368) returned 1 [0182.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220 [0182.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220 [0182.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.295] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.296] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.296] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1d08, lpOverlapped=0x0) returned 1 [0182.298] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1d10, lpOverlapped=0x0) returned 1 [0182.299] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.300] CloseHandle (hObject=0x368) returned 1 [0182.300] CloseHandle (hObject=0x344) returned 1 [0182.300] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0 [0182.300] SetEvent (hEvent=0x2fc) returned 1 [0182.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.301] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12528) returned 1 [0182.301] CloseHandle (hObject=0x344) returned 1 [0182.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220 [0182.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220 [0182.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.302] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.302] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.303] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x30f0, lpOverlapped=0x0) returned 1 [0182.305] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3100, lpOverlapped=0x0) returned 1 [0182.423] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.423] CloseHandle (hObject=0x344) returned 1 [0182.423] CloseHandle (hObject=0x368) returned 1 [0182.423] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0 [0182.423] SetEvent (hEvent=0x2fc) returned 1 [0182.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.425] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11396) returned 1 [0182.425] CloseHandle (hObject=0x368) returned 1 [0182.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220 [0182.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220 [0182.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.426] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.426] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.427] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2c84, lpOverlapped=0x0) returned 1 [0182.429] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2c90, lpOverlapped=0x0) returned 1 [0182.430] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.430] CloseHandle (hObject=0x368) returned 1 [0182.430] CloseHandle (hObject=0x344) returned 1 [0182.431] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0 [0182.431] SetEvent (hEvent=0x2fc) returned 1 [0182.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.431] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18652) returned 1 [0182.431] CloseHandle (hObject=0x344) returned 1 [0182.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0x220 [0182.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0x220 [0182.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.432] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.432] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.433] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x48dc, lpOverlapped=0x0) returned 1 [0182.435] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x48e0, lpOverlapped=0x0) returned 1 [0182.436] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.436] CloseHandle (hObject=0x344) returned 1 [0182.437] CloseHandle (hObject=0x368) returned 1 [0182.437] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0 [0182.437] SetEvent (hEvent=0x2fc) returned 1 [0182.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.438] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17966) returned 1 [0182.438] CloseHandle (hObject=0x368) returned 1 [0182.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220 [0182.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220 [0182.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.439] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.439] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.440] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x462e, lpOverlapped=0x0) returned 1 [0182.443] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4630, lpOverlapped=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.444] CloseHandle (hObject=0x368) returned 1 [0182.445] CloseHandle (hObject=0x344) returned 1 [0182.445] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0 [0182.445] SetEvent (hEvent=0x2fc) returned 1 [0182.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.448] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29406) returned 1 [0182.448] CloseHandle (hObject=0x344) returned 1 [0182.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220 [0182.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220 [0182.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.448] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.448] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.449] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x72de, lpOverlapped=0x0) returned 1 [0182.451] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x72e0, lpOverlapped=0x0) returned 1 [0182.453] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.453] CloseHandle (hObject=0x344) returned 1 [0182.453] CloseHandle (hObject=0x368) returned 1 [0182.453] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0 [0182.453] SetEvent (hEvent=0x2fc) returned 1 [0182.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.454] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=46484) returned 1 [0182.454] CloseHandle (hObject=0x368) returned 1 [0182.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220 [0182.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220 [0182.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.455] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.455] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0182.456] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb594, lpOverlapped=0x0) returned 1 [0182.458] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb5a0, lpOverlapped=0x0) returned 1 [0182.460] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.460] CloseHandle (hObject=0x368) returned 1 [0182.460] CloseHandle (hObject=0x344) returned 1 [0182.460] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0 [0182.461] SetEvent (hEvent=0x2fc) returned 1 [0182.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.508] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20906) returned 1 [0182.509] CloseHandle (hObject=0x344) returned 1 [0182.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220 [0182.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220 [0182.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.590] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.590] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0182.591] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x51aa, lpOverlapped=0x0) returned 1 [0182.594] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x51b0, lpOverlapped=0x0) returned 1 [0182.596] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.596] CloseHandle (hObject=0x368) returned 1 [0182.596] CloseHandle (hObject=0x370) returned 1 [0182.596] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0 [0182.596] SetEvent (hEvent=0x2fc) returned 1 [0182.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.597] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5100) returned 1 [0182.597] CloseHandle (hObject=0x370) returned 1 [0182.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220 [0182.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220 [0182.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.598] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.598] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.599] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x13ec, lpOverlapped=0x0) returned 1 [0182.600] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13f0, lpOverlapped=0x0) returned 1 [0182.601] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.601] CloseHandle (hObject=0x370) returned 1 [0182.602] CloseHandle (hObject=0x368) returned 1 [0182.602] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0 [0182.602] SetEvent (hEvent=0x2fc) returned 1 [0182.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.603] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24982) returned 1 [0182.603] CloseHandle (hObject=0x368) returned 1 [0182.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0x220 [0182.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0x220 [0182.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.604] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.604] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0182.605] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6196, lpOverlapped=0x0) returned 1 [0182.607] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x61a0, lpOverlapped=0x0) returned 1 [0182.608] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.608] CloseHandle (hObject=0x368) returned 1 [0182.608] CloseHandle (hObject=0x370) returned 1 [0182.608] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0 [0182.609] SetEvent (hEvent=0x2fc) returned 1 [0182.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.610] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=46461) returned 1 [0182.610] CloseHandle (hObject=0x370) returned 1 [0182.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220 [0182.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220 [0182.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.611] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb57d, lpOverlapped=0x0) returned 1 [0182.613] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb580, lpOverlapped=0x0) returned 1 [0182.615] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.615] CloseHandle (hObject=0x370) returned 1 [0182.616] CloseHandle (hObject=0x368) returned 1 [0182.616] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0 [0182.616] SetEvent (hEvent=0x2fc) returned 1 [0182.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.617] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14552) returned 1 [0182.617] CloseHandle (hObject=0x368) returned 1 [0182.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220 [0182.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220 [0182.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.618] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.618] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0182.618] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x38d8, lpOverlapped=0x0) returned 1 [0182.620] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x38e0, lpOverlapped=0x0) returned 1 [0182.621] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.621] CloseHandle (hObject=0x368) returned 1 [0182.622] CloseHandle (hObject=0x370) returned 1 [0182.622] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0 [0182.622] SetEvent (hEvent=0x2fc) returned 1 [0182.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.623] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=45358) returned 1 [0182.623] CloseHandle (hObject=0x370) returned 1 [0182.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220 [0182.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220 [0182.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.624] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.624] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.624] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb12e, lpOverlapped=0x0) returned 1 [0182.715] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb130, lpOverlapped=0x0) returned 1 [0182.716] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.716] CloseHandle (hObject=0x370) returned 1 [0182.717] CloseHandle (hObject=0x368) returned 1 [0182.717] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0 [0182.717] SetEvent (hEvent=0x2fc) returned 1 [0182.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.719] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=23338) returned 1 [0182.719] CloseHandle (hObject=0x368) returned 1 [0182.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220 [0182.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220 [0182.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.719] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.719] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0182.720] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5b2a, lpOverlapped=0x0) returned 1 [0182.723] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5b30, lpOverlapped=0x0) returned 1 [0182.725] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.725] CloseHandle (hObject=0x368) returned 1 [0182.725] CloseHandle (hObject=0x370) returned 1 [0182.725] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0 [0182.725] SetEvent (hEvent=0x2fc) returned 1 [0182.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.726] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32038) returned 1 [0182.726] CloseHandle (hObject=0x370) returned 1 [0182.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220 [0182.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220 [0182.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.727] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.727] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.727] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7d26, lpOverlapped=0x0) returned 1 [0182.730] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7d30, lpOverlapped=0x0) returned 1 [0182.731] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.731] CloseHandle (hObject=0x370) returned 1 [0182.731] CloseHandle (hObject=0x368) returned 1 [0182.732] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0 [0182.732] SetEvent (hEvent=0x2fc) returned 1 [0182.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.733] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35340) returned 1 [0182.733] CloseHandle (hObject=0x368) returned 1 [0182.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220 [0182.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220 [0182.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0182.734] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.734] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0182.736] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8a0c, lpOverlapped=0x0) returned 1 [0182.738] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8a10, lpOverlapped=0x0) returned 1 [0182.740] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.740] CloseHandle (hObject=0x368) returned 1 [0182.740] CloseHandle (hObject=0x370) returned 1 [0182.740] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0 [0182.740] SetEvent (hEvent=0x2fc) returned 1 [0182.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.742] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32110) returned 1 [0182.742] CloseHandle (hObject=0x370) returned 1 [0182.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220 [0182.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220 [0182.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0182.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0182.742] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.743] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0182.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0182.743] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7d6e, lpOverlapped=0x0) returned 1 [0182.785] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7d70, lpOverlapped=0x0) returned 1 [0182.828] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0182.828] CloseHandle (hObject=0x370) returned 1 [0182.828] CloseHandle (hObject=0x368) returned 1 [0183.126] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0 [0183.132] SetEvent (hEvent=0x2fc) returned 1 [0183.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0183.158] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15150) returned 1 [0183.158] CloseHandle (hObject=0x344) returned 1 [0183.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220 [0183.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220 [0183.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.217] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.217] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.218] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3b2e, lpOverlapped=0x0) returned 1 [0183.221] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3b30, lpOverlapped=0x0) returned 1 [0183.222] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.222] CloseHandle (hObject=0x39c) returned 1 [0183.222] CloseHandle (hObject=0x394) returned 1 [0183.223] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0 [0183.223] SetEvent (hEvent=0x2fc) returned 1 [0183.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.224] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24430) returned 1 [0183.224] CloseHandle (hObject=0x394) returned 1 [0183.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220 [0183.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220 [0183.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.224] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.224] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.225] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5f6e, lpOverlapped=0x0) returned 1 [0183.227] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5f70, lpOverlapped=0x0) returned 1 [0183.228] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.228] CloseHandle (hObject=0x394) returned 1 [0183.228] CloseHandle (hObject=0x39c) returned 1 [0183.229] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0 [0183.229] SetEvent (hEvent=0x2fc) returned 1 [0183.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.230] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19274) returned 1 [0183.230] CloseHandle (hObject=0x39c) returned 1 [0183.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0x220 [0183.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0x220 [0183.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.230] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.230] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.231] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4b4a, lpOverlapped=0x0) returned 1 [0183.233] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4b50, lpOverlapped=0x0) returned 1 [0183.234] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.234] CloseHandle (hObject=0x39c) returned 1 [0183.234] CloseHandle (hObject=0x394) returned 1 [0183.234] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0 [0183.234] SetEvent (hEvent=0x2fc) returned 1 [0183.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.235] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7304) returned 1 [0183.235] CloseHandle (hObject=0x394) returned 1 [0183.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220 [0183.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220 [0183.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.236] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.236] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.253] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1c88, lpOverlapped=0x0) returned 1 [0183.449] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1c90, lpOverlapped=0x0) returned 1 [0183.450] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.450] CloseHandle (hObject=0x394) returned 1 [0183.450] CloseHandle (hObject=0x39c) returned 1 [0183.450] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0 [0183.450] SetEvent (hEvent=0x2fc) returned 1 [0183.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.452] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20662) returned 1 [0183.452] CloseHandle (hObject=0x39c) returned 1 [0183.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220 [0183.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220 [0183.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.453] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.453] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.454] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x50b6, lpOverlapped=0x0) returned 1 [0183.457] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x50c0, lpOverlapped=0x0) returned 1 [0183.458] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.458] CloseHandle (hObject=0x39c) returned 1 [0183.458] CloseHandle (hObject=0x394) returned 1 [0183.458] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0 [0183.459] SetEvent (hEvent=0x2fc) returned 1 [0183.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.460] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=25868) returned 1 [0183.460] CloseHandle (hObject=0x394) returned 1 [0183.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0x220 [0183.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0x220 [0183.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.461] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.461] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.461] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x650c, lpOverlapped=0x0) returned 1 [0183.464] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6510, lpOverlapped=0x0) returned 1 [0183.465] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.465] CloseHandle (hObject=0x394) returned 1 [0183.465] CloseHandle (hObject=0x39c) returned 1 [0183.465] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0 [0183.466] SetEvent (hEvent=0x2fc) returned 1 [0183.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.467] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33824) returned 1 [0183.467] CloseHandle (hObject=0x39c) returned 1 [0183.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220 [0183.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220 [0183.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.468] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.468] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.469] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8420, lpOverlapped=0x0) returned 1 [0183.471] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8430, lpOverlapped=0x0) returned 1 [0183.472] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.473] CloseHandle (hObject=0x39c) returned 1 [0183.473] CloseHandle (hObject=0x394) returned 1 [0183.473] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0 [0183.473] SetEvent (hEvent=0x2fc) returned 1 [0183.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.474] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24238) returned 1 [0183.474] CloseHandle (hObject=0x394) returned 1 [0183.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220 [0183.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220 [0183.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.474] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.474] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.475] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5eae, lpOverlapped=0x0) returned 1 [0183.477] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5eb0, lpOverlapped=0x0) returned 1 [0183.478] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.478] CloseHandle (hObject=0x394) returned 1 [0183.479] CloseHandle (hObject=0x39c) returned 1 [0183.479] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0 [0183.479] SetEvent (hEvent=0x2fc) returned 1 [0183.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.480] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=30522) returned 1 [0183.480] CloseHandle (hObject=0x39c) returned 1 [0183.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220 [0183.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220 [0183.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.481] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.481] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.482] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x773a, lpOverlapped=0x0) returned 1 [0183.485] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7740, lpOverlapped=0x0) returned 1 [0183.486] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.487] CloseHandle (hObject=0x39c) returned 1 [0183.487] CloseHandle (hObject=0x394) returned 1 [0183.487] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0 [0183.487] SetEvent (hEvent=0x2fc) returned 1 [0183.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.488] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35726) returned 1 [0183.488] CloseHandle (hObject=0x394) returned 1 [0183.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0x220 [0183.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0x220 [0183.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.488] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.489] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.489] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8b8e, lpOverlapped=0x0) returned 1 [0183.568] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8b90, lpOverlapped=0x0) returned 1 [0183.570] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.570] CloseHandle (hObject=0x394) returned 1 [0183.570] CloseHandle (hObject=0x39c) returned 1 [0183.570] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0 [0183.571] SetEvent (hEvent=0x2fc) returned 1 [0183.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.599] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18212) returned 1 [0183.599] CloseHandle (hObject=0x394) returned 1 [0183.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220 [0183.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220 [0183.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.599] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.600] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0183.601] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4724, lpOverlapped=0x0) returned 1 [0183.604] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4730, lpOverlapped=0x0) returned 1 [0183.605] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.605] CloseHandle (hObject=0x394) returned 1 [0183.605] CloseHandle (hObject=0x398) returned 1 [0183.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0 [0183.605] SetEvent (hEvent=0x2fc) returned 1 [0183.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.606] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6596) returned 1 [0183.606] CloseHandle (hObject=0x398) returned 1 [0183.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0x220 [0183.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0x220 [0183.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0183.607] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.607] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.608] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x19c4, lpOverlapped=0x0) returned 1 [0183.610] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x19d0, lpOverlapped=0x0) returned 1 [0183.611] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.612] CloseHandle (hObject=0x398) returned 1 [0183.612] CloseHandle (hObject=0x394) returned 1 [0183.612] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0 [0183.612] SetEvent (hEvent=0x2fc) returned 1 [0183.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.615] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5376) returned 1 [0183.615] CloseHandle (hObject=0x39c) returned 1 [0183.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220 [0183.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220 [0183.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.619] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1500, lpOverlapped=0x0) returned 1 [0183.622] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1510, lpOverlapped=0x0) returned 1 [0183.623] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.623] CloseHandle (hObject=0x39c) returned 1 [0183.623] CloseHandle (hObject=0x394) returned 1 [0183.623] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0 [0183.624] SetEvent (hEvent=0x2fc) returned 1 [0183.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.624] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11644) returned 1 [0183.624] CloseHandle (hObject=0x394) returned 1 [0183.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220 [0183.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220 [0183.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.625] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.625] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.626] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2d7c, lpOverlapped=0x0) returned 1 [0183.629] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2d80, lpOverlapped=0x0) returned 1 [0183.630] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.630] CloseHandle (hObject=0x394) returned 1 [0183.630] CloseHandle (hObject=0x39c) returned 1 [0183.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0 [0183.631] SetEvent (hEvent=0x2fc) returned 1 [0183.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.631] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10352) returned 1 [0183.631] CloseHandle (hObject=0x39c) returned 1 [0183.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0x220 [0183.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0x220 [0183.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.632] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.632] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0183.633] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2870, lpOverlapped=0x0) returned 1 [0183.637] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2880, lpOverlapped=0x0) returned 1 [0183.638] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.639] CloseHandle (hObject=0x39c) returned 1 [0183.639] CloseHandle (hObject=0x394) returned 1 [0183.639] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 0 [0183.639] SetEvent (hEvent=0x2fc) returned 1 [0183.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.640] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7500) returned 1 [0183.640] CloseHandle (hObject=0x394) returned 1 [0183.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0x220 [0183.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0x220 [0183.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0183.640] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.640] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.641] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1d4c, lpOverlapped=0x0) returned 1 [0183.643] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1d50, lpOverlapped=0x0) returned 1 [0183.645] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.645] CloseHandle (hObject=0x394) returned 1 [0183.645] CloseHandle (hObject=0x39c) returned 1 [0183.645] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0 [0183.645] SetEvent (hEvent=0x2fc) returned 1 [0183.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.646] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12352) returned 1 [0183.646] CloseHandle (hObject=0x39c) returned 1 [0183.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220 [0183.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220 [0183.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.647] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.647] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.662] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3040, lpOverlapped=0x0) returned 1 [0183.688] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3050, lpOverlapped=0x0) returned 1 [0183.689] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.689] CloseHandle (hObject=0x39c) returned 1 [0183.689] CloseHandle (hObject=0x388) returned 1 [0183.689] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0 [0183.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.690] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8732) returned 1 [0183.690] CloseHandle (hObject=0x388) returned 1 [0183.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220 [0183.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220 [0183.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.691] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.691] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.692] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x221c, lpOverlapped=0x0) returned 1 [0183.697] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2220, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.698] CloseHandle (hObject=0x388) returned 1 [0183.707] CloseHandle (hObject=0x39c) returned 1 [0183.709] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0 [0183.709] SetEvent (hEvent=0x2fc) returned 1 [0183.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.711] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9108) returned 1 [0183.711] CloseHandle (hObject=0x39c) returned 1 [0183.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220 [0183.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220 [0183.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.711] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.712] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.713] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2394, lpOverlapped=0x0) returned 1 [0183.714] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x23a0, lpOverlapped=0x0) returned 1 [0183.715] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.716] CloseHandle (hObject=0x39c) returned 1 [0183.716] CloseHandle (hObject=0x388) returned 1 [0183.716] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0 [0183.716] SetEvent (hEvent=0x2fc) returned 1 [0183.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.717] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10820) returned 1 [0183.717] CloseHandle (hObject=0x388) returned 1 [0183.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220 [0183.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220 [0183.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.717] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.717] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.718] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a44, lpOverlapped=0x0) returned 1 [0183.720] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a50, lpOverlapped=0x0) returned 1 [0183.721] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.721] CloseHandle (hObject=0x388) returned 1 [0183.721] CloseHandle (hObject=0x39c) returned 1 [0183.721] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0 [0183.721] SetEvent (hEvent=0x2fc) returned 1 [0183.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.722] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4696) returned 1 [0183.722] CloseHandle (hObject=0x39c) returned 1 [0183.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220 [0183.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220 [0183.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.723] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.723] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.724] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1258, lpOverlapped=0x0) returned 1 [0183.804] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1260, lpOverlapped=0x0) returned 1 [0183.805] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.805] CloseHandle (hObject=0x39c) returned 1 [0183.805] CloseHandle (hObject=0x388) returned 1 [0183.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0 [0183.806] SetEvent (hEvent=0x2fc) returned 1 [0183.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.807] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12292) returned 1 [0183.807] CloseHandle (hObject=0x388) returned 1 [0183.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0x220 [0183.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0x220 [0183.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.808] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.809] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3004, lpOverlapped=0x0) returned 1 [0183.811] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3010, lpOverlapped=0x0) returned 1 [0183.812] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.812] CloseHandle (hObject=0x388) returned 1 [0183.812] CloseHandle (hObject=0x39c) returned 1 [0183.812] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0 [0183.813] SetEvent (hEvent=0x2fc) returned 1 [0183.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.814] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5824) returned 1 [0183.814] CloseHandle (hObject=0x39c) returned 1 [0183.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0x220 [0183.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0x220 [0183.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.815] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.815] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.816] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x16c0, lpOverlapped=0x0) returned 1 [0183.817] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x16d0, lpOverlapped=0x0) returned 1 [0183.818] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.818] CloseHandle (hObject=0x39c) returned 1 [0183.819] CloseHandle (hObject=0x388) returned 1 [0183.819] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0 [0183.819] SetEvent (hEvent=0x2fc) returned 1 [0183.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.820] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15196) returned 1 [0183.820] CloseHandle (hObject=0x388) returned 1 [0183.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0x220 [0183.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0x220 [0183.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.820] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.821] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.821] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3b5c, lpOverlapped=0x0) returned 1 [0183.823] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3b60, lpOverlapped=0x0) returned 1 [0183.825] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.825] CloseHandle (hObject=0x388) returned 1 [0183.825] CloseHandle (hObject=0x39c) returned 1 [0183.825] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0 [0183.825] SetEvent (hEvent=0x2fc) returned 1 [0183.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.826] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16030) returned 1 [0183.826] CloseHandle (hObject=0x39c) returned 1 [0183.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 0x220 [0183.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 0x220 [0183.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.827] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.828] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3e9e, lpOverlapped=0x0) returned 1 [0183.829] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3ea0, lpOverlapped=0x0) returned 1 [0183.830] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.830] CloseHandle (hObject=0x39c) returned 1 [0183.831] CloseHandle (hObject=0x388) returned 1 [0183.831] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 0 [0183.831] SetEvent (hEvent=0x2fc) returned 1 [0183.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.832] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=29602) returned 1 [0183.832] CloseHandle (hObject=0x388) returned 1 [0183.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0x220 [0183.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0x220 [0183.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.832] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.832] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.833] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x73a2, lpOverlapped=0x0) returned 1 [0183.835] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x73b0, lpOverlapped=0x0) returned 1 [0183.836] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.836] CloseHandle (hObject=0x388) returned 1 [0183.837] CloseHandle (hObject=0x39c) returned 1 [0183.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0 [0183.837] SetEvent (hEvent=0x2fc) returned 1 [0183.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.838] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13162) returned 1 [0183.838] CloseHandle (hObject=0x39c) returned 1 [0183.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0x220 [0183.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0x220 [0183.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.839] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.840] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x336a, lpOverlapped=0x0) returned 1 [0183.932] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3370, lpOverlapped=0x0) returned 1 [0183.933] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.933] CloseHandle (hObject=0x39c) returned 1 [0183.933] CloseHandle (hObject=0x388) returned 1 [0183.933] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0 [0183.934] SetEvent (hEvent=0x2fc) returned 1 [0183.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.935] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3680) returned 1 [0183.935] CloseHandle (hObject=0x388) returned 1 [0183.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 0x220 [0183.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 0x220 [0183.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.936] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.936] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.940] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe60, lpOverlapped=0x0) returned 1 [0183.942] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe70, lpOverlapped=0x0) returned 1 [0183.943] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.943] CloseHandle (hObject=0x388) returned 1 [0183.943] CloseHandle (hObject=0x39c) returned 1 [0183.943] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 0 [0183.944] SetEvent (hEvent=0x2fc) returned 1 [0183.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.944] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3004) returned 1 [0183.944] CloseHandle (hObject=0x39c) returned 1 [0183.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 0x220 [0183.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 0x220 [0183.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.945] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.945] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.946] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xbbc, lpOverlapped=0x0) returned 1 [0183.948] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xbc0, lpOverlapped=0x0) returned 1 [0183.949] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.949] CloseHandle (hObject=0x39c) returned 1 [0183.950] CloseHandle (hObject=0x388) returned 1 [0183.950] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 0 [0183.950] SetEvent (hEvent=0x2fc) returned 1 [0183.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.951] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4750) returned 1 [0183.951] CloseHandle (hObject=0x388) returned 1 [0183.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 0x220 [0183.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 0x220 [0183.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.951] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.951] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.953] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x128e, lpOverlapped=0x0) returned 1 [0183.954] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1290, lpOverlapped=0x0) returned 1 [0183.955] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.955] CloseHandle (hObject=0x388) returned 1 [0183.956] CloseHandle (hObject=0x39c) returned 1 [0183.956] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 0 [0183.956] SetEvent (hEvent=0x2fc) returned 1 [0183.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.956] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5326) returned 1 [0183.957] CloseHandle (hObject=0x39c) returned 1 [0183.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 0x220 [0183.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 0x220 [0183.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.957] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.957] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0183.958] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x14ce, lpOverlapped=0x0) returned 1 [0183.959] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x14d0, lpOverlapped=0x0) returned 1 [0183.960] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.960] CloseHandle (hObject=0x39c) returned 1 [0183.960] CloseHandle (hObject=0x388) returned 1 [0183.961] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 0 [0183.961] SetEvent (hEvent=0x2fc) returned 1 [0183.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.962] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3826) returned 1 [0183.962] CloseHandle (hObject=0x388) returned 1 [0183.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 0x220 [0183.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 0x220 [0183.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.963] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.963] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0183.963] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xef2, lpOverlapped=0x0) returned 1 [0183.965] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf00, lpOverlapped=0x0) returned 1 [0183.966] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0183.966] CloseHandle (hObject=0x388) returned 1 [0183.966] CloseHandle (hObject=0x39c) returned 1 [0183.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 0 [0183.966] SetEvent (hEvent=0x2fc) returned 1 [0183.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.967] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13702) returned 1 [0183.967] CloseHandle (hObject=0x39c) returned 1 [0183.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 0x220 [0183.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 0x220 [0183.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0183.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0183.968] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.968] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0183.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0184.057] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3586, lpOverlapped=0x0) returned 1 [0184.059] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3590, lpOverlapped=0x0) returned 1 [0184.060] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.060] CloseHandle (hObject=0x39c) returned 1 [0184.060] CloseHandle (hObject=0x388) returned 1 [0184.061] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 0 [0184.061] SetEvent (hEvent=0x2fc) returned 1 [0184.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.062] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=34912) returned 1 [0184.062] CloseHandle (hObject=0x388) returned 1 [0184.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 0x220 [0184.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 0x220 [0184.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.064] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8860, lpOverlapped=0x0) returned 1 [0184.066] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8870, lpOverlapped=0x0) returned 1 [0184.067] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.067] CloseHandle (hObject=0x388) returned 1 [0184.067] CloseHandle (hObject=0x39c) returned 1 [0184.067] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 0 [0184.068] SetEvent (hEvent=0x2fc) returned 1 [0184.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.068] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26148) returned 1 [0184.068] CloseHandle (hObject=0x39c) returned 1 [0184.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 0x220 [0184.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 0x220 [0184.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.069] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.069] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0184.070] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6624, lpOverlapped=0x0) returned 1 [0184.072] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6630, lpOverlapped=0x0) returned 1 [0184.073] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.073] CloseHandle (hObject=0x39c) returned 1 [0184.073] CloseHandle (hObject=0x388) returned 1 [0184.073] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 0 [0184.074] SetEvent (hEvent=0x2fc) returned 1 [0184.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.075] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15566) returned 1 [0184.075] CloseHandle (hObject=0x388) returned 1 [0184.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf")) returned 0x220 [0184.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf")) returned 0x220 [0184.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.075] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.076] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.077] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3cce, lpOverlapped=0x0) returned 1 [0184.078] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3cd0, lpOverlapped=0x0) returned 1 [0184.079] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.080] CloseHandle (hObject=0x388) returned 1 [0184.080] CloseHandle (hObject=0x39c) returned 1 [0184.080] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf")) returned 0 [0184.080] SetEvent (hEvent=0x2fc) returned 1 [0184.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.081] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=54964) returned 1 [0184.081] CloseHandle (hObject=0x39c) returned 1 [0184.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 0x220 [0184.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 0x220 [0184.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.082] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.082] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0184.082] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd6b4, lpOverlapped=0x0) returned 1 [0184.085] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd6c0, lpOverlapped=0x0) returned 1 [0184.087] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.087] CloseHandle (hObject=0x39c) returned 1 [0184.087] CloseHandle (hObject=0x388) returned 1 [0184.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 0 [0184.087] SetEvent (hEvent=0x2fc) returned 1 [0184.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.088] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42272) returned 1 [0184.088] CloseHandle (hObject=0x388) returned 1 [0184.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 0x220 [0184.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 0x220 [0184.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.089] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.089] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.090] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa520, lpOverlapped=0x0) returned 1 [0184.092] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa530, lpOverlapped=0x0) returned 1 [0184.094] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.094] CloseHandle (hObject=0x388) returned 1 [0184.094] CloseHandle (hObject=0x39c) returned 1 [0184.094] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 0 [0184.094] SetEvent (hEvent=0x2fc) returned 1 [0184.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.095] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=41906) returned 1 [0184.095] CloseHandle (hObject=0x39c) returned 1 [0184.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 0x220 [0184.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 0x220 [0184.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.096] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.096] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0184.097] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa3b2, lpOverlapped=0x0) returned 1 [0184.285] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa3c0, lpOverlapped=0x0) returned 1 [0184.286] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.286] CloseHandle (hObject=0x39c) returned 1 [0184.286] CloseHandle (hObject=0x388) returned 1 [0184.287] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 0 [0184.287] SetEvent (hEvent=0x2fc) returned 1 [0184.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.288] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=57722) returned 1 [0184.288] CloseHandle (hObject=0x388) returned 1 [0184.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 0x220 [0184.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 0x220 [0184.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.289] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.289] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.290] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe17a, lpOverlapped=0x0) returned 1 [0184.430] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe180, lpOverlapped=0x0) returned 1 [0184.432] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.432] CloseHandle (hObject=0x388) returned 1 [0184.432] CloseHandle (hObject=0x39c) returned 1 [0184.433] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 0 [0184.469] SetEvent (hEvent=0x2fc) returned 1 [0184.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.541] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=50046) returned 1 [0184.541] CloseHandle (hObject=0x39c) returned 1 [0184.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf")) returned 0x220 [0184.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf")) returned 0x220 [0184.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.555] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.556] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.558] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc37e, lpOverlapped=0x0) returned 1 [0184.560] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc380, lpOverlapped=0x0) returned 1 [0184.562] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.563] CloseHandle (hObject=0x39c) returned 1 [0184.563] CloseHandle (hObject=0x368) returned 1 [0184.563] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf")) returned 0 [0184.563] SetEvent (hEvent=0x2fc) returned 1 [0184.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.564] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10776) returned 1 [0184.564] CloseHandle (hObject=0x368) returned 1 [0184.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 0x220 [0184.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 0x220 [0184.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.565] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.565] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.566] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2a18, lpOverlapped=0x0) returned 1 [0184.567] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2a20, lpOverlapped=0x0) returned 1 [0184.569] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.569] CloseHandle (hObject=0x368) returned 1 [0184.569] CloseHandle (hObject=0x39c) returned 1 [0184.569] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 0 [0184.569] SetEvent (hEvent=0x2fc) returned 1 [0184.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.570] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5252) returned 1 [0184.570] CloseHandle (hObject=0x39c) returned 1 [0184.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf")) returned 0x220 [0184.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf")) returned 0x220 [0184.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.571] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.571] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.571] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1484, lpOverlapped=0x0) returned 1 [0184.573] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1490, lpOverlapped=0x0) returned 1 [0184.576] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.576] CloseHandle (hObject=0x39c) returned 1 [0184.576] CloseHandle (hObject=0x368) returned 1 [0184.576] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf")) returned 0 [0184.577] SetEvent (hEvent=0x2fc) returned 1 [0184.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.577] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10164) returned 1 [0184.577] CloseHandle (hObject=0x368) returned 1 [0184.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 0x220 [0184.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 0x220 [0184.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.578] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.579] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x27b4, lpOverlapped=0x0) returned 1 [0184.581] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x27c0, lpOverlapped=0x0) returned 1 [0184.582] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.582] CloseHandle (hObject=0x368) returned 1 [0184.582] CloseHandle (hObject=0x39c) returned 1 [0184.582] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 0 [0184.583] SetEvent (hEvent=0x2fc) returned 1 [0184.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.584] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12332) returned 1 [0184.584] CloseHandle (hObject=0x39c) returned 1 [0184.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 0x220 [0184.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 0x220 [0184.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.585] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.585] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.586] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x302c, lpOverlapped=0x0) returned 1 [0184.589] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3030, lpOverlapped=0x0) returned 1 [0184.590] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.590] CloseHandle (hObject=0x39c) returned 1 [0184.590] CloseHandle (hObject=0x368) returned 1 [0184.590] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 0 [0184.591] SetEvent (hEvent=0x2fc) returned 1 [0184.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.658] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8196) returned 1 [0184.665] CloseHandle (hObject=0x368) returned 1 [0184.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 0x220 [0184.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 0x220 [0184.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.672] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.672] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.674] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2004, lpOverlapped=0x0) returned 1 [0184.676] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2010, lpOverlapped=0x0) returned 1 [0184.677] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.677] CloseHandle (hObject=0x368) returned 1 [0184.677] CloseHandle (hObject=0x39c) returned 1 [0184.678] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 0 [0184.678] SetEvent (hEvent=0x2fc) returned 1 [0184.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.678] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20232) returned 1 [0184.678] CloseHandle (hObject=0x39c) returned 1 [0184.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 0x220 [0184.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 0x220 [0184.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.679] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.679] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.680] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4f08, lpOverlapped=0x0) returned 1 [0184.685] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4f10, lpOverlapped=0x0) returned 1 [0184.686] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.687] CloseHandle (hObject=0x39c) returned 1 [0184.687] CloseHandle (hObject=0x368) returned 1 [0184.687] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 0 [0184.687] SetEvent (hEvent=0x2fc) returned 1 [0184.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.688] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21400) returned 1 [0184.688] CloseHandle (hObject=0x368) returned 1 [0184.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 0x220 [0184.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 0x220 [0184.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.688] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.688] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.689] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5398, lpOverlapped=0x0) returned 1 [0184.691] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x53a0, lpOverlapped=0x0) returned 1 [0184.693] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.693] CloseHandle (hObject=0x368) returned 1 [0184.693] CloseHandle (hObject=0x39c) returned 1 [0184.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 0 [0184.693] SetEvent (hEvent=0x2fc) returned 1 [0184.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.695] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13934) returned 1 [0184.695] CloseHandle (hObject=0x39c) returned 1 [0184.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf")) returned 0x220 [0184.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf")) returned 0x220 [0184.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.695] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.695] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.697] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x366e, lpOverlapped=0x0) returned 1 [0184.698] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3670, lpOverlapped=0x0) returned 1 [0184.700] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.700] CloseHandle (hObject=0x39c) returned 1 [0184.700] CloseHandle (hObject=0x368) returned 1 [0184.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf")) returned 0 [0184.700] SetEvent (hEvent=0x2fc) returned 1 [0184.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.701] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10046) returned 1 [0184.701] CloseHandle (hObject=0x368) returned 1 [0184.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 0x220 [0184.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 0x220 [0184.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.702] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.702] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0184.703] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x273e, lpOverlapped=0x0) returned 1 [0184.704] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2740, lpOverlapped=0x0) returned 1 [0184.705] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.705] CloseHandle (hObject=0x368) returned 1 [0184.706] CloseHandle (hObject=0x39c) returned 1 [0184.706] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 0 [0184.706] SetEvent (hEvent=0x2fc) returned 1 [0184.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.707] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3894) returned 1 [0184.707] CloseHandle (hObject=0x39c) returned 1 [0184.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 0x220 [0184.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 0x220 [0184.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.708] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.708] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0184.709] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf36, lpOverlapped=0x0) returned 1 [0184.710] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf40, lpOverlapped=0x0) returned 1 [0184.711] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.712] CloseHandle (hObject=0x39c) returned 1 [0184.712] CloseHandle (hObject=0x368) returned 1 [0184.712] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 0 [0184.712] SetEvent (hEvent=0x2fc) returned 1 [0184.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.731] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42254) returned 1 [0184.731] CloseHandle (hObject=0x398) returned 1 [0184.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 0x220 [0184.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 0x220 [0184.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.732] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.732] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.733] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa50e, lpOverlapped=0x0) returned 1 [0184.735] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa510, lpOverlapped=0x0) returned 1 [0184.737] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.737] CloseHandle (hObject=0x398) returned 1 [0184.737] CloseHandle (hObject=0x394) returned 1 [0184.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 0 [0184.737] SetEvent (hEvent=0x2fc) returned 1 [0184.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.739] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6158) returned 1 [0184.739] CloseHandle (hObject=0x394) returned 1 [0184.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 0x220 [0184.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 0x220 [0184.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.739] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.740] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.740] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x180e, lpOverlapped=0x0) returned 1 [0184.742] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1810, lpOverlapped=0x0) returned 1 [0184.743] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.743] CloseHandle (hObject=0x394) returned 1 [0184.743] CloseHandle (hObject=0x398) returned 1 [0184.743] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 0 [0184.743] SetEvent (hEvent=0x2fc) returned 1 [0184.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.744] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9676) returned 1 [0184.744] CloseHandle (hObject=0x398) returned 1 [0184.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 0x220 [0184.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 0x220 [0184.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.745] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.745] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.746] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x25cc, lpOverlapped=0x0) returned 1 [0184.747] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x25d0, lpOverlapped=0x0) returned 1 [0184.748] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.748] CloseHandle (hObject=0x398) returned 1 [0184.749] CloseHandle (hObject=0x394) returned 1 [0184.749] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 0 [0184.749] SetEvent (hEvent=0x2fc) returned 1 [0184.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.749] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6554) returned 1 [0184.750] CloseHandle (hObject=0x394) returned 1 [0184.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 0x220 [0184.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 0x220 [0184.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.750] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.750] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.751] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x199a, lpOverlapped=0x0) returned 1 [0184.753] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x19a0, lpOverlapped=0x0) returned 1 [0184.754] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.754] CloseHandle (hObject=0x394) returned 1 [0184.754] CloseHandle (hObject=0x398) returned 1 [0184.754] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 0 [0184.754] SetEvent (hEvent=0x2fc) returned 1 [0184.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.755] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2060) returned 1 [0184.755] CloseHandle (hObject=0x398) returned 1 [0184.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf")) returned 0x220 [0184.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf")) returned 0x220 [0184.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0184.756] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.756] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0184.757] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x80c, lpOverlapped=0x0) returned 1 [0184.759] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x810, lpOverlapped=0x0) returned 1 [0184.760] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.760] CloseHandle (hObject=0x398) returned 1 [0184.760] CloseHandle (hObject=0x394) returned 1 [0184.761] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf")) returned 0 [0184.761] SetEvent (hEvent=0x2fc) returned 1 [0184.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.761] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7498) returned 1 [0184.761] CloseHandle (hObject=0x394) returned 1 [0184.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 0x220 [0184.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 0x220 [0184.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.762] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.762] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.763] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1d4a, lpOverlapped=0x0) returned 1 [0184.765] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1d50, lpOverlapped=0x0) returned 1 [0184.766] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.766] CloseHandle (hObject=0x394) returned 1 [0184.766] CloseHandle (hObject=0x398) returned 1 [0184.766] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 0 [0184.792] SetEvent (hEvent=0x2fc) returned 1 [0184.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.794] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2652) returned 1 [0184.795] CloseHandle (hObject=0x39c) returned 1 [0184.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 0x220 [0184.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 0x220 [0184.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0184.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0184.796] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa5c, lpOverlapped=0x0) returned 1 [0184.856] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa60, lpOverlapped=0x0) returned 1 [0184.857] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.857] CloseHandle (hObject=0x39c) returned 1 [0184.857] CloseHandle (hObject=0x388) returned 1 [0184.857] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 0 [0184.857] SetEvent (hEvent=0x2fc) returned 1 [0184.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0184.870] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3840) returned 1 [0184.870] CloseHandle (hObject=0x368) returned 1 [0184.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 0x220 [0184.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 0x220 [0184.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0184.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0184.884] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.884] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0184.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0184.990] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xf00, lpOverlapped=0x0) returned 1 [0184.993] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf10, lpOverlapped=0x0) returned 1 [0184.994] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0184.995] CloseHandle (hObject=0x394) returned 1 [0184.995] CloseHandle (hObject=0x398) returned 1 [0184.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 0 [0184.995] SetEvent (hEvent=0x2fc) returned 1 [0184.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.013] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=44794) returned 1 [0185.013] CloseHandle (hObject=0x398) returned 1 [0185.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 0x220 [0185.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 0x220 [0185.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.014] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.014] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.015] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xaefa, lpOverlapped=0x0) returned 1 [0185.021] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xaf00, lpOverlapped=0x0) returned 1 [0185.022] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.022] CloseHandle (hObject=0x398) returned 1 [0185.022] CloseHandle (hObject=0x394) returned 1 [0185.023] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 0 [0185.023] SetEvent (hEvent=0x2fc) returned 1 [0185.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.024] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11628) returned 1 [0185.024] CloseHandle (hObject=0x394) returned 1 [0185.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 0x220 [0185.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 0x220 [0185.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.025] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.025] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0185.026] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2d6c, lpOverlapped=0x0) returned 1 [0185.028] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2d70, lpOverlapped=0x0) returned 1 [0185.029] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.029] CloseHandle (hObject=0x394) returned 1 [0185.029] CloseHandle (hObject=0x398) returned 1 [0185.029] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 0 [0185.030] SetEvent (hEvent=0x2fc) returned 1 [0185.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.030] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8016) returned 1 [0185.030] CloseHandle (hObject=0x398) returned 1 [0185.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 0x220 [0185.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 0x220 [0185.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.031] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.031] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0185.032] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f50, lpOverlapped=0x0) returned 1 [0185.034] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f60, lpOverlapped=0x0) returned 1 [0185.035] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.035] CloseHandle (hObject=0x398) returned 1 [0185.035] CloseHandle (hObject=0x394) returned 1 [0185.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 0 [0185.035] SetEvent (hEvent=0x2fc) returned 1 [0185.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.036] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33230) returned 1 [0185.036] CloseHandle (hObject=0x394) returned 1 [0185.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf")) returned 0x220 [0185.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf")) returned 0x220 [0185.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0185.037] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.037] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0185.147] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x81ce, lpOverlapped=0x0) returned 1 [0185.196] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x81d0, lpOverlapped=0x0) returned 1 [0185.335] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.335] CloseHandle (hObject=0x394) returned 1 [0185.335] CloseHandle (hObject=0x388) returned 1 [0185.336] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf")) returned 0 [0185.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.438] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17826) returned 1 [0185.438] CloseHandle (hObject=0x398) returned 1 [0185.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 0x220 [0185.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 0x220 [0185.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.439] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.439] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0185.454] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x45a2, lpOverlapped=0x0) returned 1 [0185.487] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x45b0, lpOverlapped=0x0) returned 1 [0185.488] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.489] CloseHandle (hObject=0x398) returned 1 [0185.489] CloseHandle (hObject=0x388) returned 1 [0185.489] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 0 [0185.489] SetEvent (hEvent=0x2fc) returned 1 [0185.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0185.498] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21620) returned 1 [0185.498] CloseHandle (hObject=0x390) returned 1 [0185.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 0x220 [0185.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 0x220 [0185.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0185.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.500] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5474, lpOverlapped=0x0) returned 1 [0185.503] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5480, lpOverlapped=0x0) returned 1 [0185.504] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.504] CloseHandle (hObject=0x390) returned 1 [0185.504] CloseHandle (hObject=0x368) returned 1 [0185.504] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 0 [0185.505] SetEvent (hEvent=0x2fc) returned 1 [0185.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.507] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42120) returned 1 [0185.508] CloseHandle (hObject=0x368) returned 1 [0185.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 0x220 [0185.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 0x220 [0185.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.508] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.508] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0185.509] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa488, lpOverlapped=0x0) returned 1 [0185.512] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa490, lpOverlapped=0x0) returned 1 [0185.514] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.514] CloseHandle (hObject=0x368) returned 1 [0185.514] CloseHandle (hObject=0x390) returned 1 [0185.514] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 0 [0185.514] SetEvent (hEvent=0x2fc) returned 1 [0185.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0185.515] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24796) returned 1 [0185.515] CloseHandle (hObject=0x390) returned 1 [0185.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 0x220 [0185.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 0x220 [0185.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0185.516] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.516] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0185.516] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x60dc, lpOverlapped=0x0) returned 1 [0185.519] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x60e0, lpOverlapped=0x0) returned 1 [0185.520] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.520] CloseHandle (hObject=0x390) returned 1 [0185.520] CloseHandle (hObject=0x368) returned 1 [0185.521] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 0 [0185.521] SetEvent (hEvent=0x2fc) returned 1 [0185.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.523] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8006) returned 1 [0185.524] CloseHandle (hObject=0x368) returned 1 [0185.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf")) returned 0x220 [0185.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf")) returned 0x220 [0185.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0185.524] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.524] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0185.535] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1f46, lpOverlapped=0x0) returned 1 [0185.538] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1f50, lpOverlapped=0x0) returned 1 [0185.539] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.539] CloseHandle (hObject=0x368) returned 1 [0185.539] CloseHandle (hObject=0x398) returned 1 [0185.539] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf")) returned 0 [0185.540] SetEvent (hEvent=0x2fc) returned 1 [0185.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.541] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=9442) returned 1 [0185.541] CloseHandle (hObject=0x398) returned 1 [0185.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 0x220 [0185.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 0x220 [0185.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.542] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.542] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0185.613] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x24e2, lpOverlapped=0x0) returned 1 [0185.625] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x24f0, lpOverlapped=0x0) returned 1 [0185.626] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.626] CloseHandle (hObject=0x398) returned 1 [0185.626] CloseHandle (hObject=0x39c) returned 1 [0185.626] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 0 [0185.627] SetEvent (hEvent=0x2fc) returned 1 [0185.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0185.628] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35542) returned 1 [0185.628] CloseHandle (hObject=0x39c) returned 1 [0185.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 0x220 [0185.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 0x220 [0185.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0185.629] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.629] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0185.631] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8ad6, lpOverlapped=0x0) returned 1 [0185.633] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8ae0, lpOverlapped=0x0) returned 1 [0185.635] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.635] CloseHandle (hObject=0x39c) returned 1 [0185.635] CloseHandle (hObject=0x398) returned 1 [0185.635] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 0 [0185.635] SetEvent (hEvent=0x2fc) returned 1 [0185.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.636] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=58089) returned 1 [0185.636] CloseHandle (hObject=0x398) returned 1 [0185.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 0x220 [0185.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 0x220 [0185.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.637] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.637] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0185.639] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe2e9, lpOverlapped=0x0) returned 1 [0185.641] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe2f0, lpOverlapped=0x0) returned 1 [0185.644] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.644] CloseHandle (hObject=0x398) returned 1 [0185.644] CloseHandle (hObject=0x39c) returned 1 [0185.644] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 0 [0185.645] SetEvent (hEvent=0x2fc) returned 1 [0185.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0185.646] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26022) returned 1 [0185.646] CloseHandle (hObject=0x39c) returned 1 [0185.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf")) returned 0x220 [0185.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf")) returned 0x220 [0185.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0185.647] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.647] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0185.648] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x65a6, lpOverlapped=0x0) returned 1 [0185.650] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x65b0, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.652] CloseHandle (hObject=0x39c) returned 1 [0185.652] CloseHandle (hObject=0x398) returned 1 [0185.652] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf")) returned 0 [0185.652] SetEvent (hEvent=0x2fc) returned 1 [0185.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.654] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=37260) returned 1 [0185.654] CloseHandle (hObject=0x398) returned 1 [0185.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 0x220 [0185.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 0x220 [0185.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.655] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.655] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0185.656] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x918c, lpOverlapped=0x0) returned 1 [0185.658] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9190, lpOverlapped=0x0) returned 1 [0185.660] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.660] CloseHandle (hObject=0x398) returned 1 [0185.660] CloseHandle (hObject=0x39c) returned 1 [0185.660] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 0 [0185.660] SetEvent (hEvent=0x2fc) returned 1 [0185.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0185.782] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7594) returned 1 [0185.782] CloseHandle (hObject=0x39c) returned 1 [0185.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 0x220 [0185.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 0x220 [0185.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0185.783] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.783] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0185.786] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1daa, lpOverlapped=0x0) returned 1 [0185.789] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1db0, lpOverlapped=0x0) returned 1 [0185.790] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0185.790] CloseHandle (hObject=0x39c) returned 1 [0185.790] CloseHandle (hObject=0x398) returned 1 [0185.790] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 0 [0185.791] SetEvent (hEvent=0x2fc) returned 1 [0185.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.792] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=35228) returned 1 [0185.792] CloseHandle (hObject=0x398) returned 1 [0185.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf")) returned 0x220 [0185.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf")) returned 0x220 [0185.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0185.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0185.793] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.793] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0185.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0185.794] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x899c, lpOverlapped=0x0) returned 1 [0185.796] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x89a0, lpOverlapped=0x0) returned 1 [0186.172] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.172] CloseHandle (hObject=0x398) returned 1 [0186.172] CloseHandle (hObject=0x39c) returned 1 [0186.172] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf")) returned 0 [0186.173] SetEvent (hEvent=0x2fc) returned 1 [0186.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.174] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19942) returned 1 [0186.174] CloseHandle (hObject=0x39c) returned 1 [0186.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 0x220 [0186.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 0x220 [0186.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.175] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.175] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0186.176] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4de6, lpOverlapped=0x0) returned 1 [0186.221] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4df0, lpOverlapped=0x0) returned 1 [0186.244] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.244] CloseHandle (hObject=0x39c) returned 1 [0186.246] CloseHandle (hObject=0x398) returned 1 [0186.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 0 [0186.254] SetEvent (hEvent=0x2fc) returned 1 [0186.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0186.270] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12588) returned 1 [0186.270] CloseHandle (hObject=0x398) returned 1 [0186.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 0x220 [0186.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 0x220 [0186.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0186.562] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.562] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0186.564] ReadFile (in: hFile=0x35c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x312c, lpOverlapped=0x0) returned 1 [0186.566] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3130, lpOverlapped=0x0) returned 1 [0186.568] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.568] CloseHandle (hObject=0x35c) returned 1 [0186.568] CloseHandle (hObject=0x368) returned 1 [0186.568] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 0 [0186.568] SetEvent (hEvent=0x2fc) returned 1 [0186.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0186.569] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=52128) returned 1 [0186.569] CloseHandle (hObject=0x368) returned 1 [0186.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf")) returned 0x220 [0186.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf")) returned 0x220 [0186.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0186.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x35c [0186.571] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcba0, lpOverlapped=0x0) returned 1 [0186.574] WriteFile (in: hFile=0x35c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcbb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcbb0, lpOverlapped=0x0) returned 1 [0186.576] WriteFile (in: hFile=0x35c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.576] CloseHandle (hObject=0x368) returned 1 [0186.576] CloseHandle (hObject=0x35c) returned 1 [0186.576] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf")) returned 0 [0186.577] SetEvent (hEvent=0x2fc) returned 1 [0186.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0186.577] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=22272) returned 1 [0186.577] CloseHandle (hObject=0x35c) returned 1 [0186.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 0x220 [0186.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 0x220 [0186.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0186.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0186.579] ReadFile (in: hFile=0x35c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x5700, lpOverlapped=0x0) returned 1 [0186.581] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5710, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5710, lpOverlapped=0x0) returned 1 [0186.582] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.582] CloseHandle (hObject=0x35c) returned 1 [0186.582] CloseHandle (hObject=0x368) returned 1 [0186.583] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 0 [0186.583] SetEvent (hEvent=0x2fc) returned 1 [0186.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0186.584] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24770) returned 1 [0186.584] CloseHandle (hObject=0x368) returned 1 [0186.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 0x220 [0186.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 0x220 [0186.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0186.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x35c [0186.586] ReadFile (in: hFile=0x368, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x60c2, lpOverlapped=0x0) returned 1 [0186.588] WriteFile (in: hFile=0x35c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x60d0, lpOverlapped=0x0) returned 1 [0186.590] WriteFile (in: hFile=0x35c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.590] CloseHandle (hObject=0x368) returned 1 [0186.590] CloseHandle (hObject=0x35c) returned 1 [0186.590] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 0 [0186.590] SetEvent (hEvent=0x2fc) returned 1 [0186.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0186.592] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20926) returned 1 [0186.592] CloseHandle (hObject=0x35c) returned 1 [0186.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 0x220 [0186.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 0x220 [0186.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0186.593] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.593] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x368 [0186.594] ReadFile (in: hFile=0x35c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x51be, lpOverlapped=0x0) returned 1 [0186.596] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x51c0, lpOverlapped=0x0) returned 1 [0186.598] WriteFile (in: hFile=0x368, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.598] CloseHandle (hObject=0x35c) returned 1 [0186.598] CloseHandle (hObject=0x368) returned 1 [0186.689] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 0 [0186.704] SetEvent (hEvent=0x2fc) returned 1 [0186.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.726] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7484) returned 1 [0186.726] CloseHandle (hObject=0x390) returned 1 [0186.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 0x220 [0186.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 0x220 [0186.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.727] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.727] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0186.728] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1d3c, lpOverlapped=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1d40, lpOverlapped=0x0) returned 1 [0186.730] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.731] CloseHandle (hObject=0x390) returned 1 [0186.731] CloseHandle (hObject=0x398) returned 1 [0186.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 0 [0186.731] SetEvent (hEvent=0x2fc) returned 1 [0186.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0186.732] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4756) returned 1 [0186.732] CloseHandle (hObject=0x398) returned 1 [0186.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 0x220 [0186.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 0x220 [0186.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0186.733] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.733] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0186.734] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1294, lpOverlapped=0x0) returned 1 [0186.735] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x12a0, lpOverlapped=0x0) returned 1 [0186.737] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.737] CloseHandle (hObject=0x398) returned 1 [0186.737] CloseHandle (hObject=0x390) returned 1 [0186.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 0 [0186.737] SetEvent (hEvent=0x2fc) returned 1 [0186.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.738] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5220) returned 1 [0186.738] CloseHandle (hObject=0x390) returned 1 [0186.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 0x220 [0186.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 0x220 [0186.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.739] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.739] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0186.741] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1464, lpOverlapped=0x0) returned 1 [0186.742] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1470, lpOverlapped=0x0) returned 1 [0186.743] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.743] CloseHandle (hObject=0x390) returned 1 [0186.744] CloseHandle (hObject=0x398) returned 1 [0186.744] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 0 [0186.744] SetEvent (hEvent=0x2fc) returned 1 [0186.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0186.745] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33828) returned 1 [0186.745] CloseHandle (hObject=0x398) returned 1 [0186.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf")) returned 0x220 [0186.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf")) returned 0x220 [0186.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0186.746] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.746] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0186.747] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x8424, lpOverlapped=0x0) returned 1 [0186.749] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8430, lpOverlapped=0x0) returned 1 [0186.751] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.751] CloseHandle (hObject=0x398) returned 1 [0186.751] CloseHandle (hObject=0x390) returned 1 [0186.751] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf")) returned 0 [0186.752] SetEvent (hEvent=0x2fc) returned 1 [0186.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.753] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4884) returned 1 [0186.753] CloseHandle (hObject=0x390) returned 1 [0186.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 0x220 [0186.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 0x220 [0186.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0186.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x360 [0186.892] ReadFile (in: hFile=0x384, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1314, lpOverlapped=0x0) returned 1 [0186.896] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1320, lpOverlapped=0x0) returned 1 [0186.897] WriteFile (in: hFile=0x360, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.897] CloseHandle (hObject=0x384) returned 1 [0186.897] CloseHandle (hObject=0x360) returned 1 [0186.897] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 0 [0186.897] SetEvent (hEvent=0x2fc) returned 1 [0186.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.904] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6552) returned 1 [0186.904] CloseHandle (hObject=0x394) returned 1 [0186.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 0x220 [0186.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 0x220 [0186.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0186.909] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.910] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.915] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1998, lpOverlapped=0x0) returned 1 [0186.918] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x19a0, lpOverlapped=0x0) returned 1 [0186.919] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.919] CloseHandle (hObject=0x370) returned 1 [0186.919] CloseHandle (hObject=0x39c) returned 1 [0186.920] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 0 [0186.920] SetEvent (hEvent=0x2fc) returned 1 [0186.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.921] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7112) returned 1 [0186.921] CloseHandle (hObject=0x39c) returned 1 [0186.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 0x220 [0186.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 0x220 [0186.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0186.922] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.922] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0186.923] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1bc8, lpOverlapped=0x0) returned 1 [0186.926] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1bd0, lpOverlapped=0x0) returned 1 [0186.927] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.927] CloseHandle (hObject=0x39c) returned 1 [0186.927] CloseHandle (hObject=0x370) returned 1 [0186.927] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 0 [0186.927] SetEvent (hEvent=0x2fc) returned 1 [0186.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0186.928] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4936) returned 1 [0186.928] CloseHandle (hObject=0x370) returned 1 [0186.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 0x220 [0186.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 0x220 [0186.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0186.929] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.929] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0186.930] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1348, lpOverlapped=0x0) returned 1 [0186.933] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1350, lpOverlapped=0x0) returned 1 [0186.935] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.935] CloseHandle (hObject=0x370) returned 1 [0186.935] CloseHandle (hObject=0x39c) returned 1 [0186.935] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 0 [0186.935] SetEvent (hEvent=0x2fc) returned 1 [0186.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0186.938] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5920) returned 1 [0186.938] CloseHandle (hObject=0x370) returned 1 [0186.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 0x220 [0186.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 0x220 [0186.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0186.939] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.939] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x394 [0186.940] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1720, lpOverlapped=0x0) returned 1 [0186.941] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1730, lpOverlapped=0x0) returned 1 [0186.943] WriteFile (in: hFile=0x394, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.943] CloseHandle (hObject=0x370) returned 1 [0186.943] CloseHandle (hObject=0x394) returned 1 [0186.943] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 0 [0186.943] SetEvent (hEvent=0x2fc) returned 1 [0186.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.944] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=5452) returned 1 [0186.945] CloseHandle (hObject=0x394) returned 1 [0186.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf")) returned 0x220 [0186.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf")) returned 0x220 [0186.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0186.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0186.945] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.945] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0186.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0186.947] ReadFile (in: hFile=0x394, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x154c, lpOverlapped=0x0) returned 1 [0186.949] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1550, lpOverlapped=0x0) returned 1 [0186.950] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0186.950] CloseHandle (hObject=0x394) returned 1 [0186.950] CloseHandle (hObject=0x370) returned 1 [0187.397] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf")) returned 0 [0187.523] SetEvent (hEvent=0x2fc) returned 1 [0187.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.565] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2342) returned 1 [0187.565] CloseHandle (hObject=0x37c) returned 1 [0187.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 0x220 [0187.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 0x220 [0187.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.566] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.566] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0187.568] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x926, lpOverlapped=0x0) returned 1 [0187.570] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x930, lpOverlapped=0x0) returned 1 [0187.571] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0187.571] CloseHandle (hObject=0x37c) returned 1 [0187.571] CloseHandle (hObject=0x38c) returned 1 [0187.571] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 0 [0187.572] SetEvent (hEvent=0x2fc) returned 1 [0187.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0187.573] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2738) returned 1 [0187.573] CloseHandle (hObject=0x38c) returned 1 [0187.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 0x220 [0187.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 0x220 [0187.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0187.573] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.574] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.574] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0187.575] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xab2, lpOverlapped=0x0) returned 1 [0187.577] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xac0, lpOverlapped=0x0) returned 1 [0187.578] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0187.578] CloseHandle (hObject=0x38c) returned 1 [0187.578] CloseHandle (hObject=0x37c) returned 1 [0187.579] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 0 [0187.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.580] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=2090) returned 1 [0187.580] CloseHandle (hObject=0x37c) returned 1 [0187.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf")) returned 0x220 [0187.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf")) returned 0x220 [0187.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.581] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.581] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0187.582] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x82a, lpOverlapped=0x0) returned 1 [0187.584] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x830, lpOverlapped=0x0) returned 1 [0187.585] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0187.585] CloseHandle (hObject=0x37c) returned 1 [0187.585] CloseHandle (hObject=0x38c) returned 1 [0187.585] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf")) returned 0 [0187.586] SetEvent (hEvent=0x2fc) returned 1 [0187.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0187.587] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=3262) returned 1 [0187.587] CloseHandle (hObject=0x38c) returned 1 [0187.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 0x220 [0187.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 0x220 [0187.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0187.589] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.589] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0187.589] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcbe, lpOverlapped=0x0) returned 1 [0187.683] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcc0, lpOverlapped=0x0) returned 1 [0187.685] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0187.685] CloseHandle (hObject=0x38c) returned 1 [0187.685] CloseHandle (hObject=0x37c) returned 1 [0187.685] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 0 [0187.685] SetEvent (hEvent=0x2fc) returned 1 [0187.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.687] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=1970) returned 1 [0187.687] CloseHandle (hObject=0x37c) returned 1 [0187.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 0x220 [0187.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 0x220 [0187.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0187.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0187.688] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.688] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0187.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0187.690] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7b2, lpOverlapped=0x0) returned 1 [0187.692] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7c0, lpOverlapped=0x0) returned 1 [0187.693] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0187.693] CloseHandle (hObject=0x37c) returned 1 [0187.693] CloseHandle (hObject=0x38c) returned 1 [0187.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 0 [0187.693] SetEvent (hEvent=0x2fc) returned 1 [0187.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.065] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31032) returned 1 [0188.065] CloseHandle (hObject=0x398) returned 1 [0188.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 0x220 [0188.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 0x220 [0188.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.172] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.172] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0188.173] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x7938, lpOverlapped=0x0) returned 1 [0188.175] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7940, lpOverlapped=0x0) returned 1 [0188.177] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.177] CloseHandle (hObject=0x344) returned 1 [0188.177] CloseHandle (hObject=0x39c) returned 1 [0188.177] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 0 [0188.178] SetEvent (hEvent=0x2fc) returned 1 [0188.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.179] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=73198) returned 1 [0188.179] CloseHandle (hObject=0x39c) returned 1 [0188.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 0x220 [0188.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 0x220 [0188.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0188.183] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.183] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0188.184] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x11dee, lpOverlapped=0x0) returned 1 [0188.187] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x11df0, lpOverlapped=0x0) returned 1 [0188.195] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.195] CloseHandle (hObject=0x39c) returned 1 [0188.196] CloseHandle (hObject=0x344) returned 1 [0188.196] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 0 [0188.196] SetEvent (hEvent=0x2fc) returned 1 [0188.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.266] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=38084) returned 1 [0188.266] CloseHandle (hObject=0x398) returned 1 [0188.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf")) returned 0x220 [0188.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf")) returned 0x220 [0188.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.267] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.267] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0188.269] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x94c4, lpOverlapped=0x0) returned 1 [0188.271] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x94d0, lpOverlapped=0x0) returned 1 [0188.272] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.272] CloseHandle (hObject=0x398) returned 1 [0188.273] CloseHandle (hObject=0x344) returned 1 [0188.273] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf")) returned 0 [0188.273] SetEvent (hEvent=0x2fc) returned 1 [0188.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.274] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=46516) returned 1 [0188.274] CloseHandle (hObject=0x344) returned 1 [0188.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 0x220 [0188.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 0x220 [0188.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.275] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.275] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.275] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xb5b4, lpOverlapped=0x0) returned 1 [0188.278] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xb5c0, lpOverlapped=0x0) returned 1 [0188.279] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.279] CloseHandle (hObject=0x344) returned 1 [0188.280] CloseHandle (hObject=0x398) returned 1 [0188.280] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 0 [0188.293] SetEvent (hEvent=0x2fc) returned 1 [0188.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.294] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12764) returned 1 [0188.294] CloseHandle (hObject=0x398) returned 1 [0188.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 0x220 [0188.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 0x220 [0188.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.295] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.295] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0188.299] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x31dc, lpOverlapped=0x0) returned 1 [0188.301] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x31e0, lpOverlapped=0x0) returned 1 [0188.302] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.302] CloseHandle (hObject=0x398) returned 1 [0188.302] CloseHandle (hObject=0x344) returned 1 [0188.303] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 0 [0188.303] SetEvent (hEvent=0x2fc) returned 1 [0188.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.304] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14420) returned 1 [0188.304] CloseHandle (hObject=0x344) returned 1 [0188.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 0x220 [0188.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 0x220 [0188.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.305] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.305] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.306] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3854, lpOverlapped=0x0) returned 1 [0188.308] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3860, lpOverlapped=0x0) returned 1 [0188.309] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.309] CloseHandle (hObject=0x344) returned 1 [0188.310] CloseHandle (hObject=0x398) returned 1 [0188.310] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 0 [0188.310] SetEvent (hEvent=0x2fc) returned 1 [0188.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.311] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11912) returned 1 [0188.311] CloseHandle (hObject=0x398) returned 1 [0188.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf")) returned 0x220 [0188.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf")) returned 0x220 [0188.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.312] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.312] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0188.313] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2e88, lpOverlapped=0x0) returned 1 [0188.315] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2e90, lpOverlapped=0x0) returned 1 [0188.316] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.316] CloseHandle (hObject=0x398) returned 1 [0188.316] CloseHandle (hObject=0x344) returned 1 [0188.317] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf")) returned 0 [0188.317] SetEvent (hEvent=0x2fc) returned 1 [0188.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0188.317] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12530) returned 1 [0188.318] CloseHandle (hObject=0x344) returned 1 [0188.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 0x220 [0188.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 0x220 [0188.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.420] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x30f2, lpOverlapped=0x0) returned 1 [0188.422] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3100, lpOverlapped=0x0) returned 1 [0188.423] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.423] CloseHandle (hObject=0x398) returned 1 [0188.424] CloseHandle (hObject=0x25c) returned 1 [0188.424] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 0 [0188.424] SetEvent (hEvent=0x2fc) returned 1 [0188.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.425] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=31068) returned 1 [0188.425] CloseHandle (hObject=0x25c) returned 1 [0188.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf")) returned 0x220 [0188.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf")) returned 0x220 [0188.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.426] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.426] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.427] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x795c, lpOverlapped=0x0) returned 1 [0188.429] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x7960, lpOverlapped=0x0) returned 1 [0188.431] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.431] CloseHandle (hObject=0x25c) returned 1 [0188.431] CloseHandle (hObject=0x398) returned 1 [0188.431] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf")) returned 0 [0188.432] SetEvent (hEvent=0x2fc) returned 1 [0188.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.433] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21054) returned 1 [0188.433] CloseHandle (hObject=0x398) returned 1 [0188.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf")) returned 0x220 [0188.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf")) returned 0x220 [0188.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.434] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.434] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.435] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x523e, lpOverlapped=0x0) returned 1 [0188.440] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x5240, lpOverlapped=0x0) returned 1 [0188.442] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.442] CloseHandle (hObject=0x398) returned 1 [0188.442] CloseHandle (hObject=0x25c) returned 1 [0188.442] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf")) returned 0 [0188.443] SetEvent (hEvent=0x2fc) returned 1 [0188.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.445] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11956) returned 1 [0188.445] CloseHandle (hObject=0x25c) returned 1 [0188.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 0x220 [0188.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 0x220 [0188.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.446] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.446] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.447] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2eb4, lpOverlapped=0x0) returned 1 [0188.448] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2ec0, lpOverlapped=0x0) returned 1 [0188.449] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.450] CloseHandle (hObject=0x25c) returned 1 [0188.451] CloseHandle (hObject=0x398) returned 1 [0188.451] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 0 [0188.451] SetEvent (hEvent=0x2fc) returned 1 [0188.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.452] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13648) returned 1 [0188.452] CloseHandle (hObject=0x398) returned 1 [0188.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf")) returned 0x220 [0188.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf")) returned 0x220 [0188.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.453] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.453] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.454] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3550, lpOverlapped=0x0) returned 1 [0188.489] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3560, lpOverlapped=0x0) returned 1 [0188.490] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.491] CloseHandle (hObject=0x398) returned 1 [0188.492] CloseHandle (hObject=0x25c) returned 1 [0188.492] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf")) returned 0 [0188.592] SetEvent (hEvent=0x2fc) returned 1 [0188.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.595] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=32984) returned 1 [0188.595] CloseHandle (hObject=0x25c) returned 1 [0188.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf")) returned 0x220 [0188.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf")) returned 0x220 [0188.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.596] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.596] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.598] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x80d8, lpOverlapped=0x0) returned 1 [0188.601] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x80e0, lpOverlapped=0x0) returned 1 [0188.602] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.602] CloseHandle (hObject=0x25c) returned 1 [0188.603] CloseHandle (hObject=0x398) returned 1 [0188.603] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287020.wmf")) returned 0 [0188.603] SetEvent (hEvent=0x2fc) returned 1 [0188.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.605] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=50898) returned 1 [0188.605] CloseHandle (hObject=0x398) returned 1 [0188.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf")) returned 0x220 [0188.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf")) returned 0x220 [0188.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.606] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.606] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.607] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xc6d2, lpOverlapped=0x0) returned 1 [0188.609] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xc6e0, lpOverlapped=0x0) returned 1 [0188.612] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.612] CloseHandle (hObject=0x398) returned 1 [0188.612] CloseHandle (hObject=0x25c) returned 1 [0188.612] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287024.wmf")) returned 0 [0188.612] SetEvent (hEvent=0x2fc) returned 1 [0188.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.614] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=52496) returned 1 [0188.614] CloseHandle (hObject=0x25c) returned 1 [0188.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf")) returned 0x220 [0188.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf")) returned 0x220 [0188.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.615] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.615] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.616] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xcd10, lpOverlapped=0x0) returned 1 [0188.618] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xcd20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xcd20, lpOverlapped=0x0) returned 1 [0188.622] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.622] CloseHandle (hObject=0x25c) returned 1 [0188.622] CloseHandle (hObject=0x398) returned 1 [0188.623] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287408.wmf")) returned 0 [0188.623] SetEvent (hEvent=0x2fc) returned 1 [0188.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.624] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=43020) returned 1 [0188.624] CloseHandle (hObject=0x398) returned 1 [0188.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf")) returned 0x220 [0188.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf")) returned 0x220 [0188.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.625] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.625] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.626] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa80c, lpOverlapped=0x0) returned 1 [0188.629] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa810, lpOverlapped=0x0) returned 1 [0188.631] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.631] CloseHandle (hObject=0x398) returned 1 [0188.631] CloseHandle (hObject=0x25c) returned 1 [0188.631] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287415.wmf")) returned 0 [0188.631] SetEvent (hEvent=0x2fc) returned 1 [0188.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.632] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=54972) returned 1 [0188.632] CloseHandle (hObject=0x25c) returned 1 [0188.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf")) returned 0x220 [0188.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf")) returned 0x220 [0188.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.633] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.633] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.752] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd6bc, lpOverlapped=0x0) returned 1 [0188.754] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd6c0, lpOverlapped=0x0) returned 1 [0188.757] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.757] CloseHandle (hObject=0x25c) returned 1 [0188.757] CloseHandle (hObject=0x398) returned 1 [0188.757] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0287417.wmf")) returned 0 [0188.760] SetEvent (hEvent=0x2fc) returned 1 [0188.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.772] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=40586) returned 1 [0188.772] CloseHandle (hObject=0x25c) returned 1 [0188.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf")) returned 0x220 [0188.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf")) returned 0x220 [0188.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.773] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.774] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x9e8a, lpOverlapped=0x0) returned 1 [0188.778] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9e90, lpOverlapped=0x0) returned 1 [0188.780] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.780] CloseHandle (hObject=0x25c) returned 1 [0188.780] CloseHandle (hObject=0x398) returned 1 [0188.781] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0290548.wmf")) returned 0 [0188.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.782] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8420) returned 1 [0188.782] CloseHandle (hObject=0x398) returned 1 [0188.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf")) returned 0x220 [0188.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf")) returned 0x220 [0188.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.783] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.783] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.784] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x20e4, lpOverlapped=0x0) returned 1 [0188.822] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x20f0, lpOverlapped=0x0) returned 1 [0188.823] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.823] CloseHandle (hObject=0x398) returned 1 [0188.823] CloseHandle (hObject=0x25c) returned 1 [0188.823] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292248.wmf")) returned 0 [0188.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.907] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=7012) returned 1 [0188.907] CloseHandle (hObject=0x398) returned 1 [0188.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf")) returned 0x220 [0188.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf")) returned 0x220 [0188.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.908] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.908] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.909] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b64, lpOverlapped=0x0) returned 1 [0188.911] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b70, lpOverlapped=0x0) returned 1 [0188.912] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.912] CloseHandle (hObject=0x398) returned 1 [0188.912] CloseHandle (hObject=0x25c) returned 1 [0188.912] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0292272.wmf")) returned 0 [0188.912] SetEvent (hEvent=0x2fc) returned 1 [0188.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.914] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=14302) returned 1 [0188.914] CloseHandle (hObject=0x25c) returned 1 [0188.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf")) returned 0x220 [0188.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf")) returned 0x220 [0188.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.914] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.915] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.915] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x37de, lpOverlapped=0x0) returned 1 [0188.917] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x37e0, lpOverlapped=0x0) returned 1 [0188.918] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.918] CloseHandle (hObject=0x25c) returned 1 [0188.919] CloseHandle (hObject=0x398) returned 1 [0188.919] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294989.wmf")) returned 0 [0188.919] SetEvent (hEvent=0x2fc) returned 1 [0188.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.920] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=24960) returned 1 [0188.920] CloseHandle (hObject=0x398) returned 1 [0188.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf")) returned 0x220 [0188.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf")) returned 0x220 [0188.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.921] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.921] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.922] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6180, lpOverlapped=0x0) returned 1 [0188.924] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6190, lpOverlapped=0x0) returned 1 [0188.962] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.962] CloseHandle (hObject=0x398) returned 1 [0188.962] CloseHandle (hObject=0x25c) returned 1 [0188.962] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0294991.wmf")) returned 0 [0188.963] SetEvent (hEvent=0x2fc) returned 1 [0188.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.964] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8626) returned 1 [0188.964] CloseHandle (hObject=0x25c) returned 1 [0188.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf")) returned 0x220 [0188.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf")) returned 0x220 [0188.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0188.965] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.965] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0188.966] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x21b2, lpOverlapped=0x0) returned 1 [0188.968] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x21c0, lpOverlapped=0x0) returned 1 [0188.969] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0188.969] CloseHandle (hObject=0x25c) returned 1 [0188.969] CloseHandle (hObject=0x398) returned 1 [0188.970] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0295069.wmf")) returned 0 [0188.970] SetEvent (hEvent=0x2fc) returned 1 [0188.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.971] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=58412) returned 1 [0188.971] CloseHandle (hObject=0x398) returned 1 [0188.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf")) returned 0x220 [0188.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf")) returned 0x220 [0188.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0188.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0188.972] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.972] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0188.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0188.973] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xe42c, lpOverlapped=0x0) returned 1 [0188.976] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xe430, lpOverlapped=0x0) returned 1 [0189.054] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.054] CloseHandle (hObject=0x398) returned 1 [0189.055] CloseHandle (hObject=0x25c) returned 1 [0189.055] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0296277.wmf")) returned 0 [0189.055] SetEvent (hEvent=0x2fc) returned 1 [0189.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.057] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15516) returned 1 [0189.057] CloseHandle (hObject=0x25c) returned 1 [0189.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf")) returned 0x220 [0189.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf")) returned 0x220 [0189.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.058] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.058] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.060] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3c9c, lpOverlapped=0x0) returned 1 [0189.061] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3ca0, lpOverlapped=0x0) returned 1 [0189.063] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.063] CloseHandle (hObject=0x25c) returned 1 [0189.065] CloseHandle (hObject=0x398) returned 1 [0189.065] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297727.wmf")) returned 0 [0189.065] SetEvent (hEvent=0x2fc) returned 1 [0189.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.067] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18750) returned 1 [0189.067] CloseHandle (hObject=0x398) returned 1 [0189.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf")) returned 0x220 [0189.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf")) returned 0x220 [0189.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.068] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.068] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.068] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x493e, lpOverlapped=0x0) returned 1 [0189.070] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4940, lpOverlapped=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.072] CloseHandle (hObject=0x398) returned 1 [0189.072] CloseHandle (hObject=0x25c) returned 1 [0189.072] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297757.wmf")) returned 0 [0189.072] SetEvent (hEvent=0x2fc) returned 1 [0189.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.073] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18784) returned 1 [0189.073] CloseHandle (hObject=0x25c) returned 1 [0189.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf")) returned 0x220 [0189.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf")) returned 0x220 [0189.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.074] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.074] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.075] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4960, lpOverlapped=0x0) returned 1 [0189.077] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4970, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4970, lpOverlapped=0x0) returned 1 [0189.078] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.078] CloseHandle (hObject=0x25c) returned 1 [0189.078] CloseHandle (hObject=0x398) returned 1 [0189.079] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0297759.wmf")) returned 0 [0189.079] SetEvent (hEvent=0x2fc) returned 1 [0189.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.080] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=17796) returned 1 [0189.080] CloseHandle (hObject=0x398) returned 1 [0189.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf")) returned 0x220 [0189.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf")) returned 0x220 [0189.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.082] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.082] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.083] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4584, lpOverlapped=0x0) returned 1 [0189.085] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4590, lpOverlapped=0x0) returned 1 [0189.086] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.086] CloseHandle (hObject=0x398) returned 1 [0189.086] CloseHandle (hObject=0x25c) returned 1 [0189.087] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0300862.wmf")) returned 0 [0189.087] SetEvent (hEvent=0x2fc) returned 1 [0189.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.089] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11022) returned 1 [0189.089] CloseHandle (hObject=0x25c) returned 1 [0189.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf")) returned 0x220 [0189.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf")) returned 0x220 [0189.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.089] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.089] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.091] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2b0e, lpOverlapped=0x0) returned 1 [0189.150] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2b10, lpOverlapped=0x0) returned 1 [0189.151] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.151] CloseHandle (hObject=0x25c) returned 1 [0189.152] CloseHandle (hObject=0x398) returned 1 [0189.152] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301044.wmf")) returned 0 [0189.254] SetEvent (hEvent=0x2fc) returned 1 [0189.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.256] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=10984) returned 1 [0189.256] CloseHandle (hObject=0x398) returned 1 [0189.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf")) returned 0x220 [0189.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf")) returned 0x220 [0189.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.258] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2ae8, lpOverlapped=0x0) returned 1 [0189.260] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2af0, lpOverlapped=0x0) returned 1 [0189.261] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.261] CloseHandle (hObject=0x398) returned 1 [0189.261] CloseHandle (hObject=0x25c) returned 1 [0189.261] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301052.wmf")) returned 0 [0189.261] SetEvent (hEvent=0x2fc) returned 1 [0189.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.262] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19034) returned 1 [0189.262] CloseHandle (hObject=0x25c) returned 1 [0189.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf")) returned 0x220 [0189.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf")) returned 0x220 [0189.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.263] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.264] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.265] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4a5a, lpOverlapped=0x0) returned 1 [0189.267] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4a60, lpOverlapped=0x0) returned 1 [0189.268] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.268] CloseHandle (hObject=0x25c) returned 1 [0189.268] CloseHandle (hObject=0x398) returned 1 [0189.269] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301418.wmf")) returned 0 [0189.269] SetEvent (hEvent=0x2fc) returned 1 [0189.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.270] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19962) returned 1 [0189.270] CloseHandle (hObject=0x398) returned 1 [0189.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf")) returned 0x220 [0189.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf")) returned 0x220 [0189.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0189.270] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.270] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.271] ReadFile (in: hFile=0x398, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4dfa, lpOverlapped=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4e00, lpOverlapped=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.314] CloseHandle (hObject=0x398) returned 1 [0189.314] CloseHandle (hObject=0x25c) returned 1 [0189.314] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0301432.wmf")) returned 0 [0189.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0189.327] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=4158) returned 1 [0189.327] CloseHandle (hObject=0x390) returned 1 [0189.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf")) returned 0x220 [0189.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf")) returned 0x220 [0189.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0189.328] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.328] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0189.329] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x103e, lpOverlapped=0x0) returned 1 [0189.458] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1040, lpOverlapped=0x0) returned 1 [0189.463] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.463] CloseHandle (hObject=0x390) returned 1 [0189.463] CloseHandle (hObject=0x344) returned 1 [0189.468] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304405.wmf")) returned 0 [0189.469] SetEvent (hEvent=0x2fc) returned 1 [0189.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0189.623] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18958) returned 1 [0189.623] CloseHandle (hObject=0x344) returned 1 [0189.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf")) returned 0x220 [0189.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf")) returned 0x220 [0189.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0189.624] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.624] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0189.625] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4a0e, lpOverlapped=0x0) returned 1 [0189.627] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4a10, lpOverlapped=0x0) returned 1 [0189.629] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.629] CloseHandle (hObject=0x344) returned 1 [0189.629] CloseHandle (hObject=0x390) returned 1 [0189.629] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0304853.wmf")) returned 0 [0189.629] SetEvent (hEvent=0x2fc) returned 1 [0189.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0189.630] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33264) returned 1 [0189.630] CloseHandle (hObject=0x390) returned 1 [0189.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg")) returned 0x220 [0189.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg")) returned 0x220 [0189.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0189.631] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.631] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0189.632] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x81f0, lpOverlapped=0x0) returned 1 [0189.636] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x8200, lpOverlapped=0x0) returned 1 [0189.637] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.638] CloseHandle (hObject=0x390) returned 1 [0189.638] CloseHandle (hObject=0x344) returned 1 [0189.638] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309598.jpg")) returned 0 [0189.638] SetEvent (hEvent=0x2fc) returned 1 [0189.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.642] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=43707) returned 1 [0189.642] CloseHandle (hObject=0x39c) returned 1 [0189.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg")) returned 0x220 [0189.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg")) returned 0x220 [0189.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.643] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.643] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0189.644] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xaabb, lpOverlapped=0x0) returned 1 [0189.648] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xaac0, lpOverlapped=0x0) returned 1 [0189.650] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.650] CloseHandle (hObject=0x39c) returned 1 [0189.650] CloseHandle (hObject=0x344) returned 1 [0189.650] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309664.jpg")) returned 0 [0189.650] SetEvent (hEvent=0x2fc) returned 1 [0189.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0189.652] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19162) returned 1 [0189.652] CloseHandle (hObject=0x344) returned 1 [0189.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg")) returned 0x220 [0189.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg")) returned 0x220 [0189.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0189.652] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.652] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.653] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ada, lpOverlapped=0x0) returned 1 [0189.655] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4ae0, lpOverlapped=0x0) returned 1 [0189.656] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.657] CloseHandle (hObject=0x344) returned 1 [0189.657] CloseHandle (hObject=0x39c) returned 1 [0189.657] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309705.jpg")) returned 0 [0189.657] SetEvent (hEvent=0x2fc) returned 1 [0189.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.658] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=6656) returned 1 [0189.658] CloseHandle (hObject=0x39c) returned 1 [0189.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf")) returned 0x220 [0189.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf")) returned 0x220 [0189.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.659] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.659] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0189.661] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1a00, lpOverlapped=0x0) returned 1 [0189.666] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1a10, lpOverlapped=0x0) returned 1 [0189.667] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.667] CloseHandle (hObject=0x39c) returned 1 [0189.668] CloseHandle (hObject=0x344) returned 1 [0189.668] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309902.wmf")) returned 0 [0189.668] SetEvent (hEvent=0x2fc) returned 1 [0189.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.670] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=8420) returned 1 [0189.670] CloseHandle (hObject=0x39c) returned 1 [0189.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf")) returned 0x220 [0189.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf")) returned 0x220 [0189.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.671] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.671] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0189.717] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x20e4, lpOverlapped=0x0) returned 1 [0189.719] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x20f0, lpOverlapped=0x0) returned 1 [0189.720] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.720] CloseHandle (hObject=0x39c) returned 1 [0189.720] CloseHandle (hObject=0x370) returned 1 [0189.720] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309904.wmf")) returned 0 [0189.721] SetEvent (hEvent=0x2fc) returned 1 [0189.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0189.722] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11064) returned 1 [0189.722] CloseHandle (hObject=0x370) returned 1 [0189.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf")) returned 0x220 [0189.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf")) returned 0x220 [0189.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0189.722] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.723] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.723] ReadFile (in: hFile=0x370, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2b38, lpOverlapped=0x0) returned 1 [0189.729] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2b40, lpOverlapped=0x0) returned 1 [0189.730] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.730] CloseHandle (hObject=0x370) returned 1 [0189.730] CloseHandle (hObject=0x39c) returned 1 [0189.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0309920.wmf")) returned 0 [0189.731] SetEvent (hEvent=0x2fc) returned 1 [0189.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.732] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=37146) returned 1 [0189.732] CloseHandle (hObject=0x39c) returned 1 [0189.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg")) returned 0x220 [0189.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg")) returned 0x220 [0189.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.733] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.733] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x370 [0189.733] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x911a, lpOverlapped=0x0) returned 1 [0189.749] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x9120, lpOverlapped=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x370, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.750] CloseHandle (hObject=0x39c) returned 1 [0189.750] CloseHandle (hObject=0x370) returned 1 [0189.757] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313896.jpg")) returned 0 [0189.758] SetEvent (hEvent=0x2fc) returned 1 [0189.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.801] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=33195) returned 1 [0189.801] CloseHandle (hObject=0x388) returned 1 [0189.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg")) returned 0x220 [0189.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg")) returned 0x220 [0189.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.802] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.802] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0189.803] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x81ab, lpOverlapped=0x0) returned 1 [0189.835] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x81b0, lpOverlapped=0x0) returned 1 [0189.837] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.837] CloseHandle (hObject=0x388) returned 1 [0189.837] CloseHandle (hObject=0x398) returned 1 [0189.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0313970.jpg")) returned 0 [0189.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.908] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=16954) returned 1 [0189.908] CloseHandle (hObject=0x39c) returned 1 [0189.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg")) returned 0x220 [0189.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg")) returned 0x220 [0189.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.909] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.909] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.910] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x423a, lpOverlapped=0x0) returned 1 [0189.912] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4240, lpOverlapped=0x0) returned 1 [0189.913] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.913] CloseHandle (hObject=0x39c) returned 1 [0189.913] CloseHandle (hObject=0x25c) returned 1 [0189.913] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0315612.jpg")) returned 0 [0189.914] SetEvent (hEvent=0x2fc) returned 1 [0189.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.914] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12280) returned 1 [0189.914] CloseHandle (hObject=0x25c) returned 1 [0189.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf")) returned 0x220 [0189.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf")) returned 0x220 [0189.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0189.915] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.915] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0189.916] ReadFile (in: hFile=0x25c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2ff8, lpOverlapped=0x0) returned 1 [0189.918] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3000, lpOverlapped=0x0) returned 1 [0189.919] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.920] CloseHandle (hObject=0x25c) returned 1 [0189.921] CloseHandle (hObject=0x39c) returned 1 [0189.921] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324694.wmf")) returned 0 [0189.921] SetEvent (hEvent=0x2fc) returned 1 [0189.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.922] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11902) returned 1 [0189.922] CloseHandle (hObject=0x39c) returned 1 [0189.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf")) returned 0x220 [0189.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf")) returned 0x220 [0189.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0189.923] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.923] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x25c [0189.923] ReadFile (in: hFile=0x39c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2e7e, lpOverlapped=0x0) returned 1 [0189.943] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2e80, lpOverlapped=0x0) returned 1 [0189.944] WriteFile (in: hFile=0x25c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.944] CloseHandle (hObject=0x39c) returned 1 [0189.944] CloseHandle (hObject=0x25c) returned 1 [0189.944] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0324704.wmf")) returned 0 [0189.945] SetEvent (hEvent=0x2fc) returned 1 [0189.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.959] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=12896) returned 1 [0189.959] CloseHandle (hObject=0x38c) returned 1 [0189.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg")) returned 0x220 [0189.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg")) returned 0x220 [0189.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.960] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.960] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0189.961] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3260, lpOverlapped=0x0) returned 1 [0189.964] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3270, lpOverlapped=0x0) returned 1 [0189.965] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.965] CloseHandle (hObject=0x38c) returned 1 [0189.965] CloseHandle (hObject=0x388) returned 1 [0189.965] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0337280.jpg")) returned 0 [0189.965] SetEvent (hEvent=0x2fc) returned 1 [0189.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.966] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=11485) returned 1 [0189.966] CloseHandle (hObject=0x388) returned 1 [0189.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg")) returned 0x220 [0189.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg")) returned 0x220 [0189.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0189.967] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.967] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0189.968] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x2cdd, lpOverlapped=0x0) returned 1 [0189.970] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x2ce0, lpOverlapped=0x0) returned 1 [0189.972] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0189.972] CloseHandle (hObject=0x388) returned 1 [0189.972] CloseHandle (hObject=0x38c) returned 1 [0189.972] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341344.jpg")) returned 0 [0189.972] SetEvent (hEvent=0x2fc) returned 1 [0189.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.973] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19565) returned 1 [0189.973] CloseHandle (hObject=0x38c) returned 1 [0189.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg")) returned 0x220 [0189.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg")) returned 0x220 [0189.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0189.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0189.974] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.974] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0189.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0189.975] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4c6d, lpOverlapped=0x0) returned 1 [0190.015] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4c70, lpOverlapped=0x0) returned 1 [0190.017] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.017] CloseHandle (hObject=0x38c) returned 1 [0190.018] CloseHandle (hObject=0x388) returned 1 [0190.018] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341439.jpg")) returned 0 [0190.018] SetEvent (hEvent=0x2fc) returned 1 [0190.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.019] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=19160) returned 1 [0190.019] CloseHandle (hObject=0x388) returned 1 [0190.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg")) returned 0x220 [0190.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg")) returned 0x220 [0190.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.020] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.020] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0190.021] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ad8, lpOverlapped=0x0) returned 1 [0190.190] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4ae0, lpOverlapped=0x0) returned 1 [0190.192] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.192] CloseHandle (hObject=0x388) returned 1 [0190.192] CloseHandle (hObject=0x38c) returned 1 [0190.192] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341447.jpg")) returned 0 [0190.192] SetEvent (hEvent=0x2fc) returned 1 [0190.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0190.193] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=21187) returned 1 [0190.193] CloseHandle (hObject=0x38c) returned 1 [0190.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg")) returned 0x220 [0190.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg")) returned 0x220 [0190.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0190.194] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.194] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.195] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x52c3, lpOverlapped=0x0) returned 1 [0190.221] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x52d0, lpOverlapped=0x0) returned 1 [0190.222] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.222] CloseHandle (hObject=0x38c) returned 1 [0190.222] CloseHandle (hObject=0x388) returned 1 [0190.222] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341448.jpg")) returned 0 [0190.394] SetEvent (hEvent=0x2fc) returned 1 [0190.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.394] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26739) returned 1 [0190.395] CloseHandle (hObject=0x388) returned 1 [0190.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg")) returned 0x220 [0190.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg")) returned 0x220 [0190.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.395] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.395] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x38c [0190.396] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x6873, lpOverlapped=0x0) returned 1 [0190.437] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6880, lpOverlapped=0x0) returned 1 [0190.440] WriteFile (in: hFile=0x38c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.440] CloseHandle (hObject=0x388) returned 1 [0190.442] CloseHandle (hObject=0x38c) returned 1 [0190.442] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341559.jpg")) returned 0 [0190.443] SetEvent (hEvent=0x2fc) returned 1 [0190.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0190.444] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=42135) returned 1 [0190.444] CloseHandle (hObject=0x38c) returned 1 [0190.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg")) returned 0x220 [0190.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg")) returned 0x220 [0190.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0190.445] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.445] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.446] ReadFile (in: hFile=0x38c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xa497, lpOverlapped=0x0) returned 1 [0190.530] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xa4a0, lpOverlapped=0x0) returned 1 [0190.532] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.532] CloseHandle (hObject=0x38c) returned 1 [0190.533] CloseHandle (hObject=0x388) returned 1 [0190.533] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341561.jpg")) returned 0 [0190.533] SetEvent (hEvent=0x2fc) returned 1 [0190.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.537] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=13845) returned 1 [0190.537] CloseHandle (hObject=0x388) returned 1 [0190.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg")) returned 0x220 [0190.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg")) returned 0x220 [0190.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.538] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.538] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x39c [0190.544] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3615, lpOverlapped=0x0) returned 1 [0190.577] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3620, lpOverlapped=0x0) returned 1 [0190.578] WriteFile (in: hFile=0x39c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.578] CloseHandle (hObject=0x388) returned 1 [0190.578] CloseHandle (hObject=0x39c) returned 1 [0190.578] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341636.jpg")) returned 0 [0190.578] SetEvent (hEvent=0x2fc) returned 1 [0190.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.581] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15863) returned 1 [0190.581] CloseHandle (hObject=0x388) returned 1 [0190.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg")) returned 0x220 [0190.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg")) returned 0x220 [0190.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.582] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.582] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x398 [0190.583] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3df7, lpOverlapped=0x0) returned 1 [0190.589] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3e00, lpOverlapped=0x0) returned 1 [0190.590] WriteFile (in: hFile=0x398, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.590] CloseHandle (hObject=0x388) returned 1 [0190.590] CloseHandle (hObject=0x398) returned 1 [0190.591] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341653.jpg")) returned 0 [0190.591] SetEvent (hEvent=0x2fc) returned 1 [0190.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.594] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=15743) returned 1 [0190.594] CloseHandle (hObject=0x388) returned 1 [0190.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg")) returned 0x220 [0190.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg")) returned 0x220 [0190.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.595] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x3d7f, lpOverlapped=0x0) returned 1 [0190.622] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x3d80, lpOverlapped=0x0) returned 1 [0190.623] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.623] CloseHandle (hObject=0x388) returned 1 [0190.623] CloseHandle (hObject=0x344) returned 1 [0190.623] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341654.jpg")) returned 0 [0190.624] SetEvent (hEvent=0x2fc) returned 1 [0190.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.625] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=20166) returned 1 [0190.625] CloseHandle (hObject=0x344) returned 1 [0190.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg")) returned 0x220 [0190.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg")) returned 0x220 [0190.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.625] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.626] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.627] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x4ec6, lpOverlapped=0x0) returned 1 [0190.628] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x4ed0, lpOverlapped=0x0) returned 1 [0190.630] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.630] CloseHandle (hObject=0x344) returned 1 [0190.630] CloseHandle (hObject=0x388) returned 1 [0190.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341738.jpg")) returned 0 [0190.630] SetEvent (hEvent=0x2fc) returned 1 [0190.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.631] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=18874) returned 1 [0190.631] CloseHandle (hObject=0x388) returned 1 [0190.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg")) returned 0x220 [0190.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg")) returned 0x220 [0190.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.632] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.633] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x49ba, lpOverlapped=0x0) returned 1 [0190.638] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x49c0, lpOverlapped=0x0) returned 1 [0190.640] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.640] CloseHandle (hObject=0x388) returned 1 [0190.640] CloseHandle (hObject=0x344) returned 1 [0190.640] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0341742.jpg")) returned 0 [0190.640] SetEvent (hEvent=0x2fc) returned 1 [0190.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.641] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=68572) returned 1 [0190.641] CloseHandle (hObject=0x344) returned 1 [0190.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg")) returned 0x220 [0190.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg")) returned 0x220 [0190.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.642] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.642] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.643] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x10bdc, lpOverlapped=0x0) returned 1 [0190.655] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x10be0, lpOverlapped=0x0) returned 1 [0190.657] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.657] CloseHandle (hObject=0x344) returned 1 [0190.657] CloseHandle (hObject=0x388) returned 1 [0190.658] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382836.jpg")) returned 0 [0190.658] SetEvent (hEvent=0x2fc) returned 1 [0190.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.658] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=118362) returned 1 [0190.658] CloseHandle (hObject=0x388) returned 1 [0190.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg")) returned 0x220 [0190.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg")) returned 0x220 [0190.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0190.786] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.786] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0190.787] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1ce5a, lpOverlapped=0x0) returned 1 [0190.792] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1ce60, lpOverlapped=0x0) returned 1 [0190.795] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.795] CloseHandle (hObject=0x390) returned 1 [0190.795] CloseHandle (hObject=0x37c) returned 1 [0190.795] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382925.jpg")) returned 0 [0190.795] SetEvent (hEvent=0x2fc) returned 1 [0190.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.804] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=112698) returned 1 [0190.804] CloseHandle (hObject=0x344) returned 1 [0190.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg")) returned 0x220 [0190.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg")) returned 0x220 [0190.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0190.805] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.805] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x388 [0190.806] ReadFile (in: hFile=0x344, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1b83a, lpOverlapped=0x0) returned 1 [0190.815] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1b840, lpOverlapped=0x0) returned 1 [0190.817] WriteFile (in: hFile=0x388, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.818] CloseHandle (hObject=0x344) returned 1 [0190.818] CloseHandle (hObject=0x388) returned 1 [0190.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382930.jpg")) returned 0 [0190.818] SetEvent (hEvent=0x2fc) returned 1 [0190.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.827] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=99539) returned 1 [0190.827] CloseHandle (hObject=0x388) returned 1 [0190.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg")) returned 0x220 [0190.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg")) returned 0x220 [0190.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0190.827] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.827] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x344 [0190.828] ReadFile (in: hFile=0x388, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x184d3, lpOverlapped=0x0) returned 1 [0190.847] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x184e0, lpOverlapped=0x0) returned 1 [0190.849] WriteFile (in: hFile=0x344, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.849] CloseHandle (hObject=0x388) returned 1 [0190.849] CloseHandle (hObject=0x344) returned 1 [0190.850] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382938.jpg")) returned 0 [0190.850] SetEvent (hEvent=0x2fc) returned 1 [0190.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0190.920] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=109477) returned 1 [0190.920] CloseHandle (hObject=0x37c) returned 1 [0190.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg")) returned 0x220 [0190.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg")) returned 0x220 [0190.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0190.920] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.920] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0190.922] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1aba5, lpOverlapped=0x0) returned 1 [0190.932] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1abb0, lpOverlapped=0x0) returned 1 [0190.935] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.935] CloseHandle (hObject=0x37c) returned 1 [0190.935] CloseHandle (hObject=0x390) returned 1 [0190.935] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382939.jpg")) returned 0 [0190.936] SetEvent (hEvent=0x2fc) returned 1 [0190.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0190.937] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=91450) returned 1 [0190.937] CloseHandle (hObject=0x390) returned 1 [0190.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg")) returned 0x220 [0190.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg")) returned 0x220 [0190.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0190.938] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.938] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0190.951] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1653a, lpOverlapped=0x0) returned 1 [0190.956] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x16540, lpOverlapped=0x0) returned 1 [0190.958] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0190.958] CloseHandle (hObject=0x390) returned 1 [0190.959] CloseHandle (hObject=0x37c) returned 1 [0190.959] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382942.jpg")) returned 0 [0190.959] SetEvent (hEvent=0x2fc) returned 1 [0190.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0190.960] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=81437) returned 1 [0190.960] CloseHandle (hObject=0x37c) returned 1 [0190.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg")) returned 0x220 [0190.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg")) returned 0x220 [0190.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0190.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0190.960] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.961] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0190.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0190.961] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x13e1d, lpOverlapped=0x0) returned 1 [0191.187] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x13e20, lpOverlapped=0x0) returned 1 [0191.190] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.190] CloseHandle (hObject=0x37c) returned 1 [0191.190] CloseHandle (hObject=0x390) returned 1 [0191.191] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382944.jpg")) returned 0 [0191.191] SetEvent (hEvent=0x2fc) returned 1 [0191.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.195] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=88703) returned 1 [0191.195] CloseHandle (hObject=0x390) returned 1 [0191.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg")) returned 0x220 [0191.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg")) returned 0x220 [0191.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.196] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.196] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0191.197] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x15a7f, lpOverlapped=0x0) returned 1 [0191.203] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x15a80, lpOverlapped=0x0) returned 1 [0191.205] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.205] CloseHandle (hObject=0x390) returned 1 [0191.205] CloseHandle (hObject=0x37c) returned 1 [0191.205] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382954.jpg")) returned 0 [0191.206] SetEvent (hEvent=0x2fc) returned 1 [0191.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.207] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=90095) returned 1 [0191.207] CloseHandle (hObject=0x37c) returned 1 [0191.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg")) returned 0x220 [0191.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg")) returned 0x220 [0191.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.207] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.208] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0191.209] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x15fef, lpOverlapped=0x0) returned 1 [0191.212] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x15ff0, lpOverlapped=0x0) returned 1 [0191.214] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.215] CloseHandle (hObject=0x37c) returned 1 [0191.215] CloseHandle (hObject=0x390) returned 1 [0191.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382955.jpg")) returned 0 [0191.215] SetEvent (hEvent=0x2fc) returned 1 [0191.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.216] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=109037) returned 1 [0191.217] CloseHandle (hObject=0x390) returned 1 [0191.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg")) returned 0x220 [0191.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg")) returned 0x220 [0191.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.217] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.217] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0191.218] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1a9ed, lpOverlapped=0x0) returned 1 [0191.222] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1a9f0, lpOverlapped=0x0) returned 1 [0191.224] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.224] CloseHandle (hObject=0x390) returned 1 [0191.224] CloseHandle (hObject=0x37c) returned 1 [0191.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382957.jpg")) returned 0 [0191.225] SetEvent (hEvent=0x2fc) returned 1 [0191.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.226] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=103399) returned 1 [0191.226] CloseHandle (hObject=0x37c) returned 1 [0191.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg")) returned 0x220 [0191.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg")) returned 0x220 [0191.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0191.227] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x193e7, lpOverlapped=0x0) returned 1 [0191.507] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x193f0, lpOverlapped=0x0) returned 1 [0191.509] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.509] CloseHandle (hObject=0x37c) returned 1 [0191.510] CloseHandle (hObject=0x390) returned 1 [0191.511] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382958.jpg")) returned 0 [0191.511] SetEvent (hEvent=0x2fc) returned 1 [0191.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.512] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=114423) returned 1 [0191.512] CloseHandle (hObject=0x390) returned 1 [0191.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg")) returned 0x220 [0191.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg")) returned 0x220 [0191.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.513] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.513] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0191.514] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1bef7, lpOverlapped=0x0) returned 1 [0191.518] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1bf00, lpOverlapped=0x0) returned 1 [0191.520] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.521] CloseHandle (hObject=0x390) returned 1 [0191.521] CloseHandle (hObject=0x37c) returned 1 [0191.521] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382962.jpg")) returned 0 [0191.521] SetEvent (hEvent=0x2fc) returned 1 [0191.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.522] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=97774) returned 1 [0191.522] CloseHandle (hObject=0x37c) returned 1 [0191.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg")) returned 0x220 [0191.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg")) returned 0x220 [0191.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0191.524] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x17dee, lpOverlapped=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x17df0, lpOverlapped=0x0) returned 1 [0191.529] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.529] CloseHandle (hObject=0x37c) returned 1 [0191.529] CloseHandle (hObject=0x390) returned 1 [0191.529] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382963.jpg")) returned 0 [0191.530] SetEvent (hEvent=0x2fc) returned 1 [0191.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.531] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=113410) returned 1 [0191.531] CloseHandle (hObject=0x390) returned 1 [0191.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg")) returned 0x220 [0191.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg")) returned 0x220 [0191.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.531] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.532] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0191.532] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x1bb02, lpOverlapped=0x0) returned 1 [0191.536] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x1bb10, lpOverlapped=0x0) returned 1 [0191.538] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.538] CloseHandle (hObject=0x390) returned 1 [0191.539] CloseHandle (hObject=0x37c) returned 1 [0191.539] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382965.jpg")) returned 0 [0191.539] SetEvent (hEvent=0x2fc) returned 1 [0191.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.540] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=100488) returned 1 [0191.540] CloseHandle (hObject=0x37c) returned 1 [0191.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg")) returned 0x220 [0191.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg")) returned 0x220 [0191.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0191.541] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x18888, lpOverlapped=0x0) returned 1 [0191.877] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x18890, lpOverlapped=0x0) returned 1 [0191.880] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.880] CloseHandle (hObject=0x37c) returned 1 [0191.880] CloseHandle (hObject=0x390) returned 1 [0191.880] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0382966.jpg")) returned 0 [0191.881] SetEvent (hEvent=0x2fc) returned 1 [0191.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.882] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=102633) returned 1 [0191.882] CloseHandle (hObject=0x390) returned 1 [0191.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg")) returned 0x220 [0191.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg")) returned 0x220 [0191.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.883] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.883] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0191.884] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x190e9, lpOverlapped=0x0) returned 1 [0191.887] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x190f0, lpOverlapped=0x0) returned 1 [0191.889] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.889] CloseHandle (hObject=0x390) returned 1 [0191.889] CloseHandle (hObject=0x37c) returned 1 [0191.889] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384862.jpg")) returned 0 [0191.890] SetEvent (hEvent=0x2fc) returned 1 [0191.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.891] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=97145) returned 1 [0191.891] CloseHandle (hObject=0x37c) returned 1 [0191.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 0x220 [0191.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 0x220 [0191.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.892] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.892] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0191.893] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x17b79, lpOverlapped=0x0) returned 1 [0191.896] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x17b80, lpOverlapped=0x0) returned 1 [0191.898] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.899] CloseHandle (hObject=0x37c) returned 1 [0191.899] CloseHandle (hObject=0x390) returned 1 [0191.899] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384885.jpg")) returned 0 [0191.899] SetEvent (hEvent=0x2fc) returned 1 [0191.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.900] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=81971) returned 1 [0191.900] CloseHandle (hObject=0x390) returned 1 [0191.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg")) returned 0x220 [0191.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg")) returned 0x220 [0191.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.901] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.901] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x37c [0191.902] ReadFile (in: hFile=0x390, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x14033, lpOverlapped=0x0) returned 1 [0191.905] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x14040, lpOverlapped=0x0) returned 1 [0191.907] WriteFile (in: hFile=0x37c, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0191.907] CloseHandle (hObject=0x390) returned 1 [0191.907] CloseHandle (hObject=0x37c) returned 1 [0191.907] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384888.jpg")) returned 0 [0191.908] SetEvent (hEvent=0x2fc) returned 1 [0191.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.908] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=55542) returned 1 [0191.908] CloseHandle (hObject=0x37c) returned 1 [0191.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg")) returned 0x220 [0191.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg")) returned 0x220 [0191.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0191.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0191.909] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.909] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0191.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x390 [0191.910] ReadFile (in: hFile=0x37c, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0xd8f6, lpOverlapped=0x0) returned 1 [0192.365] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xd900, lpOverlapped=0x0) returned 1 [0192.367] WriteFile (in: hFile=0x390, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0192.367] CloseHandle (hObject=0x37c) returned 1 [0192.367] CloseHandle (hObject=0x390) returned 1 [0192.367] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0384895.jpg")) returned 0 [0192.368] SetEvent (hEvent=0x2fc) returned 1 [0192.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0193.124] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x399f8a8 | out: lpFileSize=0x399f8a8*=26942) returned 1 [0193.124] CloseHandle (hObject=0x254) returned 1 [0193.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg")) returned 0x220 [0193.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg")) returned 0x220 [0193.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0193.125] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0193.125] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x399f870 | out: lpNewFilePointer=0x0) returned 1 [0193.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x258 [0193.126] ReadFile (in: hFile=0x254, lpBuffer=0x3e04020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x399f87c, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesRead=0x399f87c*=0x693e, lpOverlapped=0x0) returned 1 [0193.150] WriteFile (in: hFile=0x258, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0x6940, lpOverlapped=0x0) returned 1 [0193.151] WriteFile (in: hFile=0x258, lpBuffer=0x3e04020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x399f860, lpOverlapped=0x0 | out: lpBuffer=0x3e04020*, lpNumberOfBytesWritten=0x399f860*=0xf2, lpOverlapped=0x0) returned 1 [0193.151] CloseHandle (hObject=0x254) returned 1 [0193.152] CloseHandle (hObject=0x258) returned 1 [0193.152] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0386764.jpg")) returned 0 [0193.152] GetProcessHeap () returned 0xfd0000 [0193.152] RtlAllocateHeap (HeapHandle=0xfd0000, Flags=0x0, Size=0x50) returned 0x4029538 [0193.152] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0193.152] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0193.152] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0193.152] GetProcessHeap () returned 0xfd0000 [0193.152] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x4029538 | out: hHeap=0xfd0000) returned 1 [0193.152] SetEvent (hEvent=0x300) returned 1 [0193.152] SetEvent (hEvent=0x2fc) returned 1 [0193.152] SetEvent (hEvent=0x304) returned 1 [0193.152] GetProcessHeap () returned 0xfd0000 [0193.153] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3e04020 | out: hHeap=0xfd0000) returned 1 [0193.157] GetProcessHeap () returned 0xfd0000 [0193.157] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x100ca40 | out: hHeap=0xfd0000) returned 1 [0193.157] GetProcessHeap () returned 0xfd0000 [0193.158] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a00078 | out: hHeap=0xfd0000) returned 1 [0193.159] GetProcessHeap () returned 0xfd0000 [0193.159] HeapFree (in: hHeap=0xfd0000, dwFlags=0x0, lpMem=0x3a10080 | out: hHeap=0xfd0000) returned 1 Thread: id = 92 os_tid = 0xed8 Thread: id = 93 os_tid = 0xedc Thread: id = 133 os_tid = 0xd7c Process: id = "10" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x36163000" os_pid = "0xd58" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xd48" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 53 os_tid = 0xd5c [0137.785] GetProcessHeap () returned 0x1070000 [0137.785] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x30) returned 0x10868a0 [0137.785] GetProcessHeap () returned 0x1070000 [0137.785] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x3310) returned 0x10869b0 [0137.788] GetProcessHeap () returned 0x1070000 [0137.788] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x300) returned 0x1089cc8 [0137.789] GetProcessHeap () returned 0x1070000 [0137.789] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x10) returned 0x107ae30 [0137.789] GetTickCount () returned 0x1138af0 [0137.789] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xdbf900, cchData=32 | out: lpLCData="\x03") returned 16 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x10) returned 0x107af38 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20a) returned 0x1089fd0 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20a) returned 0x108a1e8 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20a) returned 0x108a400 [0137.790] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x108a400, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a400 | out: hHeap=0x1070000) returned 1 [0137.790] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1089fd0 | out: hHeap=0x1070000) returned 1 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a1e8 | out: hHeap=0x1070000) returned 1 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107af38 | out: hHeap=0x1070000) returned 1 [0137.790] GetVersion () returned 0x23f00206 [0137.790] GetCurrentProcess () returned 0xffffffff [0137.790] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xdbf894 | out: TokenHandle=0xdbf894*=0x1dc) returned 1 [0137.790] GetTokenInformation (in: TokenHandle=0x1dc, TokenInformationClass=0x14, TokenInformation=0xdbf88c, TokenInformationLength=0x4, ReturnLength=0xdbf890 | out: TokenInformation=0xdbf88c, ReturnLength=0xdbf890) returned 1 [0137.790] CloseHandle (hObject=0x1dc) returned 1 [0137.790] GetProcessHeap () returned 0x1070000 [0137.790] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20) returned 0x1074d60 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20a) returned 0x1089fd0 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20a) returned 0x108a1e8 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1089fd0 | out: hHeap=0x1070000) returned 1 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a1e8 | out: hHeap=0x1070000) returned 1 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20) returned 0x1074f78 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x1e) returned 0x1072e70 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1e) returned 0x1074580 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x90) returned 0x107b138 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107b138 | out: hHeap=0x1070000) returned 1 [0137.791] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1072e70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074580 | out: hHeap=0x1070000) returned 1 [0137.791] GetProcessHeap () returned 0x1070000 [0137.791] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074f78 | out: hHeap=0x1070000) returned 1 [0137.791] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xdbf84c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xdbf84c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1072e70 | out: hHeap=0x1070000) returned 1 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x30) returned 0x10867f8 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x2a) returned 0x10866e0 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlReAllocateHeap (Heap=0x1070000, Flags=0x0, Ptr=0x10866e0, Size=0x52) returned 0x1074b30 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10867f8 | out: hHeap=0x1070000) returned 1 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074b30 | out: hHeap=0x1070000) returned 1 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1c) returned 0x1072e70 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1c) returned 0x1074f78 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20) returned 0x1074580 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x1e) returned 0x10745a8 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1e) returned 0x1074b30 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x90) returned 0x107b138 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107b138 | out: hHeap=0x1070000) returned 1 [0137.792] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x10745a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074b30 | out: hHeap=0x1070000) returned 1 [0137.792] GetProcessHeap () returned 0x1070000 [0137.792] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074580 | out: hHeap=0x1070000) returned 1 [0137.792] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xdbf834, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xdbf834*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10745a8 | out: hHeap=0x1070000) returned 1 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x40) returned 0x107bee8 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x3a) returned 0x107bf78 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlReAllocateHeap (Heap=0x1070000, Flags=0x0, Ptr=0x107bf78, Size=0x72) returned 0x107b070 [0137.793] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x1dc [0137.793] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x102 [0137.793] CloseHandle (hObject=0x1dc) returned 1 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107bee8 | out: hHeap=0x1070000) returned 1 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107b070 | out: hHeap=0x1070000) returned 1 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20) returned 0x108a070 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x1e) returned 0x108a200 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1e) returned 0x108a2c8 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x90) returned 0x107b138 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107b138 | out: hHeap=0x1070000) returned 1 [0137.793] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x108a200, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.793] GetProcessHeap () returned 0x1070000 [0137.793] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a2c8 | out: hHeap=0x1070000) returned 1 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a070 | out: hHeap=0x1070000) returned 1 [0137.794] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xdbf81c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xdbf81c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a200 | out: hHeap=0x1070000) returned 1 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x40) returned 0x107bee8 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x3a) returned 0x107bf78 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] RtlReAllocateHeap (Heap=0x1070000, Flags=0x0, Ptr=0x107bf78, Size=0x72) returned 0x107b070 [0137.794] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0137.794] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x1dc [0137.794] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x0 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107bee8 | out: hHeap=0x1070000) returned 1 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107b070 | out: hHeap=0x1070000) returned 1 [0137.794] ReleaseMutex (hMutex=0x1dc) returned 1 [0137.794] CloseHandle (hObject=0x1dc) returned 1 [0137.794] GetVersion () returned 0x23f00206 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x10) returned 0x107ad28 [0137.794] GetProcessHeap () returned 0x1070000 [0137.794] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20a) returned 0x108a3d8 [0137.794] GetCurrentProcess () returned 0xffffffff [0137.795] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xdbf85c | out: TokenHandle=0xdbf85c*=0x1dc) returned 1 [0137.795] GetTokenInformation (in: TokenHandle=0x1dc, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xdbf874 | out: TokenInformation=0x0, ReturnLength=0xdbf874) returned 0 [0137.795] GetProcessHeap () returned 0x1070000 [0137.795] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x140) returned 0x107b458 [0137.795] GetTokenInformation (in: TokenHandle=0x1dc, TokenInformationClass=0x2, TokenInformation=0x107b458, TokenInformationLength=0x140, ReturnLength=0xdbf874 | out: TokenInformation=0x107b458, ReturnLength=0xdbf874) returned 1 [0137.795] AllocateAndInitializeSid (in: pIdentifierAuthority=0xdbf868, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xdbf870 | out: pSid=0xdbf870*=0x107af38*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0137.795] EqualSid (pSid1=0x107af38*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x107b4cc*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4))) returned 0 [0137.795] EqualSid (pSid1=0x107af38*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x107b4e8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0137.795] EqualSid (pSid1=0x107af38*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x107b4f4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72)) returned 0 [0137.795] EqualSid (pSid1=0x107af38*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x107b500*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0137.795] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x107b500*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), Name=0xdbf440, cchName=0xdbf874, ReferencedDomainName=0xdbf64c, cchReferencedDomainName=0xdbf874, peUse=0xdbf858 | out: Name="Administrators", cchName=0xdbf874, ReferencedDomainName="BUILTIN", cchReferencedDomainName=0xdbf874, peUse=0xdbf858) returned 1 [0137.817] GetProcessHeap () returned 0x1070000 [0137.817] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107b458 | out: hHeap=0x1070000) returned 1 [0137.817] GetProcessHeap () returned 0x1070000 [0137.817] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x50) returned 0x107aa58 [0137.817] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0137.817] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0137.817] Wow64DisableWow64FsRedirection (in: OldValue=0xdbf890 | out: OldValue=0xdbf890*=0x0) returned 1 [0137.817] GetProcessHeap () returned 0x1070000 [0137.817] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107aa58 | out: hHeap=0x1070000) returned 1 [0137.818] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x108a3d8, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0137.820] ShellExecuteExW (in: pExecInfo=0xdbf834*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xdbf834*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0190.910] GetProcessHeap () returned 0x1070000 [0190.910] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x50) returned 0x10bd488 [0190.910] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0190.910] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0190.910] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0190.910] GetProcessHeap () returned 0x1070000 [0190.910] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10bd488 | out: hHeap=0x1070000) returned 1 [0190.910] GetProcessHeap () returned 0x1070000 [0190.910] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x108a3d8 | out: hHeap=0x1070000) returned 1 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107ad28 | out: hHeap=0x1070000) returned 1 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20) returned 0x10b9478 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x1e) returned 0x10b94a0 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1e) returned 0x10b9568 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x90) returned 0x10abb28 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10abb28 | out: hHeap=0x1070000) returned 1 [0190.911] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x10b94a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10b9568 | out: hHeap=0x1070000) returned 1 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10b9478 | out: hHeap=0x1070000) returned 1 [0190.911] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xdbf81c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xdbf81c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10b94a0 | out: hHeap=0x1070000) returned 1 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x40) returned 0x1090648 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x3a) returned 0x1090498 [0190.911] GetProcessHeap () returned 0x1070000 [0190.911] RtlReAllocateHeap (Heap=0x1070000, Flags=0x0, Ptr=0x1090498, Size=0x72) returned 0x109abc0 [0190.911] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0190.911] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x24c [0190.912] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x0 [0190.912] GetProcessHeap () returned 0x1070000 [0190.912] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1090648 | out: hHeap=0x1070000) returned 1 [0190.912] GetProcessHeap () returned 0x1070000 [0190.912] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x109abc0 | out: hHeap=0x1070000) returned 1 [0190.912] ReleaseMutex (hMutex=0x24c) returned 1 [0190.912] CloseHandle (hObject=0x24c) returned 1 [0190.912] Sleep (dwMilliseconds=0x64) [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x20) returned 0x10b94a0 [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x1e) returned 0x10b9478 [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x1e) returned 0x10b9568 [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x90) returned 0x10abb28 [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10abb28 | out: hHeap=0x1070000) returned 1 [0191.270] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x10b9478, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10b9568 | out: hHeap=0x1070000) returned 1 [0191.270] GetProcessHeap () returned 0x1070000 [0191.270] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10b94a0 | out: hHeap=0x1070000) returned 1 [0191.270] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xdbf81c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xdbf81c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.271] GetProcessHeap () returned 0x1070000 [0191.271] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10b9478 | out: hHeap=0x1070000) returned 1 [0191.271] GetProcessHeap () returned 0x1070000 [0191.271] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x0, Size=0x40) returned 0x10903c0 [0191.271] GetProcessHeap () returned 0x1070000 [0191.271] RtlAllocateHeap (HeapHandle=0x1070000, Flags=0x8, Size=0x3a) returned 0x1090498 [0191.271] GetProcessHeap () returned 0x1070000 [0191.271] RtlReAllocateHeap (Heap=0x1070000, Flags=0x0, Ptr=0x1090498, Size=0x72) returned 0x109adc0 [0191.271] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x24c [0191.272] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x102 [0191.272] CloseHandle (hObject=0x24c) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10903c0 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x109adc0 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1072e70 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074f78 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1074d60 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x107ae30 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x1089cc8 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.272] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10869b0 | out: hHeap=0x1070000) returned 1 [0191.272] GetProcessHeap () returned 0x1070000 [0191.273] HeapFree (in: hHeap=0x1070000, dwFlags=0x0, lpMem=0x10868a0 | out: hHeap=0x1070000) returned 1 [0191.273] ExitProcess (uExitCode=0x0) Thread: id = 54 os_tid = 0xd60 Thread: id = 57 os_tid = 0xd84 Thread: id = 58 os_tid = 0xd88 Thread: id = 61 os_tid = 0xdac Thread: id = 62 os_tid = 0xdb0 Thread: id = 63 os_tid = 0xdb4 Thread: id = 64 os_tid = 0xdb8 Thread: id = 80 os_tid = 0xdd8 Process: id = "11" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x31542000" os_pid = "0xd68" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0xa1c" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 55 os_tid = 0xd6c [0139.225] GetProcessHeap () returned 0x1510000 [0139.225] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x30) returned 0x15236b0 [0139.225] GetProcessHeap () returned 0x1510000 [0139.225] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x3310) returned 0x152f8c0 [0139.231] GetProcessHeap () returned 0x1510000 [0139.231] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x300) returned 0x1522c48 [0139.232] GetProcessHeap () returned 0x1510000 [0139.232] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x10) returned 0x152e410 [0139.232] GetTickCount () returned 0x113909d [0139.232] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xfdfcc8, cchData=32 | out: lpLCData="\x03") returned 16 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x10) returned 0x1532c20 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20a) returned 0x1523928 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20a) returned 0x152e4d0 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20a) returned 0x1532fe0 [0139.233] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1532fe0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0xa2 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1532fe0 | out: hHeap=0x1510000) returned 1 [0139.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1523928 | out: hHeap=0x1510000) returned 1 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x152e4d0 | out: hHeap=0x1510000) returned 1 [0139.233] GetProcessHeap () returned 0x1510000 [0139.233] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1532c20 | out: hHeap=0x1510000) returned 1 [0139.233] GetVersion () returned 0x23f00206 [0139.233] GetCurrentProcess () returned 0xffffffff [0139.234] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xfdfc5c | out: TokenHandle=0xfdfc5c*=0x1fc) returned 1 [0139.234] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x14, TokenInformation=0xfdfc54, TokenInformationLength=0x4, ReturnLength=0xfdfc58 | out: TokenInformation=0xfdfc54, ReturnLength=0xfdfc58) returned 1 [0139.234] CloseHandle (hObject=0x1fc) returned 1 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20) returned 0x151b0c8 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20a) returned 0x1523928 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20a) returned 0x152e4d0 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1523928 | out: hHeap=0x1510000) returned 1 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x152e4d0 | out: hHeap=0x1510000) returned 1 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20) returned 0x151b168 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x1e) returned 0x151b190 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1e) returned 0x1532e30 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x90) returned 0x1522208 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1522208 | out: hHeap=0x1510000) returned 1 [0139.234] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x151b190, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1532e30 | out: hHeap=0x1510000) returned 1 [0139.234] GetProcessHeap () returned 0x1510000 [0139.234] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151b168 | out: hHeap=0x1510000) returned 1 [0139.234] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfdfc14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfdfc14*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151b190 | out: hHeap=0x1510000) returned 1 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x30) returned 0x1523598 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x2a) returned 0x1523608 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlReAllocateHeap (Heap=0x1510000, Flags=0x0, Ptr=0x1523608, Size=0x52) returned 0x151e718 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1523598 | out: hHeap=0x1510000) returned 1 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151e718 | out: hHeap=0x1510000) returned 1 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1c) returned 0x151b168 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1c) returned 0x151b190 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20) returned 0x1532c78 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x1e) returned 0x1532e80 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1e) returned 0x1532c50 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x90) returned 0x1522208 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1522208 | out: hHeap=0x1510000) returned 1 [0139.235] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1532e80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1532c50 | out: hHeap=0x1510000) returned 1 [0139.235] GetProcessHeap () returned 0x1510000 [0139.235] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1532c78 | out: hHeap=0x1510000) returned 1 [0139.235] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfdfbfc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfdfbfc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1532e80 | out: hHeap=0x1510000) returned 1 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x40) returned 0x1522758 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x3a) returned 0x1522638 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlReAllocateHeap (Heap=0x1510000, Flags=0x0, Ptr=0x1522638, Size=0x72) returned 0x151fd70 [0139.236] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x1fc [0139.236] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0139.236] CloseHandle (hObject=0x1fc) returned 1 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1522758 | out: hHeap=0x1510000) returned 1 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151fd70 | out: hHeap=0x1510000) returned 1 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20) returned 0x15332c0 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x1e) returned 0x1533360 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1e) returned 0x1533220 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x90) returned 0x1522208 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1522208 | out: hHeap=0x1510000) returned 1 [0139.236] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1533360, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1533220 | out: hHeap=0x1510000) returned 1 [0139.236] GetProcessHeap () returned 0x1510000 [0139.236] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15332c0 | out: hHeap=0x1510000) returned 1 [0139.237] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfdfbe4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfdfbe4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1533360 | out: hHeap=0x1510000) returned 1 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x40) returned 0x1522878 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x3a) returned 0x15223b0 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] RtlReAllocateHeap (Heap=0x1510000, Flags=0x0, Ptr=0x15223b0, Size=0x72) returned 0x151fd70 [0139.237] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0139.237] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x1fc [0139.237] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1522878 | out: hHeap=0x1510000) returned 1 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151fd70 | out: hHeap=0x1510000) returned 1 [0139.237] ReleaseMutex (hMutex=0x1fc) returned 1 [0139.237] CloseHandle (hObject=0x1fc) returned 1 [0139.237] GetVersion () returned 0x23f00206 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x10) returned 0x15337d0 [0139.237] GetProcessHeap () returned 0x1510000 [0139.237] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20a) returned 0x1523928 [0139.237] GetCurrentProcess () returned 0xffffffff [0139.237] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xfdfc24 | out: TokenHandle=0xfdfc24*=0x1fc) returned 1 [0139.237] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xfdfc3c | out: TokenInformation=0x0, ReturnLength=0xfdfc3c) returned 0 [0139.237] GetProcessHeap () returned 0x1510000 [0139.238] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x140) returned 0x15212d8 [0139.238] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x2, TokenInformation=0x15212d8, TokenInformationLength=0x140, ReturnLength=0xfdfc3c | out: TokenInformation=0x15212d8, ReturnLength=0xfdfc3c) returned 1 [0139.238] AllocateAndInitializeSid (in: pIdentifierAuthority=0xfdfc30, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xfdfc38 | out: pSid=0xfdfc38*=0x1533758*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0139.238] EqualSid (pSid1=0x1533758*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x152134c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4))) returned 0 [0139.238] EqualSid (pSid1=0x1533758*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1521368*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0139.238] EqualSid (pSid1=0x1533758*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1521374*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72)) returned 0 [0139.238] EqualSid (pSid1=0x1533758*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1521380*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0139.238] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x1521380*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), Name=0xfdf808, cchName=0xfdfc3c, ReferencedDomainName=0xfdfa14, cchReferencedDomainName=0xfdfc3c, peUse=0xfdfc20 | out: Name="Administrators", cchName=0xfdfc3c, ReferencedDomainName="BUILTIN", cchReferencedDomainName=0xfdfc3c, peUse=0xfdfc20) returned 1 [0139.242] GetProcessHeap () returned 0x1510000 [0139.242] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15212d8 | out: hHeap=0x1510000) returned 1 [0139.242] GetProcessHeap () returned 0x1510000 [0139.242] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x50) returned 0x1521ce0 [0139.243] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0139.243] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0139.243] Wow64DisableWow64FsRedirection (in: OldValue=0xfdfc58 | out: OldValue=0xfdfc58*=0x0) returned 1 [0139.243] GetProcessHeap () returned 0x1510000 [0139.243] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1521ce0 | out: hHeap=0x1510000) returned 1 [0139.243] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1523928, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0xa2 [0139.243] ShellExecuteExW (in: pExecInfo=0xfdfbfc*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xfdfbfc*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0191.079] GetProcessHeap () returned 0x1510000 [0191.079] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x50) returned 0x155c678 [0191.079] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0191.079] GetProcAddress (hModule=0x76420000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76436b50 [0191.080] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x155c678 | out: hHeap=0x1510000) returned 1 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1523928 | out: hHeap=0x1510000) returned 1 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15337d0 | out: hHeap=0x1510000) returned 1 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20) returned 0x15667e0 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x1e) returned 0x15665d8 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1e) returned 0x1566650 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x90) returned 0x157ae00 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x157ae00 | out: hHeap=0x1510000) returned 1 [0191.080] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x15665d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1566650 | out: hHeap=0x1510000) returned 1 [0191.080] GetProcessHeap () returned 0x1510000 [0191.080] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15667e0 | out: hHeap=0x1510000) returned 1 [0191.080] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfdfbe4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfdfbe4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.081] GetProcessHeap () returned 0x1510000 [0191.081] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15665d8 | out: hHeap=0x1510000) returned 1 [0191.081] GetProcessHeap () returned 0x1510000 [0191.081] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x40) returned 0x1572c58 [0191.081] GetProcessHeap () returned 0x1510000 [0191.081] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x3a) returned 0x1572ce8 [0191.081] GetProcessHeap () returned 0x1510000 [0191.081] RtlReAllocateHeap (Heap=0x1510000, Flags=0x0, Ptr=0x1572ce8, Size=0x72) returned 0x15607c0 [0191.081] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0191.082] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x26c [0191.082] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x0 [0191.082] GetProcessHeap () returned 0x1510000 [0191.082] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1572c58 | out: hHeap=0x1510000) returned 1 [0191.082] GetProcessHeap () returned 0x1510000 [0191.082] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15607c0 | out: hHeap=0x1510000) returned 1 [0191.082] ReleaseMutex (hMutex=0x26c) returned 1 [0191.082] CloseHandle (hObject=0x26c) returned 1 [0191.082] Sleep (dwMilliseconds=0x64) [0191.489] GetProcessHeap () returned 0x1510000 [0191.489] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x20) returned 0x1566740 [0191.489] GetProcessHeap () returned 0x1510000 [0191.489] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x1e) returned 0x1566830 [0191.489] GetProcessHeap () returned 0x1510000 [0191.489] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x1e) returned 0x1566718 [0191.489] GetProcessHeap () returned 0x1510000 [0191.489] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x90) returned 0x157ae00 [0191.489] GetProcessHeap () returned 0x1510000 [0191.489] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x157ae00 | out: hHeap=0x1510000) returned 1 [0191.490] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x1566830, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1566718 | out: hHeap=0x1510000) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1566740 | out: hHeap=0x1510000) returned 1 [0191.490] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfdfbe4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfdfbe4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1566830 | out: hHeap=0x1510000) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x0, Size=0x40) returned 0x15729d0 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] RtlAllocateHeap (HeapHandle=0x1510000, Flags=0x8, Size=0x3a) returned 0x1572e08 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] RtlReAllocateHeap (Heap=0x1510000, Flags=0x0, Ptr=0x1572e08, Size=0x72) returned 0x15608c0 [0191.490] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x26c [0191.490] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x102 [0191.490] CloseHandle (hObject=0x26c) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15729d0 | out: hHeap=0x1510000) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15608c0 | out: hHeap=0x1510000) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151b168 | out: hHeap=0x1510000) returned 1 [0191.490] GetProcessHeap () returned 0x1510000 [0191.490] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151b190 | out: hHeap=0x1510000) returned 1 [0191.491] GetProcessHeap () returned 0x1510000 [0191.491] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x151b0c8 | out: hHeap=0x1510000) returned 1 [0191.491] GetProcessHeap () returned 0x1510000 [0191.491] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x152e410 | out: hHeap=0x1510000) returned 1 [0191.491] GetProcessHeap () returned 0x1510000 [0191.491] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x1522c48 | out: hHeap=0x1510000) returned 1 [0191.491] GetProcessHeap () returned 0x1510000 [0191.491] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x152f8c0 | out: hHeap=0x1510000) returned 1 [0191.491] GetProcessHeap () returned 0x1510000 [0191.491] HeapFree (in: hHeap=0x1510000, dwFlags=0x0, lpMem=0x15236b0 | out: hHeap=0x1510000) returned 1 [0191.491] ExitProcess (uExitCode=0x0) Thread: id = 56 os_tid = 0xd70 Thread: id = 59 os_tid = 0xd8c Thread: id = 60 os_tid = 0xd90 Thread: id = 65 os_tid = 0xdbc Thread: id = 66 os_tid = 0xdc0 Thread: id = 67 os_tid = 0xdc4 Thread: id = 68 os_tid = 0xdc8 Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4b870000" os_pid = "0x544" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "10" os_parent_pid = "0x244" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e7a3" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 69 os_tid = 0xaa0 Thread: id = 70 os_tid = 0x9f4 Thread: id = 71 os_tid = 0x9f0 Thread: id = 72 os_tid = 0x9cc Thread: id = 73 os_tid = 0x684 Thread: id = 74 os_tid = 0x680 Thread: id = 75 os_tid = 0x5a8 Thread: id = 76 os_tid = 0x5a4 Thread: id = 77 os_tid = 0x5a0 Thread: id = 78 os_tid = 0x54c Thread: id = 79 os_tid = 0x548 Process: id = "13" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x7c39e000" os_pid = "0xf98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xd58" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0xf9c [0191.101] GetProcessHeap () returned 0xb40000 [0191.101] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x30) returned 0xb56390 [0191.101] GetProcessHeap () returned 0xb40000 [0191.101] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x3310) returned 0xb56900 [0191.105] GetProcessHeap () returned 0xb40000 [0191.105] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x300) returned 0xb59c18 [0191.106] GetProcessHeap () returned 0xb40000 [0191.106] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb4b038 [0191.107] GetTickCount () returned 0x1145b31 [0191.107] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xfaf858, cchData=32 | out: lpLCData="\x03") returned 16 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb484e0 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb59f20 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a138 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a350 [0191.117] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5a350, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a350 | out: hHeap=0xb40000) returned 1 [0191.117] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f20 | out: hHeap=0xb40000) returned 1 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a138 | out: hHeap=0xb40000) returned 1 [0191.117] GetProcessHeap () returned 0xb40000 [0191.117] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb484e0 | out: hHeap=0xb40000) returned 1 [0191.118] GetVersion () returned 0x23f00206 [0191.118] GetCurrentProcess () returned 0xffffffff [0191.118] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xfaf7ec | out: TokenHandle=0xfaf7ec*=0x1dc) returned 1 [0191.118] GetTokenInformation (in: TokenHandle=0x1dc, TokenInformationClass=0x14, TokenInformation=0xfaf7e4, TokenInformationLength=0x4, ReturnLength=0xfaf7e8 | out: TokenInformation=0xfaf7e4, ReturnLength=0xfaf7e8) returned 1 [0191.118] CloseHandle (hObject=0x1dc) returned 1 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb44c98 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb59f20 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a138 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f20 | out: hHeap=0xb40000) returned 1 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a138 | out: hHeap=0xb40000) returned 1 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb44eb0 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb42db0 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb4bb50 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.118] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb42db0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4bb50 | out: hHeap=0xb40000) returned 1 [0191.118] GetProcessHeap () returned 0xb40000 [0191.118] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44eb0 | out: hHeap=0xb40000) returned 1 [0191.118] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf7a4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf7a4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb42db0 | out: hHeap=0xb40000) returned 1 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x30) returned 0xb565c0 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x2a) returned 0xb564e0 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb564e0, Size=0x52) returned 0xb48a78 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb565c0 | out: hHeap=0xb40000) returned 1 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1c) returned 0xb42db0 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1c) returned 0xb44eb0 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb4bb50 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb4bb78 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb44038 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.119] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb4bb78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44038 | out: hHeap=0xb40000) returned 1 [0191.119] GetProcessHeap () returned 0xb40000 [0191.119] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4bb50 | out: hHeap=0xb40000) returned 1 [0191.119] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf78c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf78c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4bb78 | out: hHeap=0xb40000) returned 1 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4ded8 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4df68 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4df68, Size=0x72) returned 0xb4abc8 [0191.120] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0191.120] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x1dc [0191.120] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x0 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4ded8 | out: hHeap=0xb40000) returned 1 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4abc8 | out: hHeap=0xb40000) returned 1 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a128 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a268 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb59f98 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.120] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f98 | out: hHeap=0xb40000) returned 1 [0191.120] GetProcessHeap () returned 0xb40000 [0191.120] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a128 | out: hHeap=0xb40000) returned 1 [0191.120] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf774, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf774*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a268 | out: hHeap=0xb40000) returned 1 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e508 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4de90 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4de90, Size=0x72) returned 0xb4abc8 [0191.121] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x1e0 [0191.121] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0191.121] CloseHandle (hObject=0x1e0) returned 1 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e508 | out: hHeap=0xb40000) returned 1 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4abc8 | out: hHeap=0xb40000) returned 1 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xd0) returned 0xb54460 [0191.121] GetProcessHeap () returned 0xb40000 [0191.121] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xc3) returned 0xb4b7f8 [0191.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x974b85, lpParameter=0xb4b7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0191.122] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0191.122] CloseHandle (hObject=0x1e0) returned 1 [0191.122] GetProcessHeap () returned 0xb40000 [0191.122] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb54460 | out: hHeap=0xb40000) returned 1 [0191.122] GetProcessHeap () returned 0xb40000 [0191.122] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x60) returned 0xb48a78 [0191.122] GetProcessHeap () returned 0xb40000 [0191.122] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x5c) returned 0xb44a50 [0191.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x974b85, lpParameter=0xb44a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0191.123] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0191.123] CloseHandle (hObject=0x1e0) returned 1 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2e0 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59fc0 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a0b0 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.123] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59fc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a0b0 | out: hHeap=0xb40000) returned 1 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0191.123] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf7ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf7ac*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.123] GetProcessHeap () returned 0xb40000 [0191.123] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59fc0 | out: hHeap=0xb40000) returned 1 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x60) returned 0xb48a78 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a1f0 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59f70 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a150 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.124] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb59f70, nSize=0xf | out: lpDst="") returned 0x1e [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a150 | out: hHeap=0xb40000) returned 1 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb59f70, Size=0x3a) returned 0xb4ded8 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x3a) returned 0xb4e478 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.124] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb4ded8, nSize=0x1d | out: lpDst="") returned 0x1e [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e478 | out: hHeap=0xb40000) returned 1 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4ded8, Size=0x72) returned 0xb4abc8 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x72) returned 0xb404a0 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.124] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xb4abc8, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb404a0 | out: hHeap=0xb40000) returned 1 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1f0 | out: hHeap=0xb40000) returned 1 [0191.124] GetProcessHeap () returned 0xb40000 [0191.124] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e5e0 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3e) returned 0xb4e508 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x3e) returned 0xb4e598 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x10) returned 0xb484e0 [0191.125] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6c4 | out: phkResult=0xfaf6c4*=0x1e4) returned 0x0 [0191.125] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xfaf6c0, lpData=0xb4e598, lpcbData=0xfaf6c8*=0x3e | out: lpType=0xfaf6c0*=0x2, lpData=0xb4e598*=0x6d, lpcbData=0xfaf6c8*=0x98) returned 0xea [0191.125] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb484e0 | out: hHeap=0xb40000) returned 1 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e598 | out: hHeap=0xb40000) returned 1 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e508, Size=0x7a) returned 0xb44cd8 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x7a) returned 0xb453e0 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb44460 [0191.125] GetProcessHeap () returned 0xb40000 [0191.125] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x10) returned 0xb48510 [0191.125] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6c4 | out: phkResult=0xfaf6c4*=0x1e4) returned 0x0 [0191.125] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xfaf6c0, lpData=0xb453e0, lpcbData=0xfaf6c8*=0x7a | out: lpType=0xfaf6c0*=0x2, lpData=0xb453e0*=0x60, lpcbData=0xfaf6c8*=0x98) returned 0xea [0191.125] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.125] GetProcessHeap () returned 0xb40000 [0191.126] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48510 | out: hHeap=0xb40000) returned 1 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44460 | out: hHeap=0xb40000) returned 1 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb44cd8, Size=0xf2) returned 0xb4a338 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xf2) returned 0xb491c8 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x10) returned 0xb48510 [0191.126] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6c4 | out: phkResult=0xfaf6c4*=0x1e4) returned 0x0 [0191.126] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xfaf6c0, lpData=0xb491c8, lpcbData=0xfaf6c8*=0xf2 | out: lpType=0xfaf6c0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xfaf6c8*=0x98) returned 0x0 [0191.126] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48510 | out: hHeap=0xb40000) returned 1 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a038 [0191.126] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6c4 | out: phkResult=0xfaf6c4*=0x1e4) returned 0x0 [0191.126] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xfaf6c0, lpData=0xb49260, lpcbData=0xfaf6c8*=0x5a | out: lpType=0xfaf6c0*=0x0, lpData=0xb49260*=0x1a, lpcbData=0xfaf6c8*=0x5a) returned 0x2 [0191.126] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.126] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6d8 | out: phkResult=0xfaf6d8*=0x1e4) returned 0x0 [0191.126] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xfaf6d4, lpData=0xb49260, lpcbData=0xfaf6dc*=0x5a | out: lpType=0xfaf6d4*=0x2, lpData=0xb49260*=0x1a, lpcbData=0xfaf6dc*=0x78) returned 0xea [0191.126] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.126] GetProcessHeap () returned 0xb40000 [0191.126] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a038 | out: hHeap=0xb40000) returned 1 [0191.126] GetProcessHeap () returned 0xb40000 [0191.127] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb491c8 | out: hHeap=0xb40000) returned 1 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4a338, Size=0x1e2) returned 0xb5a328 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e2) returned 0xb5a518 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x10) returned 0xb484e0 [0191.127] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6c4 | out: phkResult=0xfaf6c4*=0x1e4) returned 0x0 [0191.127] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0xfaf6c0, lpData=0xb5a518, lpcbData=0xfaf6c8*=0x1e2 | out: lpType=0xfaf6c0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xfaf6c8*=0x98) returned 0x0 [0191.127] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb484e0 | out: hHeap=0xb40000) returned 1 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a268 [0191.127] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6c4 | out: phkResult=0xfaf6c4*=0x1e4) returned 0x0 [0191.127] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xfaf6c0, lpData=0xb5a5b0, lpcbData=0xfaf6c8*=0x14a | out: lpType=0xfaf6c0*=0x0, lpData=0xb5a5b0*=0x0, lpcbData=0xfaf6c8*=0x14a) returned 0x2 [0191.127] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.127] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xfaf6d8 | out: phkResult=0xfaf6d8*=0x1e4) returned 0x0 [0191.127] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0xfaf6d4, lpData=0xb5a5b0, lpcbData=0xfaf6dc*=0x14a | out: lpType=0xfaf6d4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xfaf6dc*=0x78) returned 0x0 [0191.127] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a268 | out: hHeap=0xb40000) returned 1 [0191.127] GetProcessHeap () returned 0xb40000 [0191.127] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.128] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xb5a328, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a518 | out: hHeap=0xb40000) returned 1 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e5e0 | out: hHeap=0xb40000) returned 1 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb484e0 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x10) returned 0xb48510 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb48528 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.128] ExpandEnvironmentStringsW (in: lpSrc="oit.txt", lpDst=0xb48510, nSize=0x8 | out: lpDst="oit.txt") returned 0x8 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48528 | out: hHeap=0xb40000) returned 1 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb484e0 | out: hHeap=0xb40000) returned 1 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a518 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a730 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a948 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5ab60 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5ad78 [0191.128] GetProcessHeap () returned 0xb40000 [0191.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5af90 [0191.129] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5a730, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.129] GetProcessHeap () returned 0xb40000 [0191.129] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5b1a8 [0191.129] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5b1a8, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.129] GetProcessHeap () returned 0xb40000 [0191.129] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5b1a8 | out: hHeap=0xb40000) returned 1 [0191.129] GetProcessHeap () returned 0xb40000 [0191.129] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5b1a8 [0191.129] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5b1a8, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.129] GetProcessHeap () returned 0xb40000 [0191.129] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5b1a8 | out: hHeap=0xb40000) returned 1 [0191.129] GetProcessHeap () returned 0xb40000 [0191.129] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5b1a8 [0191.129] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5b1a8, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.129] GetProcessHeap () returned 0xb40000 [0191.129] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5b1a8 | out: hHeap=0xb40000) returned 1 [0191.129] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=0) returned 1 [0191.140] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xfaf7bc | out: phkResult=0xfaf7bc*=0x1e4) returned 0x0 [0191.140] RegSetValueExW (in: hKey=0x1e4, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe") returned 0x0 [0191.141] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.141] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xfaf7d0 | out: phkResult=0xfaf7d0*=0x1e4) returned 0x0 [0191.141] RegSetValueExW (in: hKey=0x1e4, lpValueName="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe", cbData=0xe4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe") returned 0x0 [0191.142] RegCloseKey (hKey=0x1e4) returned 0x0 [0191.142] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt"), bFailIfExists=1) returned 0 [0191.142] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\oit.txt")) returned 0xffffffff [0191.142] GetProcessHeap () returned 0xb40000 [0191.142] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x118) returned 0xb4aa60 [0191.142] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 0 [0191.143] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0191.145] GetFileAttributesW (lpFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0191.145] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe"), bFailIfExists=1) returned 0 [0191.146] CopyFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), bFailIfExists=1) returned 0 [0191.146] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt")) returned 0xffffffff [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4aa60 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48510 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a518 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a730 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a948 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5ab60 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5ad78 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5af90 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4abc8 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a328 | out: hHeap=0xb40000) returned 1 [0191.146] GetProcessHeap () returned 0xb40000 [0191.146] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a100 [0191.146] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a060 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a1c8 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.147] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a060, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a100 | out: hHeap=0xb40000) returned 1 [0191.147] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf7e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf7e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a060 | out: hHeap=0xb40000) returned 1 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb50a50 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb48510 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x190) returned 0xb4b1a8 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x70) returned 0xb48a78 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x66) returned 0xb44810 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb44810, Size=0xca) returned 0xb4b910 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x184) returned 0xb4a838 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb484e0 [0191.147] GetProcessHeap () returned 0xb40000 [0191.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a328 [0191.147] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x250) returned 0xb5a540 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xa0) returned 0xb44460 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x94) returned 0xb4b098 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x94) returned 0xb5b440 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.148] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0xb4b098, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5b440 | out: hHeap=0xb40000) returned 1 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44460 | out: hHeap=0xb40000) returned 1 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x70) returned 0xb44810 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x62) returned 0xb43050 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x62) returned 0xb4abc8 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.148] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xb43050, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4abc8 | out: hHeap=0xb40000) returned 1 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb43050, Size=0xc2) returned 0xb48ff0 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xc2) returned 0xb4a710 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.148] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xb48ff0, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0191.148] GetProcessHeap () returned 0xb40000 [0191.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a710 | out: hHeap=0xb40000) returned 1 [0191.148] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44810 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5b7a0 [0191.149] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5b7a0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5b7a0 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x24e) returned 0xb5b7a0 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5b7a0, Size=0x3cc) returned 0xb5b7a0 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x96) returned 0xb5b120 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5b120, Size=0x140) returned 0xb4b3b8 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x6a) returned 0xb44810 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a328 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a540 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48ff0 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48510 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b1a8 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a838 | out: hHeap=0xb40000) returned 1 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb59f48 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a038 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a240 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.149] GetProcessHeap () returned 0xb40000 [0191.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.150] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a038, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a240 | out: hHeap=0xb40000) returned 1 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f48 | out: hHeap=0xb40000) returned 1 [0191.150] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf7e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf7e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a038 | out: hHeap=0xb40000) returned 1 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb50990 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb48510 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x190) returned 0xb4b1a8 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x70) returned 0xb48a78 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x66) returned 0xb43050 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb43050, Size=0xca) returned 0xb48ff0 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x184) returned 0xb4a838 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb48540 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5a328 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x250) returned 0xb5a540 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xa0) returned 0xb5d108 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x94) returned 0xb5b6c0 [0191.150] GetProcessHeap () returned 0xb40000 [0191.150] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x94) returned 0xb5a900 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.151] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt", lpDst=0xb5b6c0, nSize=0x4a | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;oit.txt") returned 0x4a [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a900 | out: hHeap=0xb40000) returned 1 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5d108 | out: hHeap=0xb40000) returned 1 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x70) returned 0xb43050 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x62) returned 0xb4abc8 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x62) returned 0xb404a0 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.151] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xb4abc8, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb404a0 | out: hHeap=0xb40000) returned 1 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4abc8, Size=0xc2) returned 0xb4a710 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xc2) returned 0xb44600 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.151] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xb4a710, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44600 | out: hHeap=0xb40000) returned 1 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb43050 | out: hHeap=0xb40000) returned 1 [0191.151] GetProcessHeap () returned 0xb40000 [0191.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20a) returned 0xb5bb78 [0191.151] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb5bb78, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0x91 [0191.151] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5bb78 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x182) returned 0xb5bb78 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x24e) returned 0xb5bd08 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x96) returned 0xb5a7c0 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5a7c0, Size=0x140) returned 0xb5bf60 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x6a) returned 0xb43050 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a328 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a540 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5b6c0 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a710 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48510 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b1a8 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a838 | out: hHeap=0xb40000) returned 1 [0191.152] GetProcessHeap () returned 0xb40000 [0191.152] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x14) returned 0xb5c2f8 [0191.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9722ee, lpParameter=0xb5c2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0191.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x97239a, lpParameter=0xfaf81c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0191.153] GetProcessHeap () returned 0xb40000 [0191.153] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x14) returned 0xb5c3d8 [0191.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x972161, lpParameter=0xb5c3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0191.154] GetProcessHeap () returned 0xb40000 [0191.154] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x14) returned 0xb5c4f8 [0191.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x971a76, lpParameter=0xb5c4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0191.155] GetProcessHeap () returned 0xb40000 [0191.155] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x14) returned 0xb5c438 [0191.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x971cc5, lpParameter=0xb5c438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0191.155] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0xffffffff) Thread: id = 95 os_tid = 0xfa0 Thread: id = 98 os_tid = 0xfb4 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a1c8 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x14) returned 0xb5c218 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x14) returned 0xb5c238 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.420] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb5c218, nSize=0xa | out: lpDst="") returned 0x1c [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5c238 | out: hHeap=0xb40000) returned 1 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5c218, Size=0x26) returned 0xb50b10 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x26) returned 0xb50a20 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.420] GetProcessHeap () returned 0xb40000 [0191.420] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.420] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb50b10, nSize=0x13 | out: lpDst="") returned 0x1c [0191.420] GetProcessHeap () returned 0xb40000 [0191.421] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb50a20 | out: hHeap=0xb40000) returned 1 [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb50b10, Size=0x4a) returned 0xb5a730 [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4a) returned 0xb48a78 [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb453e0 [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb453e0 | out: hHeap=0xb40000) returned 1 [0191.421] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb5a730, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0191.421] GetProcessHeap () returned 0xb40000 [0191.421] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb48a78 [0191.421] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0191.421] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0191.421] Wow64DisableWow64FsRedirection (in: OldValue=0x2a4febc | out: OldValue=0x2a4febc*=0x0) returned 1 [0191.421] GetProcessHeap () returned 0xb40000 [0191.422] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb48a78 | out: hHeap=0xb40000) returned 1 [0191.422] CreatePipe (in: hReadPipe=0x2a4feb0, hWritePipe=0x2a4feac, lpPipeAttributes=0x2a4fecc, nSize=0x0 | out: hReadPipe=0x2a4feb0*=0x21c, hWritePipe=0x2a4feac*=0x220) returned 1 [0191.422] CreatePipe (in: hReadPipe=0x2a4feb4, hWritePipe=0x2a4feb8, lpPipeAttributes=0x2a4fecc, nSize=0x0 | out: hReadPipe=0x2a4feb4*=0x224, hWritePipe=0x2a4feb8*=0x228) returned 1 [0191.423] SetHandleInformation (hObject=0x220, dwMask=0x1, dwFlags=0x0) returned 1 [0191.423] SetHandleInformation (hObject=0x224, dwMask=0x1, dwFlags=0x0) returned 1 [0191.423] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2a4fee8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x21c, hStdOutput=0x228, hStdError=0x228), lpProcessInformation=0x2a4fed8 | out: lpCommandLine=0x0, lpProcessInformation=0x2a4fed8*(hProcess=0x230, hThread=0x22c, dwProcessId=0xfd0, dwThreadId=0xfd4)) returned 1 [0191.446] WriteFile (in: hFile=0x220, lpBuffer=0xb4b7f8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x2a4fec8, lpOverlapped=0x0 | out: lpBuffer=0xb4b7f8*, lpNumberOfBytesWritten=0x2a4fec8*=0xc2, lpOverlapped=0x0) returned 1 [0191.446] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0xffffffff) Thread: id = 99 os_tid = 0xfb8 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb59f98 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x14) returned 0xb5c598 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x14) returned 0xb5c478 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.447] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb5c598, nSize=0xa | out: lpDst="") returned 0x1c [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5c478 | out: hHeap=0xb40000) returned 1 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5c598, Size=0x26) returned 0xb50960 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x26) returned 0xb509f0 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.447] GetProcessHeap () returned 0xb40000 [0191.447] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.447] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb50960, nSize=0x13 | out: lpDst="") returned 0x1c [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb509f0 | out: hHeap=0xb40000) returned 1 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb50960, Size=0x4a) returned 0xb404a0 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4a) returned 0xb45230 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.448] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xb404a0, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb45230 | out: hHeap=0xb40000) returned 1 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f98 | out: hHeap=0xb40000) returned 1 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb45230 [0191.448] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0191.448] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0191.448] Wow64DisableWow64FsRedirection (in: OldValue=0x2bef9dc | out: OldValue=0x2bef9dc*=0x0) returned 1 [0191.448] GetProcessHeap () returned 0xb40000 [0191.448] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb45230 | out: hHeap=0xb40000) returned 1 [0191.448] CreatePipe (in: hReadPipe=0x2bef9d0, hWritePipe=0x2bef9cc, lpPipeAttributes=0x2bef9ec, nSize=0x0 | out: hReadPipe=0x2bef9d0*=0x238, hWritePipe=0x2bef9cc*=0x234) returned 1 [0191.449] CreatePipe (in: hReadPipe=0x2bef9d4, hWritePipe=0x2bef9d8, lpPipeAttributes=0x2bef9ec, nSize=0x0 | out: hReadPipe=0x2bef9d4*=0x248, hWritePipe=0x2bef9d8*=0x24c) returned 1 [0191.449] SetHandleInformation (hObject=0x234, dwMask=0x1, dwFlags=0x0) returned 1 [0191.449] SetHandleInformation (hObject=0x248, dwMask=0x1, dwFlags=0x0) returned 1 [0191.449] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2befa08*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x238, hStdOutput=0x24c, hStdError=0x24c), lpProcessInformation=0x2bef9f8 | out: lpCommandLine=0x0, lpProcessInformation=0x2bef9f8*(hProcess=0x254, hThread=0x250, dwProcessId=0xfd8, dwThreadId=0xfdc)) returned 1 [0191.458] WriteFile (in: hFile=0x234, lpBuffer=0xb44a50*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2bef9e8, lpOverlapped=0x0 | out: lpBuffer=0xb44a50*, lpNumberOfBytesWritten=0x2bef9e8*=0x5b, lpOverlapped=0x0) returned 1 [0191.459] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0xffffffff) Thread: id = 100 os_tid = 0xfbc [0191.459] GetProcessHeap () returned 0xb40000 [0191.459] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x440) returned 0xb5f470 [0191.459] GetProcessHeap () returned 0xb40000 [0191.459] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x30) returned 0xb561d0 [0191.459] GetCurrentProcess () returned 0xffffffff [0191.459] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x2cefbe0 | out: TokenHandle=0x2cefbe0*=0x25c) returned 1 [0191.459] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2cefbd8 | out: lpLuid=0x2cefbd8*(LowPart=0x14, HighPart=0)) returned 1 [0191.465] AdjustTokenPrivileges (in: TokenHandle=0x25c, DisableAllPrivileges=0, NewState=0x2cefbc8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0191.465] CloseHandle (hObject=0x25c) returned 1 [0191.465] GetProcessHeap () returned 0xb40000 [0191.465] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb561d0 | out: hHeap=0xb40000) returned 1 [0191.465] GetProcessHeap () returned 0xb40000 [0191.465] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x434) returned 0xb60ac8 [0191.465] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c [0191.790] Process32FirstW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.791] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.791] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.792] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.792] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.793] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.793] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.794] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.794] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.795] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.795] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.795] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.796] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.796] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.797] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.797] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.798] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.798] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.799] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.799] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.800] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.800] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.801] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.801] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.802] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.802] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.803] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.803] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0191.804] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0191.804] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0191.804] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0191.805] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.805] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.806] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.806] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0191.807] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0191.807] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0191.807] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.808] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.808] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.809] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.809] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.810] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.810] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.810] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0191.811] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.811] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.812] Process32NextW (in: hSnapshot=0x29c, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0191.812] CloseHandle (hObject=0x29c) returned 1 [0191.812] Sleep (dwMilliseconds=0x1f4) [0192.572] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0192.578] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.579] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.579] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.579] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.580] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.580] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.581] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.582] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.582] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.582] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.583] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.583] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.584] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.584] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.584] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.585] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.585] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.586] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.586] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.586] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.587] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.587] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.588] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.588] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.589] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.589] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.589] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.590] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.590] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.591] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.591] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.591] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.592] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.592] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.593] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.593] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.594] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.594] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.595] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.595] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd48, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.595] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.596] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.597] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.597] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.597] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0192.598] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.598] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.599] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.599] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.600] Process32NextW (in: hSnapshot=0x2d8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0192.600] CloseHandle (hObject=0x2d8) returned 1 [0192.600] Sleep (dwMilliseconds=0x1f4) [0193.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0193.446] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.447] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.447] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.448] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.448] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.448] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.449] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.449] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.450] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.450] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0193.451] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0193.451] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.451] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.452] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.452] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.453] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.453] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.454] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.454] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.454] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.455] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.455] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.456] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.456] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.457] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.457] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.458] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.458] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0193.458] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0193.459] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0193.459] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0193.460] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.460] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0193.461] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.461] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0193.461] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0193.462] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0193.462] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0193.463] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0193.463] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.464] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.464] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0193.464] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0193.465] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0193.465] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0193.466] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0193.466] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0193.466] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0193.467] CloseHandle (hObject=0x2e4) returned 1 [0193.467] Sleep (dwMilliseconds=0x1f4) [0194.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0194.224] Process32FirstW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.225] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.225] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.225] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.226] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.226] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.227] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.228] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.228] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.228] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.229] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.229] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.230] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.230] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.230] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.231] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.231] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.232] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.232] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.233] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.233] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.233] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.234] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.234] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.235] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.235] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.236] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.236] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0194.236] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0194.237] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0194.237] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0194.238] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.238] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0194.238] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.239] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0194.239] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0194.240] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0194.240] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0194.241] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0194.241] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.241] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.242] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0194.242] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.243] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.243] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.244] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.244] Process32NextW (in: hSnapshot=0x308, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0194.244] CloseHandle (hObject=0x308) returned 1 [0194.244] Sleep (dwMilliseconds=0x1f4) [0195.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0195.360] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.361] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.361] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.362] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.362] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.363] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.363] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.364] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.364] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.364] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0195.365] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0195.365] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.366] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.366] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.367] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.367] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.368] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.368] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.369] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.369] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.370] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.370] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.370] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.371] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.371] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.372] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.372] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.373] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0195.373] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0195.373] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0195.374] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0195.374] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.375] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0195.375] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.376] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0195.376] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0195.377] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0195.377] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0195.377] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0195.378] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.378] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.379] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0195.379] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.380] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.380] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.381] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.381] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0195.381] CloseHandle (hObject=0x2f0) returned 1 [0195.381] Sleep (dwMilliseconds=0x1f4) [0196.102] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0196.106] Process32FirstW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.107] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.107] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.107] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.108] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.108] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.109] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.109] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.110] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.110] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.111] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.111] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.111] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.112] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.112] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.113] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.113] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.114] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.114] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.114] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.115] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.115] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.116] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.116] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.117] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.127] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.127] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.128] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0196.128] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0196.129] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0196.129] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0196.130] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.130] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0196.130] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.131] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0196.131] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0196.132] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0196.132] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.133] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0196.133] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.134] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.134] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0196.135] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.135] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.136] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.136] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.137] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0196.137] CloseHandle (hObject=0x304) returned 1 [0196.138] Sleep (dwMilliseconds=0x1f4) [0196.854] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0196.859] Process32FirstW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.859] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.860] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.860] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.864] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.865] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.865] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.865] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.866] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.866] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.867] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.867] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.867] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.868] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.868] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.869] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.869] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.870] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.870] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.870] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.871] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.871] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.872] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.872] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.872] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.873] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.873] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.874] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0196.874] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0196.874] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0196.875] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0196.875] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.876] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0196.876] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.876] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0196.877] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0196.877] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0196.878] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.878] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0196.878] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0196.879] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.879] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.880] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.880] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.880] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0196.881] CloseHandle (hObject=0x304) returned 1 [0196.881] Sleep (dwMilliseconds=0x1f4) [0197.540] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0197.544] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.544] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.544] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.545] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.545] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.545] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.546] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.546] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.547] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.547] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0197.548] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0197.548] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.548] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.549] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.549] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.549] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.550] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.550] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.551] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.551] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.551] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.552] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.552] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.553] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.553] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.553] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.554] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.554] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0197.555] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0197.555] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0197.556] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0197.556] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.556] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0197.557] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.557] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0197.558] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0197.558] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0197.558] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0197.559] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0197.559] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0197.559] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.560] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.560] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.561] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.561] Process32NextW (in: hSnapshot=0x2e8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0197.561] CloseHandle (hObject=0x2e8) returned 1 [0197.562] Sleep (dwMilliseconds=0x1f4) [0198.384] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0198.389] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.389] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.389] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.390] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.390] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.391] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.391] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.391] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.392] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.392] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.392] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.393] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.393] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.394] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.394] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.395] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.395] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.395] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.396] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.396] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.396] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.397] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.397] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.398] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.398] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.398] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.399] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.404] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0198.404] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0198.404] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0198.405] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0198.405] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.406] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0198.406] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.406] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0198.407] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0198.407] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0198.408] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0198.408] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0198.408] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0198.409] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.409] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.410] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.410] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.410] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0198.411] CloseHandle (hObject=0x2e4) returned 1 [0198.411] Sleep (dwMilliseconds=0x1f4) [0199.087] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0199.091] Process32FirstW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.091] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.091] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.092] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.092] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.093] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.093] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.094] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.094] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.095] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.095] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.095] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.096] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.096] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.097] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.097] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.097] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.098] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.098] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.099] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.099] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.099] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.100] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.100] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.100] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.101] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.101] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.102] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0199.102] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0199.103] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0199.103] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0199.103] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.104] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0199.104] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.104] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0199.105] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0199.105] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0199.106] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.106] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0199.106] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0199.107] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.107] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.108] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.108] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.109] Process32NextW (in: hSnapshot=0x304, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0199.109] CloseHandle (hObject=0x304) returned 1 [0199.109] Sleep (dwMilliseconds=0x1f4) [0200.000] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0200.004] Process32FirstW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.005] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.005] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.005] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.006] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.006] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.007] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.010] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.011] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.011] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.012] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.012] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.012] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.013] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.013] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.013] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.014] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.014] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.015] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.015] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.015] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.016] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.016] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.017] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.017] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.018] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.018] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.018] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0200.019] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0200.019] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0200.020] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0200.020] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.020] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0200.021] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.021] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0200.022] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0200.022] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0200.023] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.023] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0200.023] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0200.024] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.025] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.025] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.025] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.026] Process32NextW (in: hSnapshot=0x2fc, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0200.026] CloseHandle (hObject=0x2fc) returned 1 [0200.026] Sleep (dwMilliseconds=0x1f4) [0200.892] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0200.895] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.896] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.896] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.897] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.897] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.898] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.898] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.898] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.899] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.899] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.900] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.900] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.900] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.901] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.901] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.902] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.902] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.902] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.903] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.903] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.904] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.904] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.904] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.905] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.905] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.906] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.906] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.907] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0200.907] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0200.907] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0200.908] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0200.908] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.909] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0200.909] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.909] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0200.910] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0200.910] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0200.911] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.911] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0200.912] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0200.912] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.912] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.913] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.913] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.914] Process32NextW (in: hSnapshot=0x2f8, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0200.914] CloseHandle (hObject=0x2f8) returned 1 [0200.914] Sleep (dwMilliseconds=0x1f4) [0201.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0201.631] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.632] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.632] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.633] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.633] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.634] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.634] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.635] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.635] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.636] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0201.636] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0201.636] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.637] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.637] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.638] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.638] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.638] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.639] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.639] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.640] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.640] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.641] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.641] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.641] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.642] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.642] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.643] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.643] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0201.643] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0201.644] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0201.644] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0201.645] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.645] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0201.645] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.646] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0201.646] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0201.647] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0201.647] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0201.647] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0201.648] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0201.648] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.649] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.649] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.650] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.650] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0201.650] CloseHandle (hObject=0x2f0) returned 1 [0201.651] Sleep (dwMilliseconds=0x1f4) [0202.341] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0202.363] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.364] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.364] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.365] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.365] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.366] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.366] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.366] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.367] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.367] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.368] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.368] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.369] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.369] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.370] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.370] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.371] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.371] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.371] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.372] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.372] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.373] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.373] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.374] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.374] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.375] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.375] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.375] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0202.376] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0202.376] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0202.377] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0202.377] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.378] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0202.378] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.379] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0202.379] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0202.380] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0202.380] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.380] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0202.381] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0202.381] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.382] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.382] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.383] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.383] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0202.384] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0202.384] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0202.385] CloseHandle (hObject=0x2e4) returned 1 [0202.385] Sleep (dwMilliseconds=0x1f4) [0203.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0203.009] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.009] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.010] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.010] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.011] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.011] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.011] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.012] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.012] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.013] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.013] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.014] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.014] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.015] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.015] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.015] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.016] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.016] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.017] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.017] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.018] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.018] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.019] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.019] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.020] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.020] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.021] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.021] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0203.022] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0203.022] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0203.022] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0203.023] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.023] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0203.024] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.024] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0203.025] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0203.025] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0203.026] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0203.026] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0203.027] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0203.027] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.028] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.028] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.029] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.029] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0203.030] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0203.030] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.031] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0203.031] CloseHandle (hObject=0x2e4) returned 1 [0203.031] Sleep (dwMilliseconds=0x1f4) [0203.648] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0203.680] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.681] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.681] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.682] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.682] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.682] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.683] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.683] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.684] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.684] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.685] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.685] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.686] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.686] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.686] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.687] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.687] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.688] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.688] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.689] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.689] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.689] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.690] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.690] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.691] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.691] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.691] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.692] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0203.692] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0203.693] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0203.693] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0203.694] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.694] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0203.694] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.695] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0203.695] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0203.696] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0203.696] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0203.697] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0203.697] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0203.697] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.698] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.698] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.699] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.699] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0203.700] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0203.700] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.700] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0203.701] CloseHandle (hObject=0x2f0) returned 1 [0203.701] Sleep (dwMilliseconds=0x1f4) [0204.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0204.433] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.434] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.434] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.435] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.435] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.435] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.436] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.436] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.437] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.437] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.437] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.438] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.438] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.439] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.439] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.440] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.440] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.440] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.441] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.441] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.442] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.442] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.443] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.443] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.443] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.444] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.444] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.445] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0204.445] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0204.446] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0204.446] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0204.446] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.447] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0204.447] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.448] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0204.448] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0204.448] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0204.449] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.450] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0204.450] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0204.450] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.451] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.451] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.452] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.452] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0204.453] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0204.453] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.453] Process32NextW (in: hSnapshot=0x2e4, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0204.454] CloseHandle (hObject=0x2e4) returned 1 [0204.454] Sleep (dwMilliseconds=0x1f4) [0205.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0205.177] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.177] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.177] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.178] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.178] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.179] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.179] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x228, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.180] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.180] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.180] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x228, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.181] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.181] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.182] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.182] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x228, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.182] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.183] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.183] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.184] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.184] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.185] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.185] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.185] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.186] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.186] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.187] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.187] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.188] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.188] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0205.188] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0205.189] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0205.189] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x888, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0205.190] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x898, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.190] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0205.191] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.191] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0205.191] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0205.192] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0205.192] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0205.193] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0205.193] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0xd58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 1 [0205.193] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.194] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.194] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.195] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.195] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0205.196] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfd0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0205.196] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.196] Process32NextW (in: hSnapshot=0x2f0, lppe=0x2cef9b4 | out: lppe=0x2cef9b4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x244, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0205.197] CloseHandle (hObject=0x2f0) returned 1 [0205.197] Sleep (dwMilliseconds=0x1f4) Thread: id = 101 os_tid = 0xfc0 [0191.472] GetVersion () returned 0x23f00206 [0191.472] GetCurrentProcess () returned 0xffffffff [0191.472] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2e2fa90 | out: TokenHandle=0x2e2fa90*=0x25c) returned 1 [0191.472] GetTokenInformation (in: TokenHandle=0x25c, TokenInformationClass=0x14, TokenInformation=0x2e2fa88, TokenInformationLength=0x4, ReturnLength=0x2e2fa8c | out: TokenInformation=0x2e2fa88, ReturnLength=0x2e2fa8c) returned 1 [0191.472] CloseHandle (hObject=0x25c) returned 1 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb59f98 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a2e0 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a1c8 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.472] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a2e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f98 | out: hHeap=0xb40000) returned 1 [0191.472] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0191.472] GetProcessHeap () returned 0xb40000 [0191.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4df20 [0191.473] GetProcessHeap () returned 0xb40000 [0191.473] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e2c8 [0191.473] GetProcessHeap () returned 0xb40000 [0191.473] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e2c8, Size=0x72) returned 0xb45230 [0191.473] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x25c [0191.473] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102 [0191.473] CloseHandle (hObject=0x25c) returned 1 [0191.473] GetProcessHeap () returned 0xb40000 [0191.473] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4df20 | out: hHeap=0xb40000) returned 1 [0191.473] GetProcessHeap () returned 0xb40000 [0191.473] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb45230 | out: hHeap=0xb40000) returned 1 [0191.473] Sleep (dwMilliseconds=0x3e8) [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a038 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a150 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a2b8 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0192.793] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a038 | out: hHeap=0xb40000) returned 1 [0192.793] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a150 | out: hHeap=0xb40000) returned 1 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4de90 [0192.793] GetProcessHeap () returned 0xb40000 [0192.793] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e508 [0192.793] GetProcessHeap () returned 0xb40000 [0192.794] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e508, Size=0x72) returned 0xb45230 [0192.794] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2d8 [0192.794] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0192.794] CloseHandle (hObject=0x2d8) returned 1 [0192.794] GetProcessHeap () returned 0xb40000 [0192.794] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4de90 | out: hHeap=0xb40000) returned 1 [0192.794] GetProcessHeap () returned 0xb40000 [0192.794] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb45230 | out: hHeap=0xb40000) returned 1 [0192.794] Sleep (dwMilliseconds=0x3e8) [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2e0 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a1c8 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb59f48 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0194.056] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a1c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f48 | out: hHeap=0xb40000) returned 1 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0194.056] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e1a8 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e1f0 [0194.056] GetProcessHeap () returned 0xb40000 [0194.056] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e1f0, Size=0x72) returned 0x3b071b8 [0194.056] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2e8 [0194.057] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x0) returned 0x102 [0194.057] CloseHandle (hObject=0x2e8) returned 1 [0194.057] GetProcessHeap () returned 0xb40000 [0194.057] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e1a8 | out: hHeap=0xb40000) returned 1 [0194.057] GetProcessHeap () returned 0xb40000 [0194.057] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b071b8 | out: hHeap=0xb40000) returned 1 [0194.057] Sleep (dwMilliseconds=0x3e8) [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb59f70 [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59fc0 [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a2b8 [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0195.459] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59fc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0195.459] GetProcessHeap () returned 0xb40000 [0195.459] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f70 | out: hHeap=0xb40000) returned 1 [0195.459] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0195.460] GetProcessHeap () returned 0xb40000 [0195.460] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59fc0 | out: hHeap=0xb40000) returned 1 [0195.460] GetProcessHeap () returned 0xb40000 [0195.460] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e1f0 [0195.460] GetProcessHeap () returned 0xb40000 [0195.460] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e1a8 [0195.460] GetProcessHeap () returned 0xb40000 [0195.460] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e1a8, Size=0x72) returned 0x3b06ab8 [0195.460] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x310 [0195.460] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0195.460] CloseHandle (hObject=0x310) returned 1 [0195.460] GetProcessHeap () returned 0xb40000 [0195.460] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e1f0 | out: hHeap=0xb40000) returned 1 [0195.460] GetProcessHeap () returned 0xb40000 [0195.460] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b06ab8 | out: hHeap=0xb40000) returned 1 [0195.460] Sleep (dwMilliseconds=0x3e8) [0196.806] GetProcessHeap () returned 0xb40000 [0196.806] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2b8 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59fc0 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a010 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4a710 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a710 | out: hHeap=0xb40000) returned 1 [0196.807] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59fc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a010 | out: hHeap=0xb40000) returned 1 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0196.807] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59fc0 | out: hHeap=0xb40000) returned 1 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e1a8 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e1f0 [0196.807] GetProcessHeap () returned 0xb40000 [0196.807] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e1f0, Size=0x72) returned 0x3b073b8 [0196.807] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x304 [0196.808] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0196.808] CloseHandle (hObject=0x304) returned 1 [0196.808] GetProcessHeap () returned 0xb40000 [0196.808] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e1a8 | out: hHeap=0xb40000) returned 1 [0196.808] GetProcessHeap () returned 0xb40000 [0196.808] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b073b8 | out: hHeap=0xb40000) returned 1 [0196.808] Sleep (dwMilliseconds=0x3e8) [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb59f48 [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a2e0 [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a1c8 [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0198.040] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a2e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0198.040] GetProcessHeap () returned 0xb40000 [0198.040] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f48 | out: hHeap=0xb40000) returned 1 [0198.040] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.041] GetProcessHeap () returned 0xb40000 [0198.041] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0198.041] GetProcessHeap () returned 0xb40000 [0198.041] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e1a8 [0198.041] GetProcessHeap () returned 0xb40000 [0198.041] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e1f0 [0198.041] GetProcessHeap () returned 0xb40000 [0198.041] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e1f0, Size=0x72) returned 0x3b06e38 [0198.041] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f0 [0198.041] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0198.041] CloseHandle (hObject=0x2f0) returned 1 [0198.041] GetProcessHeap () returned 0xb40000 [0198.041] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e1a8 | out: hHeap=0xb40000) returned 1 [0198.041] GetProcessHeap () returned 0xb40000 [0198.041] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b06e38 | out: hHeap=0xb40000) returned 1 [0198.041] Sleep (dwMilliseconds=0x3e8) [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a038 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a2b8 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a1c8 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0199.250] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a2b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a038 | out: hHeap=0xb40000) returned 1 [0199.250] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0199.250] GetProcessHeap () returned 0xb40000 [0199.250] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0199.250] GetProcessHeap () returned 0xb40000 [0199.251] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e1a8 [0199.251] GetProcessHeap () returned 0xb40000 [0199.251] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e478 [0199.251] GetProcessHeap () returned 0xb40000 [0199.251] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e478, Size=0x72) returned 0x3b06d38 [0199.251] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2e4 [0199.251] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102 [0199.251] CloseHandle (hObject=0x2e4) returned 1 [0199.251] GetProcessHeap () returned 0xb40000 [0199.251] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e1a8 | out: hHeap=0xb40000) returned 1 [0199.251] GetProcessHeap () returned 0xb40000 [0199.251] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b06d38 | out: hHeap=0xb40000) returned 1 [0199.251] Sleep (dwMilliseconds=0x3e8) [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2b8 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a1c8 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a1f0 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0x3ee1da0 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee1da0 | out: hHeap=0xb40000) returned 1 [0200.428] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a1c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1f0 | out: hHeap=0xb40000) returned 1 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0200.428] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e1a8 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e478 [0200.428] GetProcessHeap () returned 0xb40000 [0200.428] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e478, Size=0x72) returned 0x3b066b8 [0200.428] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x308 [0200.429] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0200.429] CloseHandle (hObject=0x308) returned 1 [0200.429] GetProcessHeap () returned 0xb40000 [0200.429] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e1a8 | out: hHeap=0xb40000) returned 1 [0200.429] GetProcessHeap () returned 0xb40000 [0200.429] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b066b8 | out: hHeap=0xb40000) returned 1 [0200.429] Sleep (dwMilliseconds=0x3e8) [0201.651] GetProcessHeap () returned 0xb40000 [0201.651] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a010 [0201.651] GetProcessHeap () returned 0xb40000 [0201.651] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a1c8 [0201.651] GetProcessHeap () returned 0xb40000 [0201.651] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a2e0 [0201.651] GetProcessHeap () returned 0xb40000 [0201.652] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0x3ee1420 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee1420 | out: hHeap=0xb40000) returned 1 [0201.652] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a1c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a010 | out: hHeap=0xb40000) returned 1 [0201.652] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e2c8 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e478 [0201.652] GetProcessHeap () returned 0xb40000 [0201.652] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e478, Size=0x72) returned 0x3b06838 [0201.652] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f0 [0201.653] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0201.653] CloseHandle (hObject=0x2f0) returned 1 [0201.653] GetProcessHeap () returned 0xb40000 [0201.653] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e2c8 | out: hHeap=0xb40000) returned 1 [0201.653] GetProcessHeap () returned 0xb40000 [0201.653] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b06838 | out: hHeap=0xb40000) returned 1 [0201.653] Sleep (dwMilliseconds=0x3e8) [0202.900] GetProcessHeap () returned 0xb40000 [0202.900] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a1c8 [0202.900] GetProcessHeap () returned 0xb40000 [0202.900] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59fc0 [0202.900] GetProcessHeap () returned 0xb40000 [0202.906] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a2b8 [0202.906] GetProcessHeap () returned 0xb40000 [0202.906] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0x3ee1550 [0202.906] GetProcessHeap () returned 0xb40000 [0202.906] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee1550 | out: hHeap=0xb40000) returned 1 [0202.919] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59fc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0202.919] GetProcessHeap () returned 0xb40000 [0202.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0202.919] GetProcessHeap () returned 0xb40000 [0202.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0202.919] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0202.919] GetProcessHeap () returned 0xb40000 [0202.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59fc0 | out: hHeap=0xb40000) returned 1 [0202.925] GetProcessHeap () returned 0xb40000 [0202.925] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e310 [0202.925] GetProcessHeap () returned 0xb40000 [0202.925] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4de90 [0202.925] GetProcessHeap () returned 0xb40000 [0202.925] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4de90, Size=0x72) returned 0x3b06a38 [0202.925] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2dc [0202.925] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0202.925] CloseHandle (hObject=0x2dc) returned 1 [0202.925] GetProcessHeap () returned 0xb40000 [0202.925] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e310 | out: hHeap=0xb40000) returned 1 [0202.925] GetProcessHeap () returned 0xb40000 [0202.925] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b06a38 | out: hHeap=0xb40000) returned 1 [0202.925] Sleep (dwMilliseconds=0x3e8) [0204.068] GetProcessHeap () returned 0xb40000 [0204.068] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2b8 [0204.068] GetProcessHeap () returned 0xb40000 [0204.068] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59fe8 [0204.068] GetProcessHeap () returned 0xb40000 [0204.068] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a038 [0204.068] GetProcessHeap () returned 0xb40000 [0204.068] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0x3ee1f68 [0204.068] GetProcessHeap () returned 0xb40000 [0204.068] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee1f68 | out: hHeap=0xb40000) returned 1 [0204.068] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59fe8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a038 | out: hHeap=0xb40000) returned 1 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2b8 | out: hHeap=0xb40000) returned 1 [0204.069] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59fe8 | out: hHeap=0xb40000) returned 1 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4de90 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4e508 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4e508, Size=0x72) returned 0x3b071b8 [0204.069] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f8 [0204.069] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x102 [0204.069] CloseHandle (hObject=0x2f8) returned 1 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4de90 | out: hHeap=0xb40000) returned 1 [0204.069] GetProcessHeap () returned 0xb40000 [0204.069] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b071b8 | out: hHeap=0xb40000) returned 1 [0204.069] Sleep (dwMilliseconds=0x3e8) [0205.268] GetProcessHeap () returned 0xb40000 [0205.268] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2e0 [0205.268] GetProcessHeap () returned 0xb40000 [0205.268] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59f98 [0205.268] GetProcessHeap () returned 0xb40000 [0205.269] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb59f48 [0205.269] GetProcessHeap () returned 0xb40000 [0205.269] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0x3ee14b8 [0205.269] GetProcessHeap () returned 0xb40000 [0205.269] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee14b8 | out: hHeap=0xb40000) returned 1 [0205.269] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59f98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0205.269] GetProcessHeap () returned 0xb40000 [0205.269] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f48 | out: hHeap=0xb40000) returned 1 [0205.269] GetProcessHeap () returned 0xb40000 [0205.269] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0205.269] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2e2fa18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2e2fa18*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.317] GetProcessHeap () returned 0xb40000 [0205.317] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f98 | out: hHeap=0xb40000) returned 1 [0205.317] GetProcessHeap () returned 0xb40000 [0205.317] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4e2c8 [0205.317] GetProcessHeap () returned 0xb40000 [0205.317] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x3a) returned 0xb4de90 [0205.317] GetProcessHeap () returned 0xb40000 [0205.317] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4de90, Size=0x72) returned 0x3b070b8 [0205.317] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2f8 [0205.317] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x102 [0205.317] CloseHandle (hObject=0x2f8) returned 1 [0205.317] GetProcessHeap () returned 0xb40000 [0205.317] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4e2c8 | out: hHeap=0xb40000) returned 1 [0205.317] GetProcessHeap () returned 0xb40000 [0205.317] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b070b8 | out: hHeap=0xb40000) returned 1 [0205.317] Sleep (dwMilliseconds=0x3e8) Thread: id = 102 os_tid = 0xfc4 [0191.473] GetProcessHeap () returned 0xb40000 [0191.473] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x21a) returned 0xb63438 [0191.473] GetProcessHeap () returned 0xb40000 [0191.473] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb50b10 [0191.473] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x25c [0191.474] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x290 [0191.474] GetComputerNameW (in: lpBuffer=0xb63448, nSize=0x2f6fe24 | out: lpBuffer="NQDPDE", nSize=0x2f6fe24) returned 1 [0191.474] GetProcessHeap () returned 0xb40000 [0191.474] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a2e0 [0191.474] CloseHandle (hObject=0x290) returned 1 [0191.474] CloseHandle (hObject=0x25c) returned 1 [0191.474] GetProcessHeap () returned 0xb40000 [0191.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb50b10 | out: hHeap=0xb40000) returned 1 [0191.474] GetProcessHeap () returned 0xb40000 [0191.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0191.474] GetProcessHeap () returned 0xb40000 [0191.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb63438 | out: hHeap=0xb40000) returned 1 [0191.474] GetProcessHeap () returned 0xb40000 [0191.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5c3d8 | out: hHeap=0xb40000) returned 1 Thread: id = 103 os_tid = 0xfc8 [0191.475] GetLogicalDrives () returned 0x4 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4df20 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb50ae0 [0191.475] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x25c [0191.475] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x290 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb5a1c8 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb59f98 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb59f70 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.475] GetProcessHeap () returned 0xb40000 [0191.475] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.475] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb59f98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.475] GetProcessHeap () returned 0xb40000 [0191.476] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f70 | out: hHeap=0xb40000) returned 1 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0191.476] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30afd2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30afd2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f98 | out: hHeap=0xb40000) returned 1 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a448 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a4f0 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a5e0 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.476] GetProcessHeap () returned 0xb40000 [0191.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a3a0 [0191.476] htonl (hostlong=0xb4197730) returned 0x307719b4 [0191.476] QueryPerformanceCounter (in: lpPerformanceCount=0x30afc20 | out: lpPerformanceCount=0x30afc20*=11169663216) returned 1 [0191.476] GetTickCount () returned 0x1145ca8 [0191.476] GetCurrentProcessId () returned 0xf98 [0191.476] GetCurrentThreadId () returned 0xfc8 [0191.476] GetLocalTime (in: lpSystemTime=0x30afc08 | out: lpSystemTime=0x30afc08*(wYear=0x7e4, wMonth=0x7, wDayOfWeek=0x6, wDay=0xb, wHour=0x10, wMinute=0x2a, wSecond=0x12, wMilliseconds=0x33c)) [0191.476] SystemTimeToFileTime (in: lpSystemTime=0x30afc08, lpFileTime=0x30afc18 | out: lpFileTime=0x30afc18) returned 1 [0191.476] QueryPerformanceCounter (in: lpPerformanceCount=0x30afc20 | out: lpPerformanceCount=0x30afc20*=11169682496) returned 1 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x28) returned 0xb50b10 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a5b0 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb4fc10 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x14) returned 0xb5c478 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a3b8 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x80) returned 0xb61038 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a3d0 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x82) returned 0xb60088 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a4d8 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb4fc30 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a3e8 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x80) returned 0xb4a710 [0191.477] GetProcessHeap () returned 0xb40000 [0191.477] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a508 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x2) returned 0xb4fc40 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb634b8 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a478 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x80) returned 0xb44600 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a5c8 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb634a8 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4fc40, Size=0x82) returned 0xb5fe48 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb634a8, Size=0x100) returned 0xb5c0a8 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a490 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x82) returned 0xb60118 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a520 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x82) returned 0xb60868 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5fe48, Size=0x104) returned 0xb4a338 [0191.478] GetProcessHeap () returned 0xb40000 [0191.478] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5c0a8, Size=0x200) returned 0xb63840 [0191.479] GetProcessHeap () returned 0xb40000 [0191.479] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb634b8 | out: hHeap=0xb40000) returned 1 [0191.479] GetProcessHeap () returned 0xb40000 [0191.479] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb63840 | out: hHeap=0xb40000) returned 1 [0191.479] GetProcessHeap () returned 0xb40000 [0191.479] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a5c8 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a710 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a3e8 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44600 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a478 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a338 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a508 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb60118 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a490 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb60868 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a520 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4fc10 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a5b0 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb60088 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a3d0 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb61038 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a3b8 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4fc30 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a4d8 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb50b10 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5c478 | out: hHeap=0xb40000) returned 1 [0191.480] GetProcessHeap () returned 0xb40000 [0191.480] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xa4) returned 0xb493b8 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a4f0 | out: hHeap=0xb40000) returned 1 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a5e0 | out: hHeap=0xb40000) returned 1 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a3a0 | out: hHeap=0xb40000) returned 1 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a448 | out: hHeap=0xb40000) returned 1 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x18) returned 0xb5c598 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0xe) returned 0xb5a448 [0191.481] ResetEvent (hEvent=0x290) returned 1 [0191.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9756b3, lpParameter=0xb5c598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0191.481] CloseHandle (hObject=0x294) returned 1 [0191.481] GetProcessHeap () returned 0xb40000 [0191.481] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a5f8 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a3e8 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a3a0 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a4d8 [0191.482] htonl (hostlong=0xb4197730) returned 0x307719b4 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x28) returned 0xb50b10 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a5e0 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb4fc10 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x14) returned 0xb5c258 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a478 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x80) returned 0xb61038 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a520 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x82) returned 0xb601a8 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a598 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb4fc30 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a490 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x80) returned 0xb44600 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a610 [0191.482] GetProcessHeap () returned 0xb40000 [0191.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x2) returned 0xb4fc40 [0191.482] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb63668 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a400 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x80) returned 0xb4a710 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a508 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x4) returned 0xb63828 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb4fc40, Size=0x82) returned 0xb5fed8 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb63828, Size=0x100) returned 0xb5c0a8 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a4f0 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x82) returned 0xb60358 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10) returned 0xb5a628 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x82) returned 0xb603e8 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5fed8, Size=0x104) returned 0xb4a338 [0191.483] GetProcessHeap () returned 0xb40000 [0191.483] RtlReAllocateHeap (Heap=0xb40000, Flags=0x0, Ptr=0xb5c0a8, Size=0x200) returned 0xb63840 [0191.484] GetProcessHeap () returned 0xb40000 [0191.484] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb63668 | out: hHeap=0xb40000) returned 1 [0191.484] GetProcessHeap () returned 0xb40000 [0191.484] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb63840 | out: hHeap=0xb40000) returned 1 [0191.484] GetProcessHeap () returned 0xb40000 [0191.484] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a508 | out: hHeap=0xb40000) returned 1 [0191.484] GetProcessHeap () returned 0xb40000 [0191.484] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb44600 | out: hHeap=0xb40000) returned 1 [0191.484] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a490 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a710 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a400 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a338 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a610 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb60358 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a4f0 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb603e8 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a628 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4fc10 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a5e0 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb601a8 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a520 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb61038 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a478 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4fc30 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a598 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb50b10 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5c258 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0xa4) returned 0xb49eb8 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a3e8 | out: hHeap=0xb40000) returned 1 [0191.485] GetProcessHeap () returned 0xb40000 [0191.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a3a0 | out: hHeap=0xb40000) returned 1 [0191.486] GetProcessHeap () returned 0xb40000 [0191.486] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.486] GetProcessHeap () returned 0xb40000 [0191.486] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a4d8 | out: hHeap=0xb40000) returned 1 [0191.486] GetProcessHeap () returned 0xb40000 [0191.486] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a5f8 | out: hHeap=0xb40000) returned 1 [0191.486] GetProcessHeap () returned 0xb40000 [0191.486] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x18) returned 0xb5c318 [0191.486] GetProcessHeap () returned 0xb40000 [0191.486] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0xe) returned 0xb5a568 [0191.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x9756b3, lpParameter=0xb5c318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0191.486] CloseHandle (hObject=0x294) returned 1 [0191.488] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) Thread: id = 104 os_tid = 0xfcc [0191.488] GetLogicalDrives () returned 0x4 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x20) returned 0xb59f98 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x8, Size=0x1e) returned 0xb5a2e0 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x1e) returned 0xb5a1c8 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x90) returned 0xb4b098 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4b098 | out: hHeap=0xb40000) returned 1 [0191.488] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb5a2e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a1c8 | out: hHeap=0xb40000) returned 1 [0191.488] GetProcessHeap () returned 0xb40000 [0191.488] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb59f98 | out: hHeap=0xb40000) returned 1 [0191.488] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x31eff2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x31eff2c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.489] GetProcessHeap () returned 0xb40000 [0191.489] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb5a2e0 | out: hHeap=0xb40000) returned 1 [0191.489] GetProcessHeap () returned 0xb40000 [0191.489] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x40) returned 0xb4dff8 [0191.489] GetProcessHeap () returned 0xb40000 [0191.489] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb50b40 [0191.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x294 [0191.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x298 [0191.489] GetLogicalDrives () returned 0x4 [0191.489] Sleep (dwMilliseconds=0x3e8) [0192.794] GetLogicalDrives () returned 0x4 [0192.794] Sleep (dwMilliseconds=0x3e8) [0194.055] GetLogicalDrives () returned 0x4 [0194.056] Sleep (dwMilliseconds=0x3e8) [0195.460] GetLogicalDrives () returned 0x4 [0195.460] Sleep (dwMilliseconds=0x3e8) [0196.755] GetLogicalDrives () returned 0x4 [0196.755] Sleep (dwMilliseconds=0x3e8) [0197.970] GetLogicalDrives () returned 0x4 [0197.970] Sleep (dwMilliseconds=0x3e8) [0199.213] GetLogicalDrives () returned 0x4 [0199.213] Sleep (dwMilliseconds=0x3e8) [0200.405] GetLogicalDrives () returned 0x4 [0200.405] Sleep (dwMilliseconds=0x3e8) [0201.628] GetLogicalDrives () returned 0x4 [0201.628] Sleep (dwMilliseconds=0x3e8) [0202.890] GetLogicalDrives () returned 0x4 [0202.890] Sleep (dwMilliseconds=0x3e8) [0204.067] GetLogicalDrives () returned 0x4 [0204.067] Sleep (dwMilliseconds=0x3e8) [0205.269] GetLogicalDrives () returned 0x4 [0205.269] Sleep (dwMilliseconds=0x3e8) Thread: id = 107 os_tid = 0xfe0 [0191.813] GetProcessHeap () returned 0xb40000 [0191.813] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x38) returned 0xb52a18 [0191.813] GetProcessHeap () returned 0xb40000 [0191.813] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x18) returned 0xb5c218 [0191.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c [0191.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0191.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a4 [0191.813] GetProcessHeap () returned 0xb40000 [0191.813] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb64a00 [0191.814] GetProcessHeap () returned 0xb40000 [0191.814] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb74a08 [0191.814] GetProcessHeap () returned 0xb40000 [0191.814] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb4a9b8 [0191.814] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0191.815] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0191.815] Wow64DisableWow64FsRedirection (in: OldValue=0x2f6f8ec | out: OldValue=0x2f6f8ec*=0x0) returned 1 [0191.815] GetProcessHeap () returned 0xb40000 [0191.815] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a9b8 | out: hHeap=0xb40000) returned 1 [0191.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x2f6f8f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0191.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x2f6f8f4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0191.816] GetProcessHeap () returned 0xb40000 [0191.816] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb84a10 [0191.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2f6f668 | out: lpFindFileData=0x2f6f668*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xb52a58 [0191.817] GetProcessHeap () returned 0xb40000 [0191.817] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb94a18 [0191.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52c98 [0191.817] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0191.818] GetProcessHeap () returned 0xb40000 [0191.818] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0191.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0191.819] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc605d0ea, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc605d0ea, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DOWNLE~1.EJE")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="OOBE_2~1.EJE")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 0 [0191.819] FindClose (in: hFindFile=0xb53018 | out: hFindFile=0xb53018) returned 1 [0191.820] GetProcessHeap () returned 0xb40000 [0191.820] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0191.821] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0191.821] GetProcessHeap () returned 0xb40000 [0191.821] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0191.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc637e0b7, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc637e0b7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc63b639d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~2.EJE")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60cf5ed, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60cf5ed, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~1.EJE")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60f58df, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60f58df, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60f58df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6331bef, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6331bef, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6331bef, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PREOOB~1.EJE")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 0 [0191.822] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0191.823] GetProcessHeap () returned 0xb40000 [0191.823] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0191.824] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0191.824] FindClose (in: hFindFile=0xb52c98 | out: hFindFile=0xb52c98) returned 1 [0191.824] GetProcessHeap () returned 0xb40000 [0191.824] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb94a18 | out: hHeap=0xb40000) returned 1 [0191.825] FindNextFileW (in: hFindFile=0xb52a58, lpFindFileData=0x2f6f668 | out: lpFindFileData=0x2f6f668*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0191.826] GetProcessHeap () returned 0xb40000 [0191.826] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0191.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0191.826] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0191.826] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0191.826] GetProcessHeap () returned 0xb40000 [0191.826] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb529d8 [0191.827] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc642711b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc642711b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc643c8d8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc642711b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc642711b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc643c8d8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 0 [0191.827] FindClose (in: hFindFile=0xb529d8 | out: hFindFile=0xb529d8) returned 1 [0191.827] GetProcessHeap () returned 0xb40000 [0191.827] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0191.827] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0191.827] GetProcessHeap () returned 0xb40000 [0191.827] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52c98 [0191.828] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x533c449f, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c805e, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0191.828] SetEvent (hEvent=0x2a0) returned 1 [0191.828] ResetEvent (hEvent=0x2a4) returned 1 [0191.828] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 0 [0191.828] FindClose (in: hFindFile=0xb52c98 | out: hFindFile=0xb52c98) returned 1 [0191.829] GetProcessHeap () returned 0xb40000 [0191.829] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0191.829] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0191.829] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0191.829] GetProcessHeap () returned 0xb40000 [0191.829] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb95a20 | out: hHeap=0xb40000) returned 1 [0191.830] FindNextFileW (in: hFindFile=0xb52a58, lpFindFileData=0x2f6f668 | out: lpFindFileData=0x2f6f668*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0191.830] FindNextFileW (in: hFindFile=0xb52a58, lpFindFileData=0x2f6f668 | out: lpFindFileData=0x2f6f668*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0191.830] GetProcessHeap () returned 0xb40000 [0191.830] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0191.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0191.832] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0191.832] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1 [0191.832] GetProcessHeap () returned 0xb40000 [0191.832] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52a98 [0191.833] FindNextFileW (in: hFindFile=0xb52a98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0xb52a98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0xb52a98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0xb52a98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0xb52a98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.833] FindClose (in: hFindFile=0xb52a98 | out: hFindFile=0xb52a98) returned 1 [0191.834] GetProcessHeap () returned 0xb40000 [0191.834] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0191.834] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1 [0191.834] GetProcessHeap () returned 0xb40000 [0191.835] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0191.836] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.836] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.836] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66154e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66154e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc663b846, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.836] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.836] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.836] FindClose (in: hFindFile=0xb52d98 | out: hFindFile=0xb52d98) returned 1 [0191.837] GetProcessHeap () returned 0xb40000 [0191.837] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0191.837] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1 [0191.837] GetProcessHeap () returned 0xb40000 [0191.837] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52c98 [0191.839] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.839] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6661a20, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6661a20, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6687c2f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.839] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.839] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.839] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.839] FindClose (in: hFindFile=0xb52c98 | out: hFindFile=0xb52c98) returned 1 [0191.840] GetProcessHeap () returned 0xb40000 [0191.840] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0191.840] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1 [0191.840] GetProcessHeap () returned 0xb40000 [0191.840] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0191.842] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.842] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66adc60, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66adc60, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.842] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66d3f72, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66d3f72, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.842] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.842] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.842] FindClose (in: hFindFile=0xb53018 | out: hFindFile=0xb53018) returned 1 [0191.843] GetProcessHeap () returned 0xb40000 [0191.843] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0191.843] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1 [0191.843] GetProcessHeap () returned 0xb40000 [0191.843] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0191.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.251] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.252] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67203e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc67203e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc67203e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.252] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6746675, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6746675, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.252] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.252] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.252] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.253] GetProcessHeap () returned 0xb40000 [0192.253] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.253] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1 [0192.253] GetProcessHeap () returned 0xb40000 [0192.253] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.254] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.255] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.255] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc695c8d9, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc695c8d9, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.255] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.255] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.255] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.256] GetProcessHeap () returned 0xb40000 [0192.256] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.256] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1 [0192.256] GetProcessHeap () returned 0xb40000 [0192.256] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.257] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.257] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.258] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.258] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.258] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.258] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.258] GetProcessHeap () returned 0xb40000 [0192.258] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.259] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1 [0192.259] GetProcessHeap () returned 0xb40000 [0192.259] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.260] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.260] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.260] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.260] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.260] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.261] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0192.261] GetProcessHeap () returned 0xb40000 [0192.261] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.262] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1 [0192.262] GetProcessHeap () returned 0xb40000 [0192.262] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.263] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.263] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.263] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.263] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.263] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.263] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.264] GetProcessHeap () returned 0xb40000 [0192.264] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.265] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1 [0192.265] GetProcessHeap () returned 0xb40000 [0192.265] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.266] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.266] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f06165, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6f06165, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.266] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc718eb45, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc718eb45, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.266] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.267] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.267] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.267] GetProcessHeap () returned 0xb40000 [0192.267] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.268] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1 [0192.268] GetProcessHeap () returned 0xb40000 [0192.268] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.269] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.269] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.269] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71daed0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71daed0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.269] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.270] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.270] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.270] GetProcessHeap () returned 0xb40000 [0192.270] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.271] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1 [0192.271] GetProcessHeap () returned 0xb40000 [0192.271] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.272] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.272] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc720100d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.272] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.272] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.272] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.272] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.273] GetProcessHeap () returned 0xb40000 [0192.273] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.273] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1 [0192.274] GetProcessHeap () returned 0xb40000 [0192.274] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.275] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.275] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc724d629, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.275] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc724d629, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc724d629, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.275] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.275] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.275] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.276] GetProcessHeap () returned 0xb40000 [0192.276] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.276] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1 [0192.276] GetProcessHeap () returned 0xb40000 [0192.276] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.277] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.278] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79282ab, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.278] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.278] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.278] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.278] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.279] GetProcessHeap () returned 0xb40000 [0192.279] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.279] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1 [0192.279] GetProcessHeap () returned 0xb40000 [0192.279] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0192.280] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.280] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.281] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc794e521, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc794e521, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.281] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.281] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.281] FindClose (in: hFindFile=0xb52e98 | out: hFindFile=0xb52e98) returned 1 [0192.281] GetProcessHeap () returned 0xb40000 [0192.281] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.282] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1 [0192.282] GetProcessHeap () returned 0xb40000 [0192.282] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.477] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.477] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.477] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799a6b5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc799a6b5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.477] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.477] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.477] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.477] GetProcessHeap () returned 0xb40000 [0192.477] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.477] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1 [0192.477] GetProcessHeap () returned 0xb40000 [0192.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.479] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.479] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.479] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.480] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.480] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.480] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.480] GetProcessHeap () returned 0xb40000 [0192.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.480] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1 [0192.480] GetProcessHeap () returned 0xb40000 [0192.481] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0192.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bfcda4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.482] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0192.483] GetProcessHeap () returned 0xb40000 [0192.483] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.483] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1 [0192.483] GetProcessHeap () returned 0xb40000 [0192.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.484] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.484] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.484] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e5f486, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.484] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.484] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.484] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0192.485] GetProcessHeap () returned 0xb40000 [0192.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.485] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1 [0192.485] GetProcessHeap () returned 0xb40000 [0192.485] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.486] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.486] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c6f4ac, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.486] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.486] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.486] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.486] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.487] GetProcessHeap () returned 0xb40000 [0192.487] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.487] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1 [0192.487] GetProcessHeap () returned 0xb40000 [0192.487] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.488] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.488] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7eab926, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.488] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e5f486, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e5f486, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.488] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.488] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.488] FindClose (in: hFindFile=0xb52d98 | out: hFindFile=0xb52d98) returned 1 [0192.489] GetProcessHeap () returned 0xb40000 [0192.489] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.489] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1 [0192.489] GetProcessHeap () returned 0xb40000 [0192.489] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.490] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.490] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7eab926, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7eab926, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ed1c8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.490] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ef7e2e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.490] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.490] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.490] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0192.491] GetProcessHeap () returned 0xb40000 [0192.491] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.491] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1 [0192.491] GetProcessHeap () returned 0xb40000 [0192.491] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.492] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.492] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ef7e2e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ef7e2e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.492] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f1ddc0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f1ddc0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.492] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.492] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.492] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.493] GetProcessHeap () returned 0xb40000 [0192.493] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.493] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1 [0192.493] GetProcessHeap () returned 0xb40000 [0192.493] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.494] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.494] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.494] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87ae93f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.494] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.494] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.494] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.495] GetProcessHeap () returned 0xb40000 [0192.495] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.495] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1 [0192.495] GetProcessHeap () returned 0xb40000 [0192.495] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.496] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.496] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc847b51f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.496] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84a2f93, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.496] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.496] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.496] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0192.497] GetProcessHeap () returned 0xb40000 [0192.497] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.497] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1 [0192.497] GetProcessHeap () returned 0xb40000 [0192.497] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.498] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.498] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8575d26, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8575d26, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc88217ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0192.498] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0192.498] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0192.498] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.499] GetProcessHeap () returned 0xb40000 [0192.499] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.499] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DHTMLH~1.EJE")) returned 1 [0192.499] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a3738e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DISPLA~1.EJE")) returned 1 [0192.499] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1 [0192.499] GetProcessHeap () returned 0xb40000 [0192.499] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.500] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.500] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8847300, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0192.500] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0192.500] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0192.500] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.501] GetProcessHeap () returned 0xb40000 [0192.501] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.501] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1 [0192.501] GetProcessHeap () returned 0xb40000 [0192.501] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba6a30 [0192.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.502] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.502] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PRINTI~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~2.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~3.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~4.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO751A~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO214E~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO6CC5~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO17CC~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SAVEIC~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8b42434, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPI~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b42434, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8b42434, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dca8be, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STOPIC~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~1.EJE")) returned 1 [0192.503] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~2.EJE")) returned 1 [0192.504] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 1 [0192.504] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 0 [0192.504] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.504] GetProcessHeap () returned 0xb40000 [0192.504] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba6a30 | out: hHeap=0xb40000) returned 1 [0192.504] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dacfb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8dacfb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dacfb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="HEADER~1.EJE")) returned 1 [0192.504] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xca3d85f7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc9914a4e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~2.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9914a4e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc9914a4e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca14fedb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~3.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xcc6da399, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~4.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3fe8ae, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca3fe8ae, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca6ad293, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C7C~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7de3d3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca7de3d3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca8047df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C70~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1a71f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa1a71f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa40aa3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa40aa3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa40aa3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa66d1a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa66d1a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa66d1a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad635ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~2.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad635ce, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad635ce, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad87e3d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad87e3d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad87e3d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb3ca2ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~2.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb69ef02, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb69ef02, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb744045, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~1.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb940715, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~2.EJE")) returned 1 [0192.505] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9d9033, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~3.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9d9033, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9d9033, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9ff116, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SPLASH~1.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ff116, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9ff116, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb3067d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SQMAPI~1.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb5679a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb5679a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STRING~1.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbba2da9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WATERM~1.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xccdbcae4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~1.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xcce2f139, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~2.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xce142189, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~3.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 1 [0192.506] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 0 [0192.506] FindClose (in: hFindFile=0xb52f58 | out: hFindFile=0xb52f58) returned 1 [0192.506] GetProcessHeap () returned 0xb40000 [0192.506] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb95a20 | out: hHeap=0xb40000) returned 1 [0192.507] FindNextFileW (in: hFindFile=0xb52a58, lpFindFileData=0x2f6f668 | out: lpFindFileData=0x2f6f668*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0192.507] GetProcessHeap () returned 0xb40000 [0192.507] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0192.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0192.508] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0192.509] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1 [0192.509] SetEvent (hEvent=0x2a0) returned 1 [0192.509] ResetEvent (hEvent=0x2a4) returned 1 [0192.509] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0192.509] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0192.509] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0192.509] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0192.509] GetProcessHeap () returned 0xb40000 [0192.509] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb529d8 [0192.510] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName="..", cAlternateFileName="")) returned 1 [0192.510] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.510] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.510] FindClose (in: hFindFile=0xb529d8 | out: hFindFile=0xb529d8) returned 1 [0192.510] GetProcessHeap () returned 0xb40000 [0192.510] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.510] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0192.510] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xce273134, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xce273134, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xce2994c2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="BOOTST~1.EJE")) returned 1 [0192.510] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0192.510] GetProcessHeap () returned 0xb40000 [0192.510] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.511] GetProcessHeap () returned 0xb40000 [0192.511] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.511] GetProcessHeap () returned 0xb40000 [0192.511] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.511] GetProcessHeap () returned 0xb40000 [0192.511] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.511] GetProcessHeap () returned 0xb40000 [0192.512] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.512] GetProcessHeap () returned 0xb40000 [0192.512] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.512] GetProcessHeap () returned 0xb40000 [0192.512] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.512] GetProcessHeap () returned 0xb40000 [0192.512] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.512] GetProcessHeap () returned 0xb40000 [0192.512] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.513] GetProcessHeap () returned 0xb40000 [0192.513] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.513] GetProcessHeap () returned 0xb40000 [0192.513] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.513] GetProcessHeap () returned 0xb40000 [0192.513] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.513] GetProcessHeap () returned 0xb40000 [0192.513] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.513] GetProcessHeap () returned 0xb40000 [0192.513] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.513] GetProcessHeap () returned 0xb40000 [0192.514] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0192.514] GetProcessHeap () returned 0xb40000 [0192.514] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.514] GetProcessHeap () returned 0xb40000 [0192.514] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.514] GetProcessHeap () returned 0xb40000 [0192.514] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.514] GetProcessHeap () returned 0xb40000 [0192.514] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.515] GetProcessHeap () returned 0xb40000 [0192.515] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.515] GetProcessHeap () returned 0xb40000 [0192.515] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.871] GetProcessHeap () returned 0xb40000 [0192.871] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.871] GetProcessHeap () returned 0xb40000 [0192.871] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.873] GetProcessHeap () returned 0xb40000 [0192.873] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.873] GetProcessHeap () returned 0xb40000 [0192.873] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.876] GetProcessHeap () returned 0xb40000 [0192.876] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.876] GetProcessHeap () returned 0xb40000 [0192.876] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.878] GetProcessHeap () returned 0xb40000 [0192.878] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.878] GetProcessHeap () returned 0xb40000 [0192.878] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.881] GetProcessHeap () returned 0xb40000 [0192.881] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.881] GetProcessHeap () returned 0xb40000 [0192.881] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.884] GetProcessHeap () returned 0xb40000 [0192.884] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.884] GetProcessHeap () returned 0xb40000 [0192.884] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.887] GetProcessHeap () returned 0xb40000 [0192.887] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.887] GetProcessHeap () returned 0xb40000 [0192.887] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0192.889] GetProcessHeap () returned 0xb40000 [0192.889] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.890] GetProcessHeap () returned 0xb40000 [0192.890] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.891] GetProcessHeap () returned 0xb40000 [0192.891] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.891] GetProcessHeap () returned 0xb40000 [0192.891] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.893] GetProcessHeap () returned 0xb40000 [0192.893] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.895] GetProcessHeap () returned 0xb40000 [0192.895] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.897] GetProcessHeap () returned 0xb40000 [0192.897] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.897] GetProcessHeap () returned 0xb40000 [0192.898] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.900] GetProcessHeap () returned 0xb40000 [0192.900] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.900] GetProcessHeap () returned 0xb40000 [0192.901] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.903] GetProcessHeap () returned 0xb40000 [0192.903] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.904] GetProcessHeap () returned 0xb40000 [0192.904] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.906] GetProcessHeap () returned 0xb40000 [0192.906] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.906] GetProcessHeap () returned 0xb40000 [0192.907] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.912] GetProcessHeap () returned 0xb40000 [0192.912] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.912] GetProcessHeap () returned 0xb40000 [0192.912] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.915] GetProcessHeap () returned 0xb40000 [0192.915] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.915] GetProcessHeap () returned 0xb40000 [0192.915] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.917] GetProcessHeap () returned 0xb40000 [0192.917] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3af7690 [0192.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x729, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.919] GetProcessHeap () returned 0xb40000 [0192.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3af7690 | out: hHeap=0xb40000) returned 1 [0192.919] GetProcessHeap () returned 0xb40000 [0192.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.920] GetProcessHeap () returned 0xb40000 [0192.920] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.922] GetProcessHeap () returned 0xb40000 [0192.922] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.922] GetProcessHeap () returned 0xb40000 [0192.922] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.925] GetProcessHeap () returned 0xb40000 [0192.925] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.925] GetProcessHeap () returned 0xb40000 [0192.925] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.927] GetProcessHeap () returned 0xb40000 [0192.927] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.927] GetProcessHeap () returned 0xb40000 [0192.927] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.929] GetProcessHeap () returned 0xb40000 [0192.929] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.929] GetProcessHeap () returned 0xb40000 [0192.929] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.932] GetProcessHeap () returned 0xb40000 [0192.932] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.932] GetProcessHeap () returned 0xb40000 [0192.932] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.933] GetProcessHeap () returned 0xb40000 [0192.933] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.933] GetProcessHeap () returned 0xb40000 [0192.933] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.936] GetProcessHeap () returned 0xb40000 [0192.936] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.936] GetProcessHeap () returned 0xb40000 [0192.936] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.939] GetProcessHeap () returned 0xb40000 [0192.939] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.939] GetProcessHeap () returned 0xb40000 [0192.939] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.941] GetProcessHeap () returned 0xb40000 [0192.941] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.943] GetProcessHeap () returned 0xb40000 [0192.943] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.946] GetProcessHeap () returned 0xb40000 [0192.946] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.946] GetProcessHeap () returned 0xb40000 [0192.946] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.949] GetProcessHeap () returned 0xb40000 [0192.949] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.949] GetProcessHeap () returned 0xb40000 [0192.949] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffeddb, dwReserved1=0x932, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.952] GetProcessHeap () returned 0xb40000 [0192.952] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.952] GetProcessHeap () returned 0xb40000 [0192.952] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb95a20 | out: hHeap=0xb40000) returned 1 [0192.954] GetProcessHeap () returned 0xb40000 [0192.954] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3af6688 [0192.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0192.955] GetProcessHeap () returned 0xb40000 [0192.955] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3af6688 | out: hHeap=0xb40000) returned 1 [0192.956] GetProcessHeap () returned 0xb40000 [0192.956] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3af6688 [0192.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x5edf6a21, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x5edf6a21, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.964] GetProcessHeap () returned 0xb40000 [0192.964] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3af6688 | out: hHeap=0xb40000) returned 1 [0192.965] GetProcessHeap () returned 0xb40000 [0192.965] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3af6688 [0192.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.965] GetProcessHeap () returned 0xb40000 [0192.965] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3af6688 | out: hHeap=0xb40000) returned 1 [0192.965] GetProcessHeap () returned 0xb40000 [0192.965] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3af6688 [0192.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2f6f3e0 | out: lpFindFileData=0x2f6f3e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb530d8 [0192.966] GetProcessHeap () returned 0xb40000 [0192.966] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0192.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0192.966] GetProcessHeap () returned 0xb40000 [0192.966] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x727, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.984] GetProcessHeap () returned 0xb40000 [0192.984] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0192.984] GetProcessHeap () returned 0xb40000 [0192.984] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0192.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x727, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.985] GetProcessHeap () returned 0xb40000 [0192.985] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0192.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.003] GetProcessHeap () returned 0xb40000 [0193.003] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.003] GetProcessHeap () returned 0xb40000 [0193.003] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.003] GetProcessHeap () returned 0xb40000 [0193.003] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.004] GetProcessHeap () returned 0xb40000 [0193.004] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.004] GetProcessHeap () returned 0xb40000 [0193.004] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0193.004] GetProcessHeap () returned 0xb40000 [0193.004] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.005] GetProcessHeap () returned 0xb40000 [0193.005] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.006] GetProcessHeap () returned 0xb40000 [0193.006] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.006] GetProcessHeap () returned 0xb40000 [0193.006] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.006] GetProcessHeap () returned 0xb40000 [0193.006] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.006] GetProcessHeap () returned 0xb40000 [0193.006] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.008] GetProcessHeap () returned 0xb40000 [0193.008] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.008] GetProcessHeap () returned 0xb40000 [0193.008] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.008] GetProcessHeap () returned 0xb40000 [0193.008] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.008] GetProcessHeap () returned 0xb40000 [0193.008] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.008] GetProcessHeap () returned 0xb40000 [0193.008] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.008] GetProcessHeap () returned 0xb40000 [0193.008] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.009] GetProcessHeap () returned 0xb40000 [0193.009] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.010] GetProcessHeap () returned 0xb40000 [0193.010] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.010] GetProcessHeap () returned 0xb40000 [0193.010] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.011] GetProcessHeap () returned 0xb40000 [0193.011] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.011] GetProcessHeap () returned 0xb40000 [0193.011] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.011] GetProcessHeap () returned 0xb40000 [0193.011] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.011] GetProcessHeap () returned 0xb40000 [0193.011] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.011] GetProcessHeap () returned 0xb40000 [0193.011] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.178] GetProcessHeap () returned 0xb40000 [0193.178] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.178] GetProcessHeap () returned 0xb40000 [0193.178] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.178] GetProcessHeap () returned 0xb40000 [0193.178] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.178] GetProcessHeap () returned 0xb40000 [0193.178] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.179] GetProcessHeap () returned 0xb40000 [0193.179] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.179] GetProcessHeap () returned 0xb40000 [0193.179] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.179] GetProcessHeap () returned 0xb40000 [0193.179] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.179] GetProcessHeap () returned 0xb40000 [0193.179] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.180] GetProcessHeap () returned 0xb40000 [0193.180] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.180] GetProcessHeap () returned 0xb40000 [0193.180] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.180] GetProcessHeap () returned 0xb40000 [0193.180] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.180] GetProcessHeap () returned 0xb40000 [0193.180] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b2b6c8 [0193.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x522, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.180] GetProcessHeap () returned 0xb40000 [0193.180] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b2b6c8 | out: hHeap=0xb40000) returned 1 [0193.180] GetProcessHeap () returned 0xb40000 [0193.180] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.181] GetProcessHeap () returned 0xb40000 [0193.181] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.182] GetProcessHeap () returned 0xb40000 [0193.182] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.182] GetProcessHeap () returned 0xb40000 [0193.182] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.182] GetProcessHeap () returned 0xb40000 [0193.182] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.183] GetProcessHeap () returned 0xb40000 [0193.183] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.183] GetProcessHeap () returned 0xb40000 [0193.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.183] GetProcessHeap () returned 0xb40000 [0193.183] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.183] GetProcessHeap () returned 0xb40000 [0193.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.184] GetProcessHeap () returned 0xb40000 [0193.184] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.184] GetProcessHeap () returned 0xb40000 [0193.184] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.184] GetProcessHeap () returned 0xb40000 [0193.184] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.184] GetProcessHeap () returned 0xb40000 [0193.184] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.184] GetProcessHeap () returned 0xb40000 [0193.184] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.185] GetProcessHeap () returned 0xb40000 [0193.185] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.185] GetProcessHeap () returned 0xb40000 [0193.185] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.185] GetProcessHeap () returned 0xb40000 [0193.185] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.185] GetProcessHeap () returned 0xb40000 [0193.185] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.185] GetProcessHeap () returned 0xb40000 [0193.185] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.185] GetProcessHeap () returned 0xb40000 [0193.185] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.186] GetProcessHeap () returned 0xb40000 [0193.186] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.186] GetProcessHeap () returned 0xb40000 [0193.186] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.186] GetProcessHeap () returned 0xb40000 [0193.186] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.186] GetProcessHeap () returned 0xb40000 [0193.186] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.187] GetProcessHeap () returned 0xb40000 [0193.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.187] GetProcessHeap () returned 0xb40000 [0193.187] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.187] GetProcessHeap () returned 0xb40000 [0193.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.187] GetProcessHeap () returned 0xb40000 [0193.187] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.187] GetProcessHeap () returned 0xb40000 [0193.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.187] GetProcessHeap () returned 0xb40000 [0193.187] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.188] GetProcessHeap () returned 0xb40000 [0193.188] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.188] GetProcessHeap () returned 0xb40000 [0193.188] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0193.188] GetProcessHeap () returned 0xb40000 [0193.188] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.188] GetProcessHeap () returned 0xb40000 [0193.188] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.188] GetProcessHeap () returned 0xb40000 [0193.188] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.189] GetProcessHeap () returned 0xb40000 [0193.189] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.189] GetProcessHeap () returned 0xb40000 [0193.189] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.189] GetProcessHeap () returned 0xb40000 [0193.189] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.189] GetProcessHeap () returned 0xb40000 [0193.189] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.189] GetProcessHeap () returned 0xb40000 [0193.189] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.190] GetProcessHeap () returned 0xb40000 [0193.190] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.190] GetProcessHeap () returned 0xb40000 [0193.190] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.190] GetProcessHeap () returned 0xb40000 [0193.191] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.191] GetProcessHeap () returned 0xb40000 [0193.191] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.191] GetProcessHeap () returned 0xb40000 [0193.191] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.191] GetProcessHeap () returned 0xb40000 [0193.191] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.191] GetProcessHeap () returned 0xb40000 [0193.191] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.191] GetProcessHeap () returned 0xb40000 [0193.191] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.192] GetProcessHeap () returned 0xb40000 [0193.192] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.192] GetProcessHeap () returned 0xb40000 [0193.192] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.192] GetProcessHeap () returned 0xb40000 [0193.192] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.192] GetProcessHeap () returned 0xb40000 [0193.192] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b1a6b8 [0193.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x524, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.193] GetProcessHeap () returned 0xb40000 [0193.193] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b1a6b8 | out: hHeap=0xb40000) returned 1 [0193.193] GetProcessHeap () returned 0xb40000 [0193.193] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.194] GetProcessHeap () returned 0xb40000 [0193.194] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.195] GetProcessHeap () returned 0xb40000 [0193.195] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b196b0 [0193.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffce31, dwReserved1=0x1956, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.195] GetProcessHeap () returned 0xb40000 [0193.195] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b196b0 | out: hHeap=0xb40000) returned 1 [0193.195] GetProcessHeap () returned 0xb40000 [0193.195] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.196] GetProcessHeap () returned 0xb40000 [0193.196] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.197] GetProcessHeap () returned 0xb40000 [0193.197] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b196b0 [0193.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffce31, dwReserved1=0x1956, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.199] GetProcessHeap () returned 0xb40000 [0193.199] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b196b0 | out: hHeap=0xb40000) returned 1 [0193.199] GetProcessHeap () returned 0xb40000 [0193.199] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.200] GetProcessHeap () returned 0xb40000 [0193.200] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.201] GetProcessHeap () returned 0xb40000 [0193.201] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.201] GetProcessHeap () returned 0xb40000 [0193.201] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.202] GetProcessHeap () returned 0xb40000 [0193.202] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.202] GetProcessHeap () returned 0xb40000 [0193.202] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.203] GetProcessHeap () returned 0xb40000 [0193.203] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.204] GetProcessHeap () returned 0xb40000 [0193.204] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.204] GetProcessHeap () returned 0xb40000 [0193.204] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b196b0 [0193.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffce31, dwReserved1=0x1956, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.204] GetProcessHeap () returned 0xb40000 [0193.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b196b0 | out: hHeap=0xb40000) returned 1 [0193.204] GetProcessHeap () returned 0xb40000 [0193.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.205] GetProcessHeap () returned 0xb40000 [0193.205] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0193.206] GetProcessHeap () returned 0xb40000 [0193.206] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b196b0 [0193.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffce31, dwReserved1=0x1956, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.207] GetProcessHeap () returned 0xb40000 [0193.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b196b0 | out: hHeap=0xb40000) returned 1 [0193.207] GetProcessHeap () returned 0xb40000 [0193.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.208] GetProcessHeap () returned 0xb40000 [0193.208] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.209] GetProcessHeap () returned 0xb40000 [0193.209] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.209] GetProcessHeap () returned 0xb40000 [0193.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.209] GetProcessHeap () returned 0xb40000 [0193.209] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.209] GetProcessHeap () returned 0xb40000 [0193.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b096a8 [0193.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x526, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.210] GetProcessHeap () returned 0xb40000 [0193.210] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b196b0 [0193.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffce31, dwReserved1=0x1956, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.556] GetProcessHeap () returned 0xb40000 [0193.556] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0193.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.557] GetProcessHeap () returned 0xb40000 [0193.557] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0193.557] GetProcessHeap () returned 0xb40000 [0193.557] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b196b0 | out: hHeap=0xb40000) returned 1 [0193.559] GetProcessHeap () returned 0xb40000 [0193.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b096a8 | out: hHeap=0xb40000) returned 1 [0193.559] GetProcessHeap () returned 0xb40000 [0193.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0193.560] GetProcessHeap () returned 0xb40000 [0193.560] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0193.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x727, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.561] GetProcessHeap () returned 0xb40000 [0193.561] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0193.561] GetProcessHeap () returned 0xb40000 [0193.561] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0193.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x727, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.561] GetProcessHeap () returned 0xb40000 [0193.561] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b086a0 [0193.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.562] GetProcessHeap () returned 0xb40000 [0193.562] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b186a8 [0193.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x520, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.562] GetProcessHeap () returned 0xb40000 [0193.562] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b186a8 | out: hHeap=0xb40000) returned 1 [0193.562] GetProcessHeap () returned 0xb40000 [0193.562] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b086a0 | out: hHeap=0xb40000) returned 1 [0193.563] GetProcessHeap () returned 0xb40000 [0193.563] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b086a0 [0193.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.564] GetProcessHeap () returned 0xb40000 [0193.564] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b086a0 | out: hHeap=0xb40000) returned 1 [0193.564] GetProcessHeap () returned 0xb40000 [0193.564] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b086a0 [0193.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.564] GetProcessHeap () returned 0xb40000 [0193.564] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b186a8 [0193.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x520, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.565] GetProcessHeap () returned 0xb40000 [0193.565] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b186a8 | out: hHeap=0xb40000) returned 1 [0193.565] GetProcessHeap () returned 0xb40000 [0193.565] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b086a0 | out: hHeap=0xb40000) returned 1 [0193.566] GetProcessHeap () returned 0xb40000 [0193.566] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b086a0 [0193.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.567] GetProcessHeap () returned 0xb40000 [0193.567] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b186a8 [0193.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x520, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.567] GetProcessHeap () returned 0xb40000 [0193.567] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b186a8 | out: hHeap=0xb40000) returned 1 [0193.567] GetProcessHeap () returned 0xb40000 [0193.567] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b086a0 | out: hHeap=0xb40000) returned 1 [0193.568] GetProcessHeap () returned 0xb40000 [0193.568] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0193.568] GetProcessHeap () returned 0xb40000 [0193.568] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb95a20 | out: hHeap=0xb40000) returned 1 [0193.569] GetProcessHeap () returned 0xb40000 [0193.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0193.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.570] GetProcessHeap () returned 0xb40000 [0193.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0193.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0193.570] GetProcessHeap () returned 0xb40000 [0193.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0193.570] GetProcessHeap () returned 0xb40000 [0193.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0193.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.571] GetProcessHeap () returned 0xb40000 [0193.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0193.571] GetProcessHeap () returned 0xb40000 [0193.571] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0193.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.571] GetProcessHeap () returned 0xb40000 [0193.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0193.571] GetProcessHeap () returned 0xb40000 [0193.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb95a20 | out: hHeap=0xb40000) returned 1 [0193.572] GetProcessHeap () returned 0xb40000 [0193.572] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0193.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0193.572] GetProcessHeap () returned 0xb40000 [0193.572] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0193.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.573] GetProcessHeap () returned 0xb40000 [0193.573] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0193.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x520, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.574] GetProcessHeap () returned 0xb40000 [0193.574] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x31f, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.574] GetProcessHeap () returned 0xb40000 [0193.574] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.574] GetProcessHeap () returned 0xb40000 [0193.574] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x31f, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.574] GetProcessHeap () returned 0xb40000 [0193.574] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.574] GetProcessHeap () returned 0xb40000 [0193.574] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x31f, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.575] GetProcessHeap () returned 0xb40000 [0193.575] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.575] GetProcessHeap () returned 0xb40000 [0193.575] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0193.575] GetProcessHeap () returned 0xb40000 [0193.575] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0193.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x520, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.576] GetProcessHeap () returned 0xb40000 [0193.576] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.576] GetProcessHeap () returned 0xb40000 [0193.576] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.576] GetProcessHeap () returned 0xb40000 [0193.576] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0193.576] GetProcessHeap () returned 0xb40000 [0193.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.577] GetProcessHeap () returned 0xb40000 [0193.577] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.577] GetProcessHeap () returned 0xb40000 [0193.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.577] GetProcessHeap () returned 0xb40000 [0193.577] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.577] GetProcessHeap () returned 0xb40000 [0193.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.577] GetProcessHeap () returned 0xb40000 [0193.577] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.935] GetProcessHeap () returned 0xb40000 [0193.935] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0193.952] GetProcessHeap () returned 0xb40000 [0193.952] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0193.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.998] GetProcessHeap () returned 0xb40000 [0193.998] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.007] GetProcessHeap () returned 0xb40000 [0194.007] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.008] GetProcessHeap () returned 0xb40000 [0194.008] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0194.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x2f6e738 | out: lpFindFileData=0x2f6e738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0194.513] GetProcessHeap () returned 0xb40000 [0194.513] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0194.513] GetProcessHeap () returned 0xb40000 [0194.514] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.517] GetProcessHeap () returned 0xb40000 [0194.517] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0194.543] GetProcessHeap () returned 0xb40000 [0194.543] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.072] GetProcessHeap () returned 0xb40000 [0195.072] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0195.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0195.592] GetProcessHeap () returned 0xb40000 [0195.592] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0196.359] GetProcessHeap () returned 0xb40000 [0196.360] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0196.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.736] GetProcessHeap () returned 0xb40000 [0196.736] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0196.739] GetProcessHeap () returned 0xb40000 [0196.739] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.032] GetProcessHeap () returned 0xb40000 [0197.032] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0197.041] GetProcessHeap () returned 0xb40000 [0197.041] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb95a20 | out: hHeap=0xb40000) returned 1 [0197.042] GetProcessHeap () returned 0xb40000 [0197.042] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xb95a20 [0197.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2f6f158 | out: lpFindFileData=0x2f6f158*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0197.050] GetProcessHeap () returned 0xb40000 [0197.050] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0197.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.212] GetProcessHeap () returned 0xb40000 [0197.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0197.212] GetProcessHeap () returned 0xb40000 [0197.212] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0197.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.697] GetProcessHeap () returned 0xb40000 [0197.697] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xba5a28 | out: hHeap=0xb40000) returned 1 [0197.697] GetProcessHeap () returned 0xb40000 [0197.697] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xba5a28 [0197.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x2f6eed0 | out: lpFindFileData=0x2f6eed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.698] GetProcessHeap () returned 0xb40000 [0197.698] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.709] GetProcessHeap () returned 0xb40000 [0197.709] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.709] GetProcessHeap () returned 0xb40000 [0197.709] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x2f6ec48 | out: lpFindFileData=0x2f6ec48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.709] GetProcessHeap () returned 0xb40000 [0197.709] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2f6e9c0 | out: lpFindFileData=0x2f6e9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb53018 Thread: id = 108 os_tid = 0xfe4 [0191.845] GetProcessHeap () returned 0xb40000 [0191.845] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x38) returned 0xb52a98 [0191.845] GetProcessHeap () returned 0xb40000 [0191.846] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x18) returned 0xb5c238 [0191.846] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0191.846] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0191.846] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0191.846] GetProcessHeap () returned 0xb40000 [0191.846] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbb7318 [0191.846] GetProcessHeap () returned 0xb40000 [0191.846] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbc7320 [0191.847] GetProcessHeap () returned 0xb40000 [0191.847] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb4a9b8 [0191.847] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0191.847] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0191.847] Wow64DisableWow64FsRedirection (in: OldValue=0x342f7bc | out: OldValue=0x342f7bc*=0x0) returned 1 [0191.847] GetProcessHeap () returned 0xb40000 [0191.847] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a9b8 | out: hHeap=0xb40000) returned 1 [0191.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x342f7c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0191.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x9754bf, lpParameter=0x342f7c4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0191.848] GetProcessHeap () returned 0xb40000 [0191.848] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbd7328 [0191.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x342f538 | out: lpFindFileData=0x342f538*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xb52c98 [0191.849] GetProcessHeap () returned 0xb40000 [0191.849] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe7330 [0191.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0191.850] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0191.850] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0191.850] GetProcessHeap () returned 0xb40000 [0191.850] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0191.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0191.851] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.851] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc605d0ea, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc605d0ea, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DOWNLE~1.EJE")) returned 1 [0191.851] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="OOBE_2~1.EJE")) returned 1 [0191.851] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0191.851] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6083471, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6083471, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6083471, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 0 [0191.851] FindClose (in: hFindFile=0xb53018 | out: hFindFile=0xb53018) returned 1 [0191.852] GetProcessHeap () returned 0xb40000 [0191.852] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0191.852] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0191.853] GetProcessHeap () returned 0xb40000 [0191.853] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0191.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc637e0b7, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc637e0b7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc63b639d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~2.EJE")) returned 1 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60cf5ed, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60cf5ed, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60cf5ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="GETCUR~1.EJE")) returned 1 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60f58df, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc60f58df, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc60f58df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARTNE~1.EJE")) returned 1 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6331bef, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6331bef, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6331bef, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PREOOB~1.EJE")) returned 1 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 1 [0191.854] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6362cb2, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6362cb2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc637e0b7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPC~1.EJE")) returned 0 [0191.854] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0191.855] GetProcessHeap () returned 0xb40000 [0191.855] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0191.855] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0191.855] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0191.856] GetProcessHeap () returned 0xb40000 [0191.856] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe7330 | out: hHeap=0xb40000) returned 1 [0191.856] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x342f538 | out: lpFindFileData=0x342f538*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0191.857] GetProcessHeap () returned 0xb40000 [0191.857] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0191.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0191.857] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0191.857] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0191.857] GetProcessHeap () returned 0xb40000 [0191.857] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb529d8 [0191.858] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.858] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc642711b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc642711b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc643c8d8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 1 [0191.858] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc642711b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc642711b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc643c8d8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 0 [0191.858] FindClose (in: hFindFile=0xb529d8 | out: hFindFile=0xb529d8) returned 1 [0191.858] GetProcessHeap () returned 0xb40000 [0191.858] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0191.858] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0191.858] GetProcessHeap () returned 0xb40000 [0191.859] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0191.859] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.859] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x533c449f, ftCreationTime.dwHighDateTime=0x1d65791, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c805e, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0191.859] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 1 [0191.859] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc63c8719, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc63c8719, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc64221b2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DESKTO~1.EJE")) returned 0 [0191.859] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0191.859] GetProcessHeap () returned 0xb40000 [0191.859] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0191.860] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x533c449f, ftLastAccessTime.dwHighDateTime=0x1d65791, ftLastWriteTime.dwLowDateTime=0x533c449f, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0191.860] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0191.860] GetProcessHeap () returned 0xb40000 [0191.860] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0191.861] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x342f538 | out: lpFindFileData=0x342f538*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0191.861] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x342f538 | out: lpFindFileData=0x342f538*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0191.861] GetProcessHeap () returned 0xb40000 [0191.861] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0191.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0191.862] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xccf867a7, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xccf867a7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0191.862] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1 [0191.862] GetProcessHeap () returned 0xb40000 [0191.862] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0191.863] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65c909e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65c909e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc65ef070, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.863] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0191.864] GetProcessHeap () returned 0xb40000 [0191.864] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0191.864] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1 [0191.865] GetProcessHeap () returned 0xb40000 [0191.865] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0191.866] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.866] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ef070, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc65ef070, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66154e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.866] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66154e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66154e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc663b846, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.866] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.866] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc663b846, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc663b846, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6661a20, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.866] FindClose (in: hFindFile=0xb52d98 | out: hFindFile=0xb52d98) returned 1 [0191.867] GetProcessHeap () returned 0xb40000 [0191.867] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0191.867] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1 [0191.867] GetProcessHeap () returned 0xb40000 [0191.867] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0191.868] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.869] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6661a20, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6661a20, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6687c2f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.869] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.869] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.869] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6687c2f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6687c2f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66adc60, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.869] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0191.869] GetProcessHeap () returned 0xb40000 [0191.870] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0191.870] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1 [0191.870] GetProcessHeap () returned 0xb40000 [0191.870] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0191.871] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.871] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66adc60, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66adc60, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0191.871] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66d3f72, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66d3f72, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0191.871] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0191.871] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66fa1fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc66fa1fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc66fa1fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0191.872] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0191.872] GetProcessHeap () returned 0xb40000 [0191.872] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0191.873] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1 [0191.873] GetProcessHeap () returned 0xb40000 [0191.873] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0191.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.219] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.219] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67203e6, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc67203e6, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc67203e6, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.219] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6746675, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6746675, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.220] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.220] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6936788, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.220] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.220] GetProcessHeap () returned 0xb40000 [0192.220] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.220] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1 [0192.220] GetProcessHeap () returned 0xb40000 [0192.220] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.222] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.222] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6936788, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6936788, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.222] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc695c8d9, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc695c8d9, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc695c8d9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.222] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.222] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6982a2b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.222] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.223] GetProcessHeap () returned 0xb40000 [0192.223] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.223] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1 [0192.223] GetProcessHeap () returned 0xb40000 [0192.223] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.225] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.225] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6982a2b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6982a2b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.225] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.225] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.225] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e6d929, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.225] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.226] GetProcessHeap () returned 0xb40000 [0192.226] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.226] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1 [0192.226] GetProcessHeap () returned 0xb40000 [0192.226] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.228] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.228] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6d929, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e6d929, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.228] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e93b9f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6e93b9f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6e93b9f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.228] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.228] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6eb9e42, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.228] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0192.229] GetProcessHeap () returned 0xb40000 [0192.229] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.229] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1 [0192.229] GetProcessHeap () returned 0xb40000 [0192.229] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.231] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.231] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6eb9e42, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6eb9e42, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.231] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.231] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.231] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ee002e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6ee002e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc6ee002e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.231] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.232] GetProcessHeap () returned 0xb40000 [0192.232] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.232] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1 [0192.232] GetProcessHeap () returned 0xb40000 [0192.232] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.234] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.234] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f06165, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc6f06165, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.234] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc718eb45, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc718eb45, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc718eb45, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.234] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.234] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71b4c95, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.234] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.235] GetProcessHeap () returned 0xb40000 [0192.235] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.235] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1 [0192.235] GetProcessHeap () returned 0xb40000 [0192.235] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.236] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.237] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71b4c95, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71b4c95, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.237] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc71daed0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc71daed0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc71daed0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.237] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.237] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73a4993, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.237] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.238] GetProcessHeap () returned 0xb40000 [0192.238] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.238] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1 [0192.239] GetProcessHeap () returned 0xb40000 [0192.239] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.240] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.240] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc720100d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.240] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc720100d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc720100d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.240] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.240] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc722a11c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.240] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.241] GetProcessHeap () returned 0xb40000 [0192.241] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.241] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1 [0192.241] GetProcessHeap () returned 0xb40000 [0192.241] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.243] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.243] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc722a11c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc722a11c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc724d629, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.243] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc724d629, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc724d629, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.243] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.243] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73a4993, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73a4993, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73cab23, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.243] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.244] GetProcessHeap () returned 0xb40000 [0192.244] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.244] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1 [0192.244] GetProcessHeap () returned 0xb40000 [0192.244] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.246] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.246] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79282ab, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.246] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc73f0e56, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.246] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.246] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73f0e56, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc73f0e56, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7417177, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.246] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.247] GetProcessHeap () returned 0xb40000 [0192.247] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.247] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1 [0192.247] GetProcessHeap () returned 0xb40000 [0192.247] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0192.249] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.249] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79282ab, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79282ab, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.249] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc794e521, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc794e521, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79744a8, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.249] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.249] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc799a6b5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.249] FindClose (in: hFindFile=0xb52e98 | out: hFindFile=0xb52e98) returned 1 [0192.250] GetProcessHeap () returned 0xb40000 [0192.250] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.250] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1 [0192.250] GetProcessHeap () returned 0xb40000 [0192.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.538] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.538] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79744a8, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79744a8, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.538] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc799a6b5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc799a6b5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79c0967, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.538] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.538] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bd6b06, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.538] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.539] GetProcessHeap () returned 0xb40000 [0192.539] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.539] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1 [0192.539] GetProcessHeap () returned 0xb40000 [0192.539] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.540] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.540] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79c0967, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79c0967, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.540] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc79e6e8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.540] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.540] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79e6e8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc79e6e8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.540] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.541] GetProcessHeap () returned 0xb40000 [0192.541] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.541] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1 [0192.541] GetProcessHeap () returned 0xb40000 [0192.541] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb529d8 [0192.542] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.542] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7bfcda4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.542] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7bfcda4, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7bfcda4, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.542] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.542] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c2483b, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.542] FindClose (in: hFindFile=0xb529d8 | out: hFindFile=0xb529d8) returned 1 [0192.543] GetProcessHeap () returned 0xb40000 [0192.543] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.543] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1 [0192.543] GetProcessHeap () returned 0xb40000 [0192.543] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.544] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.544] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c2483b, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c2483b, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.544] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e5f486, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.544] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.544] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c493de, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c493de, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c493de, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.544] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0192.545] GetProcessHeap () returned 0xb40000 [0192.545] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.545] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1 [0192.545] GetProcessHeap () returned 0xb40000 [0192.545] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.545] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.545] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c6f4ac, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.546] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c6f4ac, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c6f4ac, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.546] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.546] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7c9589c, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.546] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.546] GetProcessHeap () returned 0xb40000 [0192.546] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.546] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1 [0192.547] GetProcessHeap () returned 0xb40000 [0192.547] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.547] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.547] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c9589c, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7c9589c, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7eab926, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.547] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e5f486, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e5f486, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.548] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.548] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e856fb, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7e856fb, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7e856fb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.548] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0192.548] GetProcessHeap () returned 0xb40000 [0192.548] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.548] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1 [0192.548] GetProcessHeap () returned 0xb40000 [0192.549] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.550] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.550] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7eab926, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7eab926, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ed1c8e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.550] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7ef7e2e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.550] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.550] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ed1c8e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ed1c8e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8218f66, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.550] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0192.551] GetProcessHeap () returned 0xb40000 [0192.551] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.551] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1 [0192.551] GetProcessHeap () returned 0xb40000 [0192.551] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.552] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.552] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ef7e2e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7ef7e2e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.552] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f1ddc0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f1ddc0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f1ddc0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.552] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.552] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc7f4441a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.552] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.553] GetProcessHeap () returned 0xb40000 [0192.553] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.553] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1 [0192.553] GetProcessHeap () returned 0xb40000 [0192.553] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.554] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.554] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f4441a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc7f4441a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.554] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87ae93f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.554] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.554] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84552a5, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84552a5, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84552a5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.554] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0192.555] GetProcessHeap () returned 0xb40000 [0192.555] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.555] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1 [0192.555] GetProcessHeap () returned 0xb40000 [0192.555] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0192.556] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.556] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc847b51f, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="EULART~1.EJE")) returned 1 [0192.556] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847b51f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc847b51f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc84a2f93, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="LOCALI~1.EJE")) returned 1 [0192.556] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 1 [0192.556] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84a2f93, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc84a2f93, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8575d26, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPR~1.EJE")) returned 0 [0192.556] FindClose (in: hFindFile=0xb52e98 | out: hFindFile=0xb52e98) returned 1 [0192.557] GetProcessHeap () returned 0xb40000 [0192.557] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.557] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1 [0192.557] GetProcessHeap () returned 0xb40000 [0192.557] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.558] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.558] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8575d26, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8575d26, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc88217ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0192.558] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0192.558] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ae93f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87ae93f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0192.558] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.559] GetProcessHeap () returned 0xb40000 [0192.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.559] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc87d4cb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DHTMLH~1.EJE")) returned 1 [0192.559] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87d4cb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc87d4cb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a3738e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="DISPLA~1.EJE")) returned 1 [0192.559] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1 [0192.559] GetProcessHeap () returned 0xb40000 [0192.559] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.560] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.560] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8847300, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0192.560] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0192.560] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8847300, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8847300, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc886d3e5, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 0 [0192.560] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0192.561] GetProcessHeap () returned 0xb40000 [0192.561] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.561] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1 [0192.561] GetProcessHeap () returned 0xb40000 [0192.561] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf9348 [0192.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.561] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PRINTI~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a5d223, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~2.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a5d223, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a5d223, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~3.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8a83750, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="ROTATE~4.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a83750, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8a83750, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO751A~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO214E~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8aa99b3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8aa99b3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8aa99b3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO6CC5~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RO17CC~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8acfae1, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SAVEIC~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acfae1, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8acfae1, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8b42434, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPI~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b42434, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8b42434, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dca8be, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STOPIC~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d58217, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~1.EJE")) returned 1 [0192.562] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d58217, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d58217, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SYSREQ~2.EJE")) returned 1 [0192.563] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 1 [0192.563] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d7e408, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8d7e408, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8d7e408, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WARNIC~1.EJE")) returned 0 [0192.563] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.563] GetProcessHeap () returned 0xb40000 [0192.563] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf9348 | out: hHeap=0xb40000) returned 1 [0192.563] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dacfb0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc8dacfb0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8dacfb0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="HEADER~1.EJE")) returned 1 [0192.563] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xca3d85f7, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc9914a4e, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~2.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9914a4e, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xc9914a4e, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca14fedb, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~3.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xcc6da399, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NETFX_~4.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca3fe8ae, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca3fe8ae, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca6ad293, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C7C~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7de3d3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xca7de3d3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xca8047df, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="NE2C70~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1a71f, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa1a71f, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa40aa3, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="PARAME~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa40aa3, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa40aa3, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcaa66d1a, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa66d1a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcaa66d1a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad635ce, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="RGB9RA~2.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad635ce, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad635ce, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcad87e3d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad87e3d, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcad87e3d, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb3ca2ed, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPE~2.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb69ef02, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb69ef02, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb744045, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~1.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb940715, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~2.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb940715, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb940715, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9d9033, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SETUPU~3.EJE")) returned 1 [0192.564] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9d9033, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9d9033, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcb9ff116, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SPLASH~1.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ff116, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcb9ff116, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb3067d, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="SQMAPI~1.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb5679a, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb5679a, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="STRING~1.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbb7cff0, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="UIINFO~1.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7cff0, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xcbb7cff0, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xcbba2da9, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WATERM~1.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xccdbcae4, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~1.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xcce2f139, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~2.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xce142189, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~3.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 1 [0192.565] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd05f6761, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="WINDOW~4.EJE")) returned 0 [0192.565] FindClose (in: hFindFile=0xb53018 | out: hFindFile=0xb53018) returned 1 [0192.566] GetProcessHeap () returned 0xb40000 [0192.566] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0192.566] FindNextFileW (in: hFindFile=0xb52c98, lpFindFileData=0x342f538 | out: lpFindFileData=0x342f538*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76420000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0192.566] GetProcessHeap () returned 0xb40000 [0192.566] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0192.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb529d8 [0192.567] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0192.567] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1 [0192.567] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0192.567] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0192.567] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0192.567] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0192.567] GetProcessHeap () returned 0xb40000 [0192.567] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.568] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.568] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.568] FindNextFileW (in: hFindFile=0xb52cd8, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.568] FindClose (in: hFindFile=0xb52cd8 | out: hFindFile=0xb52cd8) returned 1 [0192.568] GetProcessHeap () returned 0xb40000 [0192.568] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.568] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0192.568] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xce273134, ftCreationTime.dwHighDateTime=0x1d65788, ftLastAccessTime.dwLowDateTime=0xce273134, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xce2994c2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT.id[B4197730-2869].[robinhood@countermail.com].eject", cAlternateFileName="BOOTST~1.EJE")) returned 1 [0192.568] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0192.568] GetProcessHeap () returned 0xb40000 [0192.568] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.569] GetProcessHeap () returned 0xb40000 [0192.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.570] GetProcessHeap () returned 0xb40000 [0192.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.571] GetProcessHeap () returned 0xb40000 [0192.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.571] GetProcessHeap () returned 0xb40000 [0192.571] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.571] GetProcessHeap () returned 0xb40000 [0192.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.571] GetProcessHeap () returned 0xb40000 [0192.571] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.571] GetProcessHeap () returned 0xb40000 [0192.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.571] GetProcessHeap () returned 0xb40000 [0192.571] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.795] GetProcessHeap () returned 0xb40000 [0192.795] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.795] GetProcessHeap () returned 0xb40000 [0192.795] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.795] GetProcessHeap () returned 0xb40000 [0192.795] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.795] GetProcessHeap () returned 0xb40000 [0192.795] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.795] GetProcessHeap () returned 0xb40000 [0192.795] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.795] GetProcessHeap () returned 0xb40000 [0192.795] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.796] GetProcessHeap () returned 0xb40000 [0192.796] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.796] GetProcessHeap () returned 0xb40000 [0192.796] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0192.796] GetProcessHeap () returned 0xb40000 [0192.796] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.796] GetProcessHeap () returned 0xb40000 [0192.796] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.797] GetProcessHeap () returned 0xb40000 [0192.797] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.797] GetProcessHeap () returned 0xb40000 [0192.797] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.797] GetProcessHeap () returned 0xb40000 [0192.797] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.797] GetProcessHeap () returned 0xb40000 [0192.797] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.797] GetProcessHeap () returned 0xb40000 [0192.797] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.797] GetProcessHeap () returned 0xb40000 [0192.797] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.798] GetProcessHeap () returned 0xb40000 [0192.798] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.798] GetProcessHeap () returned 0xb40000 [0192.798] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.803] GetProcessHeap () returned 0xb40000 [0192.803] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.803] GetProcessHeap () returned 0xb40000 [0192.803] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.803] GetProcessHeap () returned 0xb40000 [0192.803] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.803] GetProcessHeap () returned 0xb40000 [0192.803] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.804] GetProcessHeap () returned 0xb40000 [0192.804] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.804] GetProcessHeap () returned 0xb40000 [0192.804] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0192.804] GetProcessHeap () returned 0xb40000 [0192.804] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.804] GetProcessHeap () returned 0xb40000 [0192.804] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.804] GetProcessHeap () returned 0xb40000 [0192.804] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.804] GetProcessHeap () returned 0xb40000 [0192.804] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.805] GetProcessHeap () returned 0xb40000 [0192.805] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.805] GetProcessHeap () returned 0xb40000 [0192.805] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.805] GetProcessHeap () returned 0xb40000 [0192.805] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.805] GetProcessHeap () returned 0xb40000 [0192.805] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.806] GetProcessHeap () returned 0xb40000 [0192.806] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ab2648 [0192.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.807] GetProcessHeap () returned 0xb40000 [0192.807] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ab2648 | out: hHeap=0xb40000) returned 1 [0192.807] GetProcessHeap () returned 0xb40000 [0192.807] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.807] GetProcessHeap () returned 0xb40000 [0192.808] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0192.808] GetProcessHeap () returned 0xb40000 [0192.808] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.808] GetProcessHeap () returned 0xb40000 [0192.808] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.809] GetProcessHeap () returned 0xb40000 [0192.809] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.809] GetProcessHeap () returned 0xb40000 [0192.809] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.809] GetProcessHeap () returned 0xb40000 [0192.809] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.809] GetProcessHeap () returned 0xb40000 [0192.809] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.809] GetProcessHeap () returned 0xb40000 [0192.809] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.809] GetProcessHeap () returned 0xb40000 [0192.809] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.810] GetProcessHeap () returned 0xb40000 [0192.810] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.810] GetProcessHeap () returned 0xb40000 [0192.810] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.810] GetProcessHeap () returned 0xb40000 [0192.810] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.810] GetProcessHeap () returned 0xb40000 [0192.810] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.811] GetProcessHeap () returned 0xb40000 [0192.811] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.811] GetProcessHeap () returned 0xb40000 [0192.811] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.811] GetProcessHeap () returned 0xb40000 [0192.811] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.811] GetProcessHeap () returned 0xb40000 [0192.811] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0192.811] GetProcessHeap () returned 0xb40000 [0192.811] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.811] GetProcessHeap () returned 0xb40000 [0192.811] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.812] GetProcessHeap () returned 0xb40000 [0192.812] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.812] GetProcessHeap () returned 0xb40000 [0192.812] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.812] GetProcessHeap () returned 0xb40000 [0192.812] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.812] GetProcessHeap () returned 0xb40000 [0192.812] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.812] GetProcessHeap () returned 0xb40000 [0192.812] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.812] GetProcessHeap () returned 0xb40000 [0192.812] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0192.813] GetProcessHeap () returned 0xb40000 [0192.813] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ab2648 [0192.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.819] GetProcessHeap () returned 0xb40000 [0192.819] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ab2648 | out: hHeap=0xb40000) returned 1 [0192.819] GetProcessHeap () returned 0xb40000 [0192.819] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ab2648 [0192.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xd0e9af28, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0x5edf6a21, ftLastWriteTime.dwHighDateTime=0x1d65791, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0192.822] GetProcessHeap () returned 0xb40000 [0192.822] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ab2648 | out: hHeap=0xb40000) returned 1 [0192.822] GetProcessHeap () returned 0xb40000 [0192.823] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ab2648 [0192.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.823] GetProcessHeap () returned 0xb40000 [0192.823] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ab2648 | out: hHeap=0xb40000) returned 1 [0192.823] GetProcessHeap () returned 0xb40000 [0192.823] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ab2648 [0192.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec746a1d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec746a1d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xb529d8 [0192.823] GetProcessHeap () returned 0xb40000 [0192.823] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0192.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0192.824] GetProcessHeap () returned 0xb40000 [0192.824] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd9, dwReserved1=0x930, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0192.824] GetProcessHeap () returned 0xb40000 [0192.824] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0192.824] GetProcessHeap () returned 0xb40000 [0192.824] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0192.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd9, dwReserved1=0x930, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0192.825] GetProcessHeap () returned 0xb40000 [0192.825] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac3658 [0192.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0192.826] GetProcessHeap () returned 0xb40000 [0192.826] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac3658 | out: hHeap=0xb40000) returned 1 [0192.826] GetProcessHeap () returned 0xb40000 [0192.826] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac3658 [0192.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0192.826] GetProcessHeap () returned 0xb40000 [0192.827] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.827] GetProcessHeap () returned 0xb40000 [0192.827] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.827] GetProcessHeap () returned 0xb40000 [0192.827] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.828] GetProcessHeap () returned 0xb40000 [0192.828] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.828] GetProcessHeap () returned 0xb40000 [0192.828] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.828] GetProcessHeap () returned 0xb40000 [0192.828] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.828] GetProcessHeap () returned 0xb40000 [0192.828] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.828] GetProcessHeap () returned 0xb40000 [0192.828] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.828] GetProcessHeap () returned 0xb40000 [0192.829] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.829] GetProcessHeap () returned 0xb40000 [0192.829] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.829] GetProcessHeap () returned 0xb40000 [0192.829] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.829] GetProcessHeap () returned 0xb40000 [0192.829] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.829] GetProcessHeap () returned 0xb40000 [0192.829] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0192.830] GetProcessHeap () returned 0xb40000 [0192.830] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.830] GetProcessHeap () returned 0xb40000 [0192.830] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.832] GetProcessHeap () returned 0xb40000 [0192.832] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.832] GetProcessHeap () returned 0xb40000 [0192.832] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0192.832] GetProcessHeap () returned 0xb40000 [0192.832] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.832] GetProcessHeap () returned 0xb40000 [0192.832] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.832] GetProcessHeap () returned 0xb40000 [0192.832] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.832] GetProcessHeap () returned 0xb40000 [0192.832] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.833] GetProcessHeap () returned 0xb40000 [0192.833] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.833] GetProcessHeap () returned 0xb40000 [0192.833] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.833] GetProcessHeap () returned 0xb40000 [0192.833] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.833] GetProcessHeap () returned 0xb40000 [0192.833] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.834] GetProcessHeap () returned 0xb40000 [0192.834] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.834] GetProcessHeap () returned 0xb40000 [0192.834] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.834] GetProcessHeap () returned 0xb40000 [0192.834] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0192.834] GetProcessHeap () returned 0xb40000 [0192.834] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0192.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0192.834] GetProcessHeap () returned 0xb40000 [0192.834] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0192.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.835] GetProcessHeap () returned 0xb40000 [0192.835] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0192.835] GetProcessHeap () returned 0xb40000 [0192.835] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0192.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0192.836] GetProcessHeap () returned 0xb40000 [0192.836] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0192.836] GetProcessHeap () returned 0xb40000 [0192.836] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0192.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0192.836] GetProcessHeap () returned 0xb40000 [0192.836] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0192.836] GetProcessHeap () returned 0xb40000 [0192.836] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0192.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0193.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0193.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0193.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.212] GetProcessHeap () returned 0xb40000 [0193.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0193.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0193.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae6680 [0193.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x72b, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae6680 | out: hHeap=0xb40000) returned 1 [0193.213] GetProcessHeap () returned 0xb40000 [0193.213] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.215] GetProcessHeap () returned 0xb40000 [0193.215] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.215] GetProcessHeap () returned 0xb40000 [0193.215] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.215] GetProcessHeap () returned 0xb40000 [0193.215] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.216] GetProcessHeap () returned 0xb40000 [0193.216] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.217] GetProcessHeap () returned 0xb40000 [0193.217] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.218] GetProcessHeap () returned 0xb40000 [0193.218] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.218] GetProcessHeap () returned 0xb40000 [0193.218] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.218] GetProcessHeap () returned 0xb40000 [0193.218] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.218] GetProcessHeap () returned 0xb40000 [0193.218] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.218] GetProcessHeap () returned 0xb40000 [0193.218] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.218] GetProcessHeap () returned 0xb40000 [0193.218] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.219] GetProcessHeap () returned 0xb40000 [0193.219] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.220] GetProcessHeap () returned 0xb40000 [0193.220] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.221] GetProcessHeap () returned 0xb40000 [0193.221] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.221] GetProcessHeap () returned 0xb40000 [0193.221] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.221] GetProcessHeap () returned 0xb40000 [0193.221] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.221] GetProcessHeap () returned 0xb40000 [0193.221] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0193.221] GetProcessHeap () returned 0xb40000 [0193.221] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.222] GetProcessHeap () returned 0xb40000 [0193.222] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.223] GetProcessHeap () returned 0xb40000 [0193.223] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.223] GetProcessHeap () returned 0xb40000 [0193.223] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad4668 [0193.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd7, dwReserved1=0x92e, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.223] GetProcessHeap () returned 0xb40000 [0193.223] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad4668 | out: hHeap=0xb40000) returned 1 [0193.223] GetProcessHeap () returned 0xb40000 [0193.223] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac3658 | out: hHeap=0xb40000) returned 1 [0193.224] GetProcessHeap () returned 0xb40000 [0193.224] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.224] GetProcessHeap () returned 0xb40000 [0193.224] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.225] GetProcessHeap () returned 0xb40000 [0193.225] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.225] GetProcessHeap () returned 0xb40000 [0193.225] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.226] GetProcessHeap () returned 0xb40000 [0193.226] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.226] GetProcessHeap () returned 0xb40000 [0193.226] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.228] GetProcessHeap () returned 0xb40000 [0193.228] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.228] GetProcessHeap () returned 0xb40000 [0193.228] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.229] GetProcessHeap () returned 0xb40000 [0193.229] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.230] GetProcessHeap () returned 0xb40000 [0193.230] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.230] GetProcessHeap () returned 0xb40000 [0193.230] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.230] GetProcessHeap () returned 0xb40000 [0193.230] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.230] GetProcessHeap () returned 0xb40000 [0193.230] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.232] GetProcessHeap () returned 0xb40000 [0193.232] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.232] GetProcessHeap () returned 0xb40000 [0193.232] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.232] GetProcessHeap () returned 0xb40000 [0193.232] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.232] GetProcessHeap () returned 0xb40000 [0193.232] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.233] GetProcessHeap () returned 0xb40000 [0193.233] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.233] GetProcessHeap () returned 0xb40000 [0193.233] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.234] GetProcessHeap () returned 0xb40000 [0193.234] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.234] GetProcessHeap () returned 0xb40000 [0193.234] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.234] GetProcessHeap () returned 0xb40000 [0193.235] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.235] GetProcessHeap () returned 0xb40000 [0193.235] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.236] GetProcessHeap () returned 0xb40000 [0193.236] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.236] GetProcessHeap () returned 0xb40000 [0193.236] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.236] GetProcessHeap () returned 0xb40000 [0193.236] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.236] GetProcessHeap () returned 0xb40000 [0193.236] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.236] GetProcessHeap () returned 0xb40000 [0193.236] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.237] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.517] GetProcessHeap () returned 0xb40000 [0193.517] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac3658 [0193.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.518] GetProcessHeap () returned 0xb40000 [0193.518] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac3658 | out: hHeap=0xb40000) returned 1 [0193.518] GetProcessHeap () returned 0xb40000 [0193.518] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.519] GetProcessHeap () returned 0xb40000 [0193.519] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.519] GetProcessHeap () returned 0xb40000 [0193.519] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.520] GetProcessHeap () returned 0xb40000 [0193.520] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd9, dwReserved1=0x930, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.520] GetProcessHeap () returned 0xb40000 [0193.520] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.520] GetProcessHeap () returned 0xb40000 [0193.520] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffedd9, dwReserved1=0x930, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.521] GetProcessHeap () returned 0xb40000 [0193.521] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.522] GetProcessHeap () returned 0xb40000 [0193.522] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.523] GetProcessHeap () returned 0xb40000 [0193.523] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.523] GetProcessHeap () returned 0xb40000 [0193.523] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.524] GetProcessHeap () returned 0xb40000 [0193.524] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.524] GetProcessHeap () returned 0xb40000 [0193.524] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.524] GetProcessHeap () returned 0xb40000 [0193.524] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.525] GetProcessHeap () returned 0xb40000 [0193.525] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.526] GetProcessHeap () returned 0xb40000 [0193.526] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.526] GetProcessHeap () returned 0xb40000 [0193.526] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.527] GetProcessHeap () returned 0xb40000 [0193.527] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.528] GetProcessHeap () returned 0xb40000 [0193.528] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.529] GetProcessHeap () returned 0xb40000 [0193.529] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.529] GetProcessHeap () returned 0xb40000 [0193.529] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.530] GetProcessHeap () returned 0xb40000 [0193.530] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.530] GetProcessHeap () returned 0xb40000 [0193.530] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0193.531] GetProcessHeap () returned 0xb40000 [0193.531] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0193.532] GetProcessHeap () returned 0xb40000 [0193.532] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.533] GetProcessHeap () returned 0xb40000 [0193.533] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.533] GetProcessHeap () returned 0xb40000 [0193.533] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.533] GetProcessHeap () returned 0xb40000 [0193.533] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.534] GetProcessHeap () returned 0xb40000 [0193.534] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.535] GetProcessHeap () returned 0xb40000 [0193.535] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.535] GetProcessHeap () returned 0xb40000 [0193.535] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.535] GetProcessHeap () returned 0xb40000 [0193.536] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0193.538] GetProcessHeap () returned 0xb40000 [0193.538] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b296b8 [0193.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0193.539] GetProcessHeap () returned 0xb40000 [0193.539] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0193.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.540] GetProcessHeap () returned 0xb40000 [0193.540] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0193.541] GetProcessHeap () returned 0xb40000 [0193.541] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.541] GetProcessHeap () returned 0xb40000 [0193.541] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.541] GetProcessHeap () returned 0xb40000 [0193.541] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.541] GetProcessHeap () returned 0xb40000 [0193.541] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.542] GetProcessHeap () returned 0xb40000 [0193.542] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.542] GetProcessHeap () returned 0xb40000 [0193.542] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0193.543] GetProcessHeap () returned 0xb40000 [0193.543] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0193.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0193.544] GetProcessHeap () returned 0xb40000 [0193.544] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.544] GetProcessHeap () returned 0xb40000 [0193.544] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.544] GetProcessHeap () returned 0xb40000 [0193.544] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0193.545] GetProcessHeap () returned 0xb40000 [0193.545] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.545] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0193.545] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0193.546] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0193.546] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="cmm", cAlternateFileName="")) returned 1 [0193.546] GetProcessHeap () returned 0xb40000 [0193.546] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.546] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.546] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x721, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0193.546] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x721, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0193.546] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x721, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0193.546] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x721, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0193.547] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x721, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0193.547] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x721, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0193.547] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0193.547] GetProcessHeap () returned 0xb40000 [0193.547] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.547] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0193.547] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0193.547] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="deploy", cAlternateFileName="")) returned 1 [0193.547] GetProcessHeap () returned 0xb40000 [0193.547] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.547] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x721, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcd5, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_sv.properties", cAlternateFileName="ME0541~1.PRO")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_zh_CN.properties", cAlternateFileName="ME40CD~1.PRO")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_zh_HK.properties", cAlternateFileName="MEB8B5~1.PRO")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x721, cFileName="messages_zh_TW.properties", cAlternateFileName="MECC18~1.PRO")) returned 1 [0193.550] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x218e, dwReserved0=0x0, dwReserved1=0x721, cFileName="splash.gif", cAlternateFileName="")) returned 1 [0193.550] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bac, dwReserved0=0x0, dwReserved1=0x721, cFileName="splash@2x.gif", cAlternateFileName="SPLASH~1.GIF")) returned 1 [0193.550] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e7d, dwReserved0=0x0, dwReserved1=0x721, cFileName="splash_11-lic.gif", cAlternateFileName="SPLASH~2.GIF")) returned 1 [0193.550] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0x0, dwReserved1=0x721, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 1 [0193.550] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0x0, dwReserved1=0x721, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 0 [0193.550] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0193.550] GetProcessHeap () returned 0xb40000 [0193.550] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.550] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0193.551] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="ext", cAlternateFileName="")) returned 1 [0193.551] GetProcessHeap () returned 0xb40000 [0193.551] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0193.551] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.551] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2de78, dwReserved0=0x0, dwReserved1=0x721, cFileName="access-bridge-64.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0193.551] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3ae816, dwReserved0=0x0, dwReserved1=0x721, cFileName="cldrdata.jar", cAlternateFileName="")) returned 1 [0193.551] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x205e, dwReserved0=0x0, dwReserved1=0x721, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0193.551] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xade4, dwReserved0=0x0, dwReserved1=0x721, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0193.551] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1166a99, dwReserved0=0x0, dwReserved1=0x721, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8546b2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa8546b2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21a46d, dwReserved0=0x0, dwReserved1=0x721, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0x0, dwReserved1=0x721, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1edd4e, dwReserved0=0x0, dwReserved1=0x721, cFileName="nashorn.jar", cAlternateFileName="")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa4c9, dwReserved0=0x0, dwReserved1=0x721, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44661, dwReserved0=0x0, dwReserved1=0x721, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7fbb, dwReserved0=0x0, dwReserved1=0x721, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d5bf, dwReserved0=0x0, dwReserved1=0x721, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0x0, dwReserved1=0x721, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0193.552] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0x0, dwReserved1=0x721, cFileName="zipfs.jar", cAlternateFileName="")) returned 0 [0193.552] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0193.553] GetProcessHeap () returned 0xb40000 [0193.553] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.553] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeba, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2948, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="fonts", cAlternateFileName="")) returned 1 [0193.554] GetProcessHeap () returned 0xb40000 [0193.554] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0193.554] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaBrightDemiItalic.ttf", cAlternateFileName="LUCIDA~2.TTF")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaBrightItalic.ttf", cAlternateFileName="LUCIDA~3.TTF")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5434c, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaBrightRegular.ttf", cAlternateFileName="LUCIDA~4.TTF")) returned 1 [0193.554] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d9c8, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaSansDemiBold.ttf", cAlternateFileName="LU38C7~1.TTF")) returned 1 [0193.555] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaa77c, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaSansRegular.ttf", cAlternateFileName="LU761B~1.TTF")) returned 1 [0193.555] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39254, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaTypewriterBold.ttf", cAlternateFileName="LUE73B~1.TTF")) returned 1 [0193.555] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 1 [0193.555] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x721, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 0 [0193.555] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0193.555] GetProcessHeap () returned 0xb40000 [0193.555] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.555] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0193.555] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="images", cAlternateFileName="")) returned 1 [0193.555] GetProcessHeap () returned 0xb40000 [0193.555] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.899] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="cursors", cAlternateFileName="")) returned 1 [0193.900] GetProcessHeap () returned 0xb40000 [0193.900] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0193.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.900] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="..", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="invalid32x32.gif", cAlternateFileName="INVALI~1.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_CopyDrop32x32.gif", cAlternateFileName="WIN32_~1.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_CopyNoDrop32x32.gif", cAlternateFileName="WIN32_~2.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_LinkDrop32x32.gif", cAlternateFileName="WIN32_~3.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_LinkNoDrop32x32.gif", cAlternateFileName="WIN32_~4.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_MoveDrop32x32.gif", cAlternateFileName="WI06CF~1.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 0 [0193.901] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0193.901] GetProcessHeap () returned 0xb40000 [0193.901] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0193.901] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="cursors", cAlternateFileName="")) returned 0 [0193.901] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0193.901] GetProcessHeap () returned 0xb40000 [0193.901] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.902] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0193.902] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8e66d0e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe6827, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0193.902] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c6de, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0193.902] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="jfr", cAlternateFileName="")) returned 1 [0193.902] GetProcessHeap () returned 0xb40000 [0193.903] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0193.903] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0x0, dwReserved1=0x721, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x721, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0xb53018, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0x0, dwReserved1=0x721, cFileName="profile.jfc", cAlternateFileName="")) returned 0 [0193.903] FindClose (in: hFindFile=0xb53018 | out: hFindFile=0xb53018) returned 1 [0193.903] GetProcessHeap () returned 0xb40000 [0193.903] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.903] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x848c, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="jfxswt.jar", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa76f896, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eb80, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0193.904] GetProcessHeap () returned 0xb40000 [0193.904] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.904] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x721, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x721, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x721, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x721, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x721, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 0 [0193.905] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0193.905] GetProcessHeap () returned 0xb40000 [0193.905] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8df45fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d588b, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x354add, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="security", cAlternateFileName="")) returned 1 [0193.905] GetProcessHeap () returned 0xb40000 [0193.905] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="..", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0x0, dwReserved1=0x721, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0x0, dwReserved1=0x721, cFileName="blacklisted.certs", cAlternateFileName="BLACKL~1.CER")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c0eb, dwReserved0=0x0, dwReserved1=0x721, cFileName="cacerts", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x721, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eac, dwReserved0=0x0, dwReserved1=0x721, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x721, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x721, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x721, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x721, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x721, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 0 [0193.906] FindClose (in: hFindFile=0xb52f58 | out: hFindFile=0xb52f58) returned 1 [0193.906] GetProcessHeap () returned 0xb40000 [0193.906] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x19c1c, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="tzdb.dat", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0xffffefcc, dwReserved1=0x922, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 0 [0193.907] FindClose (in: hFindFile=0xb52e98 | out: hFindFile=0xb52e98) returned 1 [0193.907] GetProcessHeap () returned 0xb40000 [0193.907] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0193.907] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x210, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2371c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0193.908] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0193.908] GetProcessHeap () returned 0xb40000 [0193.908] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b296b8 | out: hHeap=0xb40000) returned 1 [0193.908] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28834f30, ftCreationTime.dwHighDateTime=0x1d59e64, ftLastAccessTime.dwLowDateTime=0x1001a130, ftLastAccessTime.dwHighDateTime=0x1d5e6e1, ftLastWriteTime.dwLowDateTime=0x1001a130, ftLastWriteTime.dwHighDateTime=0x1d5e6e1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56032a40, ftCreationTime.dwHighDateTime=0x1d59ea8, ftLastAccessTime.dwLowDateTime=0x3baf2870, ftLastAccessTime.dwHighDateTime=0x1d5884a, ftLastWriteTime.dwLowDateTime=0x3baf2870, ftLastWriteTime.dwHighDateTime=0x1d5884a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56032a40, ftCreationTime.dwHighDateTime=0x1d59ea8, ftLastAccessTime.dwLowDateTime=0x3baf2870, ftLastAccessTime.dwHighDateTime=0x1d5884a, ftLastWriteTime.dwLowDateTime=0x3baf2870, ftLastWriteTime.dwHighDateTime=0x1d5884a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 0 [0193.908] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0193.908] GetProcessHeap () returned 0xb40000 [0193.908] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0193.909] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0193.909] GetProcessHeap () returned 0xb40000 [0193.909] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0193.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0193.909] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7252e530, ftCreationTime.dwHighDateTime=0x1d5a0f3, ftLastAccessTime.dwLowDateTime=0x3ef974d0, ftLastAccessTime.dwHighDateTime=0x1d58602, ftLastWriteTime.dwLowDateTime=0x3ef974d0, ftLastWriteTime.dwHighDateTime=0x1d58602, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="afr38.exe", cAlternateFileName="")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSystemMetadata.xml", cAlternateFileName="FILESY~1.XML")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 1 [0193.910] GetProcessHeap () returned 0xb40000 [0193.910] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b276a8 [0193.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0193.910] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x2a9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ea17a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x17103, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x6a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x8df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52e98, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd502d600, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0xda9a8629, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd502d600, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x8df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 0 [0193.911] FindClose (in: hFindFile=0xb52e98 | out: hFindFile=0xb52e98) returned 1 [0193.911] GetProcessHeap () returned 0xb40000 [0193.911] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b276a8 | out: hHeap=0xb40000) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0193.911] GetProcessHeap () returned 0xb40000 [0193.911] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b276a8 [0193.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.911] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml", cAlternateFileName="APA05A~1.XML")) returned 1 [0193.911] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8351d7a8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8351d7a8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml", cAlternateFileName="APAD0B~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc3863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml", cAlternateFileName="APEDE2~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP51DE~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x79381, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~4.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ecd099, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml", cAlternateFileName="APCEE5~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3df10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP557F~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml", cAlternateFileName="APE193~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x112a4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml", cAlternateFileName="APC1E2~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml", cAlternateFileName="APC422~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xba5e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP2169~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP7BBA~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e0e651, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e0e651, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml", cAlternateFileName="APEF10~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml", cAlternateFileName="AP5F49~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml", cAlternateFileName="APB0FE~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x34b4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP8AF5~1.XML")) returned 1 [0193.912] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e3474a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml", cAlternateFileName="APF26A~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf33deae, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml", cAlternateFileName="APC553~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xbf2f172d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xbf2f172d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xbf2f172d, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x53d21, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP9FA1~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a41, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP330B~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83543a09, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x573e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83e3474a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83e3474a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP6206~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8351d7a8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfdea, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml", cAlternateFileName="APD1EA~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP6EFE~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf982bd9c, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf98c485a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml", cAlternateFileName="APB63F~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml", cAlternateFileName="APB913~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x838fd5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x838fd5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP4637~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83ea71ba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x618a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP2FE2~1.XML")) returned 1 [0193.913] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x839bc0c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x839bc0c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP2C4B~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x841a1e52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml", cAlternateFileName="APF00A~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x831d63af, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834ab261, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~2.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP202C~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml", cAlternateFileName="APBC30~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml", cAlternateFileName="APCB35~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml", cAlternateFileName="AP5E1E~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83485006, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83485006, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x834ab261, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x80e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml", cAlternateFileName="APPXMA~3.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834d1316, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834d1316, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml", cAlternateFileName="APE0B7~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x83ea71ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea71ba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84214453, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml", cAlternateFileName="AP8BF9~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x834f7581, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x834f7581, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x212876, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifest.common.xml", cAlternateFileName="AP3FD6~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8394994f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8394994f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84391d75, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2667, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppXManifestLoc.en-us.xml", cAlternateFileName="AP942B~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x175, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthoredExtensions.xml", cAlternateFileName="AUTHOR~1.XML")) returned 1 [0193.914] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8396fbd3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x83e80c2c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x175, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthoredExtensions.xml", cAlternateFileName="AUTHOR~1.XML")) returned 0 [0193.914] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0193.914] GetProcessHeap () returned 0xb40000 [0193.914] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b276a8 | out: hHeap=0xb40000) returned 1 [0193.915] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0193.915] GetProcessHeap () returned 0xb40000 [0193.915] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b276a8 [0193.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0193.915] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.915] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="client", cAlternateFileName="")) returned 1 [0193.915] GetProcessHeap () returned 0xb40000 [0193.915] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0193.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0193.917] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x601, cFileName="..", cAlternateFileName="")) returned 1 [0193.917] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0715cb9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0715cb9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0952017, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0193.917] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0952017, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0952017, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0a832cb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0193.917] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd089348e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd089348e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd09c4608, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0193.917] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd115de42, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd115de42, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd158a009, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1 [0193.917] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0d0baf0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0d0baf0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0eaf4e3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0c4cdf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0c4cdf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0df0820, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0c26cd1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0c26cd1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0e62fac, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd289cda7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd289cda7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2a1a592, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0b8e391, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0b8e391, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0d7e20c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0aa952a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0aa952a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0bda864, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0aa952a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0aa952a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0c99389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0af5a16, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0af5a16, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0c4cdf5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1e086ac, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1e086ac, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2365abe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1137cdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1137cdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1d23858, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1006983, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1006983, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1242d5d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0f9426a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0f9426a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd121c9ea, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0f9426a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0f9426a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd139a18a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0eaf4e3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0eaf4e3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd11d067c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0dca676, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0dca676, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1078ffd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0193.918] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0eaf4e3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0eaf4e3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd10c55e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd0dca676, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd0dca676, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd0f9426a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1b7fe91, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1b7fe91, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1ec71c8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x601, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1b59cda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1b59cda, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1f1370b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x34ad8, dwReserved0=0x0, dwReserved1=0x601, cFileName="AppVDllSurrogate32.exe", cAlternateFileName="APPVDL~2.EXE")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1e2e85a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4d8, dwReserved0=0x0, dwReserved1=0x601, cFileName="AppVDllSurrogate64.exe", cAlternateFileName="APPVDL~1.EXE")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86813dc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86813dc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86813dc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86813dc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86813dc4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86813dc4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x8683a0f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8683a0f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8683a0f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd153dc41, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd153dc41, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1e7acf5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x69630, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="AppVLP.exe", cAlternateFileName="")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x8683a0f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8683a0f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8683a0f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x420, ftCreationTime.dwLowDateTime=0x8683a0f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8683a0f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8683a0f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd11f68b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd11f68b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd191da0e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1242d5d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1242d5d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1bcc41c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5644a0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1f5fb21, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd244aa14, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0193.919] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1ea0ff2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1ea0ff2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd20449b3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0193.920] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1e7acf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1e7acf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1fac086, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0193.920] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd1e2e85a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd1e2e85a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd1f5fb21, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0193.920] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f0533c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0193.920] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2424784, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2424784, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26acf16, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0193.920] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2424784, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2424784, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26acf16, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0193.920] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0193.921] GetProcessHeap () returned 0xb40000 [0193.921] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0193.921] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0193.921] GetProcessHeap () returned 0xb40000 [0193.921] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0193.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0193.921] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="..", cAlternateFileName="")) returned 1 [0193.921] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0193.921] GetProcessHeap () returned 0xb40000 [0193.921] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.921] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0193.921] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45328f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf45328f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf4794eb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0193.921] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0193.921] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb58a9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb58a9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb58a9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xdb709c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xdb709c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xdb96b67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xec210f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xec210f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xec210f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0193.922] FindNextFileW (in: hFindFile=0xb52f58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x400, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0193.925] GetProcessHeap () returned 0xb40000 [0193.925] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.925] GetProcessHeap () returned 0xb40000 [0193.925] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0193.925] GetProcessHeap () returned 0xb40000 [0193.925] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0193.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.928] GetProcessHeap () returned 0xb40000 [0193.928] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0193.928] GetProcessHeap () returned 0xb40000 [0193.928] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.929] GetProcessHeap () returned 0xb40000 [0193.929] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0193.929] GetProcessHeap () returned 0xb40000 [0193.929] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0193.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0193.929] GetProcessHeap () returned 0xb40000 [0193.929] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0193.931] GetProcessHeap () returned 0xb40000 [0193.931] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0193.931] GetProcessHeap () returned 0xb40000 [0193.931] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0193.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.151] GetProcessHeap () returned 0xb40000 [0194.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.151] GetProcessHeap () returned 0xb40000 [0194.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.153] GetProcessHeap () returned 0xb40000 [0194.153] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.153] GetProcessHeap () returned 0xb40000 [0194.153] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.154] GetProcessHeap () returned 0xb40000 [0194.154] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0194.156] GetProcessHeap () returned 0xb40000 [0194.156] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0194.156] GetProcessHeap () returned 0xb40000 [0194.156] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.158] GetProcessHeap () returned 0xb40000 [0194.158] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0194.158] GetProcessHeap () returned 0xb40000 [0194.158] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.160] GetProcessHeap () returned 0xb40000 [0194.160] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0194.160] GetProcessHeap () returned 0xb40000 [0194.160] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0194.174] GetProcessHeap () returned 0xb40000 [0194.174] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0194.174] GetProcessHeap () returned 0xb40000 [0194.174] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0194.174] GetProcessHeap () returned 0xb40000 [0194.174] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0194.175] GetProcessHeap () returned 0xb40000 [0194.175] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0194.175] GetProcessHeap () returned 0xb40000 [0194.175] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.177] GetProcessHeap () returned 0xb40000 [0194.177] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.177] GetProcessHeap () returned 0xb40000 [0194.177] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.178] GetProcessHeap () returned 0xb40000 [0194.178] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.178] GetProcessHeap () returned 0xb40000 [0194.178] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.178] GetProcessHeap () returned 0xb40000 [0194.178] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.178] GetProcessHeap () returned 0xb40000 [0194.178] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.180] GetProcessHeap () returned 0xb40000 [0194.180] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.180] GetProcessHeap () returned 0xb40000 [0194.180] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0194.181] GetProcessHeap () returned 0xb40000 [0194.181] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0194.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0194.182] GetProcessHeap () returned 0xb40000 [0194.182] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8b68835, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc8b68835, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.183] GetProcessHeap () returned 0xb40000 [0194.183] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.183] GetProcessHeap () returned 0xb40000 [0194.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.183] GetProcessHeap () returned 0xb40000 [0194.183] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x99937c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99937c0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.463] GetProcessHeap () returned 0xb40000 [0194.463] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.466] GetProcessHeap () returned 0xb40000 [0194.466] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.468] GetProcessHeap () returned 0xb40000 [0194.468] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.468] GetProcessHeap () returned 0xb40000 [0194.468] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.470] GetProcessHeap () returned 0xb40000 [0194.470] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.470] GetProcessHeap () returned 0xb40000 [0194.470] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.472] GetProcessHeap () returned 0xb40000 [0194.472] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0194.474] GetProcessHeap () returned 0xb40000 [0194.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.475] GetProcessHeap () returned 0xb40000 [0194.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.475] GetProcessHeap () returned 0xb40000 [0194.475] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.476] GetProcessHeap () returned 0xb40000 [0194.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.476] GetProcessHeap () returned 0xb40000 [0194.476] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.476] GetProcessHeap () returned 0xb40000 [0194.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.476] GetProcessHeap () returned 0xb40000 [0194.476] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.476] GetProcessHeap () returned 0xb40000 [0194.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc9872e88, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xc9872e88, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.478] GetProcessHeap () returned 0xb40000 [0194.478] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0194.478] GetProcessHeap () returned 0xb40000 [0194.479] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0194.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0194.479] GetProcessHeap () returned 0xb40000 [0194.479] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0194.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0194.479] GetProcessHeap () returned 0xb40000 [0194.479] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0194.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0194.480] GetProcessHeap () returned 0xb40000 [0194.480] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0194.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.482] GetProcessHeap () returned 0xb40000 [0194.482] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0194.482] GetProcessHeap () returned 0xb40000 [0194.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0194.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.484] GetProcessHeap () returned 0xb40000 [0194.484] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0194.484] GetProcessHeap () returned 0xb40000 [0194.484] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0194.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.486] GetProcessHeap () returned 0xb40000 [0194.486] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0194.486] GetProcessHeap () returned 0xb40000 [0194.486] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0194.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.488] GetProcessHeap () returned 0xb40000 [0194.488] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0194.488] GetProcessHeap () returned 0xb40000 [0194.488] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0194.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.822] GetProcessHeap () returned 0xb40000 [0194.822] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0194.823] GetProcessHeap () returned 0xb40000 [0194.823] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.825] GetProcessHeap () returned 0xb40000 [0194.825] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.825] GetProcessHeap () returned 0xb40000 [0194.825] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.827] GetProcessHeap () returned 0xb40000 [0194.827] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.827] GetProcessHeap () returned 0xb40000 [0194.827] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.829] GetProcessHeap () returned 0xb40000 [0194.829] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.829] GetProcessHeap () returned 0xb40000 [0194.829] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.831] GetProcessHeap () returned 0xb40000 [0194.831] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.831] GetProcessHeap () returned 0xb40000 [0194.831] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.840] GetProcessHeap () returned 0xb40000 [0194.840] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.840] GetProcessHeap () returned 0xb40000 [0194.840] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.842] GetProcessHeap () returned 0xb40000 [0194.842] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.842] GetProcessHeap () returned 0xb40000 [0194.842] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.844] GetProcessHeap () returned 0xb40000 [0194.844] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.844] GetProcessHeap () returned 0xb40000 [0194.844] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.846] GetProcessHeap () returned 0xb40000 [0194.846] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.846] GetProcessHeap () returned 0xb40000 [0194.846] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.848] GetProcessHeap () returned 0xb40000 [0194.848] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.848] GetProcessHeap () returned 0xb40000 [0194.848] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0194.850] GetProcessHeap () returned 0xb40000 [0194.850] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.850] GetProcessHeap () returned 0xb40000 [0194.850] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.852] GetProcessHeap () returned 0xb40000 [0194.852] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.852] GetProcessHeap () returned 0xb40000 [0194.852] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0194.854] GetProcessHeap () returned 0xb40000 [0194.854] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0194.854] GetProcessHeap () returned 0xb40000 [0194.854] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0194.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.416] GetProcessHeap () returned 0xb40000 [0195.416] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.416] GetProcessHeap () returned 0xb40000 [0195.416] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.419] GetProcessHeap () returned 0xb40000 [0195.419] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.419] GetProcessHeap () returned 0xb40000 [0195.419] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.420] GetProcessHeap () returned 0xb40000 [0195.420] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.421] GetProcessHeap () returned 0xb40000 [0195.421] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.422] GetProcessHeap () returned 0xb40000 [0195.422] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.422] GetProcessHeap () returned 0xb40000 [0195.422] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.424] GetProcessHeap () returned 0xb40000 [0195.424] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.424] GetProcessHeap () returned 0xb40000 [0195.424] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.426] GetProcessHeap () returned 0xb40000 [0195.426] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.427] GetProcessHeap () returned 0xb40000 [0195.427] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.428] GetProcessHeap () returned 0xb40000 [0195.428] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.428] GetProcessHeap () returned 0xb40000 [0195.428] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ms\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.430] GetProcessHeap () returned 0xb40000 [0195.431] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.431] GetProcessHeap () returned 0xb40000 [0195.431] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\nl\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.432] GetProcessHeap () returned 0xb40000 [0195.432] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.432] GetProcessHeap () returned 0xb40000 [0195.433] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\no\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.434] GetProcessHeap () returned 0xb40000 [0195.434] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.434] GetProcessHeap () returned 0xb40000 [0195.434] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pl\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.436] GetProcessHeap () returned 0xb40000 [0195.436] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.436] GetProcessHeap () returned 0xb40000 [0195.436] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-BR\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.438] GetProcessHeap () returned 0xb40000 [0195.438] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.438] GetProcessHeap () returned 0xb40000 [0195.438] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-pt\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.440] GetProcessHeap () returned 0xb40000 [0195.440] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.440] GetProcessHeap () returned 0xb40000 [0195.440] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ro\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.442] GetProcessHeap () returned 0xb40000 [0195.442] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.442] GetProcessHeap () returned 0xb40000 [0195.442] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ru\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.443] GetProcessHeap () returned 0xb40000 [0195.443] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.443] GetProcessHeap () returned 0xb40000 [0195.443] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.445] GetProcessHeap () returned 0xb40000 [0195.445] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.445] GetProcessHeap () returned 0xb40000 [0195.445] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sl\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.447] GetProcessHeap () returned 0xb40000 [0195.447] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.447] GetProcessHeap () returned 0xb40000 [0195.447] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Cyrl\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0195.593] GetProcessHeap () returned 0xb40000 [0195.593] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.594] GetProcessHeap () returned 0xb40000 [0195.594] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0195.596] GetProcessHeap () returned 0xb40000 [0195.596] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.596] GetProcessHeap () returned 0xb40000 [0195.596] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn-CS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.598] GetProcessHeap () returned 0xb40000 [0195.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.598] GetProcessHeap () returned 0xb40000 [0195.598] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sv\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.600] GetProcessHeap () returned 0xb40000 [0195.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.600] GetProcessHeap () returned 0xb40000 [0195.600] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\th\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1860d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.601] GetProcessHeap () returned 0xb40000 [0195.601] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.601] GetProcessHeap () returned 0xb40000 [0195.602] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\tr\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.603] GetProcessHeap () returned 0xb40000 [0195.603] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.603] GetProcessHeap () returned 0xb40000 [0195.603] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\uk\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.605] GetProcessHeap () returned 0xb40000 [0195.605] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.605] GetProcessHeap () returned 0xb40000 [0195.605] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\vi\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0195.607] GetProcessHeap () returned 0xb40000 [0195.607] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.607] GetProcessHeap () returned 0xb40000 [0195.607] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0195.609] GetProcessHeap () returned 0xb40000 [0195.609] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.609] GetProcessHeap () returned 0xb40000 [0195.609] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANT\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.610] GetProcessHeap () returned 0xb40000 [0195.610] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.611] GetProcessHeap () returned 0xb40000 [0195.611] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0195.612] GetProcessHeap () returned 0xb40000 [0195.612] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0195.612] GetProcessHeap () returned 0xb40000 [0195.612] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0195.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.613] GetProcessHeap () returned 0xb40000 [0195.613] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0195.613] GetProcessHeap () returned 0xb40000 [0195.613] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0195.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0195.614] GetProcessHeap () returned 0xb40000 [0195.614] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.616] GetProcessHeap () returned 0xb40000 [0195.616] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.616] GetProcessHeap () returned 0xb40000 [0195.616] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.618] GetProcessHeap () returned 0xb40000 [0195.618] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.618] GetProcessHeap () returned 0xb40000 [0195.618] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.620] GetProcessHeap () returned 0xb40000 [0195.620] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.620] GetProcessHeap () returned 0xb40000 [0195.620] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.622] GetProcessHeap () returned 0xb40000 [0195.622] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.622] GetProcessHeap () returned 0xb40000 [0195.622] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.623] GetProcessHeap () returned 0xb40000 [0195.623] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.623] GetProcessHeap () returned 0xb40000 [0195.623] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.625] GetProcessHeap () returned 0xb40000 [0195.625] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.625] GetProcessHeap () returned 0xb40000 [0195.625] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.900] GetProcessHeap () returned 0xb40000 [0195.900] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.900] GetProcessHeap () returned 0xb40000 [0195.901] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.902] GetProcessHeap () returned 0xb40000 [0195.902] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.902] GetProcessHeap () returned 0xb40000 [0195.902] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.904] GetProcessHeap () returned 0xb40000 [0195.904] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.904] GetProcessHeap () returned 0xb40000 [0195.904] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.906] GetProcessHeap () returned 0xb40000 [0195.906] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.906] GetProcessHeap () returned 0xb40000 [0195.906] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.908] GetProcessHeap () returned 0xb40000 [0195.908] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.908] GetProcessHeap () returned 0xb40000 [0195.908] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.910] GetProcessHeap () returned 0xb40000 [0195.910] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.910] GetProcessHeap () returned 0xb40000 [0195.910] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.912] GetProcessHeap () returned 0xb40000 [0195.912] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.912] GetProcessHeap () returned 0xb40000 [0195.912] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.913] GetProcessHeap () returned 0xb40000 [0195.913] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.913] GetProcessHeap () returned 0xb40000 [0195.913] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.915] GetProcessHeap () returned 0xb40000 [0195.915] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.915] GetProcessHeap () returned 0xb40000 [0195.915] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.917] GetProcessHeap () returned 0xb40000 [0195.917] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.917] GetProcessHeap () returned 0xb40000 [0195.917] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.919] GetProcessHeap () returned 0xb40000 [0195.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.919] GetProcessHeap () returned 0xb40000 [0195.919] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.921] GetProcessHeap () returned 0xb40000 [0195.921] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.921] GetProcessHeap () returned 0xb40000 [0195.921] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.922] GetProcessHeap () returned 0xb40000 [0195.922] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.923] GetProcessHeap () returned 0xb40000 [0195.923] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.924] GetProcessHeap () returned 0xb40000 [0195.924] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.924] GetProcessHeap () returned 0xb40000 [0195.924] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0195.926] GetProcessHeap () returned 0xb40000 [0195.926] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.926] GetProcessHeap () returned 0xb40000 [0195.926] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.928] GetProcessHeap () returned 0xb40000 [0195.928] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.928] GetProcessHeap () returned 0xb40000 [0195.928] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0195.930] GetProcessHeap () returned 0xb40000 [0195.930] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.930] GetProcessHeap () returned 0xb40000 [0195.930] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0195.932] GetProcessHeap () returned 0xb40000 [0195.932] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0195.932] GetProcessHeap () returned 0xb40000 [0195.932] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0195.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.182] GetProcessHeap () returned 0xb40000 [0196.182] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.182] GetProcessHeap () returned 0xb40000 [0196.182] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.184] GetProcessHeap () returned 0xb40000 [0196.184] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.184] GetProcessHeap () returned 0xb40000 [0196.184] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.185] GetProcessHeap () returned 0xb40000 [0196.185] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.186] GetProcessHeap () returned 0xb40000 [0196.186] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.187] GetProcessHeap () returned 0xb40000 [0196.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.187] GetProcessHeap () returned 0xb40000 [0196.187] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.189] GetProcessHeap () returned 0xb40000 [0196.189] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.189] GetProcessHeap () returned 0xb40000 [0196.189] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.191] GetProcessHeap () returned 0xb40000 [0196.191] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.191] GetProcessHeap () returned 0xb40000 [0196.191] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.193] GetProcessHeap () returned 0xb40000 [0196.193] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.193] GetProcessHeap () returned 0xb40000 [0196.193] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.194] GetProcessHeap () returned 0xb40000 [0196.195] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.195] GetProcessHeap () returned 0xb40000 [0196.195] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.196] GetProcessHeap () returned 0xb40000 [0196.196] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.196] GetProcessHeap () returned 0xb40000 [0196.196] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.198] GetProcessHeap () returned 0xb40000 [0196.198] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.198] GetProcessHeap () returned 0xb40000 [0196.198] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.200] GetProcessHeap () returned 0xb40000 [0196.200] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.200] GetProcessHeap () returned 0xb40000 [0196.200] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.202] GetProcessHeap () returned 0xb40000 [0196.202] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.202] GetProcessHeap () returned 0xb40000 [0196.202] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.204] GetProcessHeap () returned 0xb40000 [0196.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.204] GetProcessHeap () returned 0xb40000 [0196.204] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.205] GetProcessHeap () returned 0xb40000 [0196.205] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.205] GetProcessHeap () returned 0xb40000 [0196.205] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.207] GetProcessHeap () returned 0xb40000 [0196.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.207] GetProcessHeap () returned 0xb40000 [0196.207] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.209] GetProcessHeap () returned 0xb40000 [0196.209] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.209] GetProcessHeap () returned 0xb40000 [0196.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.211] GetProcessHeap () returned 0xb40000 [0196.211] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.211] GetProcessHeap () returned 0xb40000 [0196.211] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.213] GetProcessHeap () returned 0xb40000 [0196.213] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.213] GetProcessHeap () returned 0xb40000 [0196.213] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.307] GetProcessHeap () returned 0xb40000 [0196.307] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.307] GetProcessHeap () returned 0xb40000 [0196.307] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.309] GetProcessHeap () returned 0xb40000 [0196.309] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.309] GetProcessHeap () returned 0xb40000 [0196.309] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0196.309] GetProcessHeap () returned 0xb40000 [0196.309] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0196.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0196.310] GetProcessHeap () returned 0xb40000 [0196.310] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.313] GetProcessHeap () returned 0xb40000 [0196.313] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.313] GetProcessHeap () returned 0xb40000 [0196.313] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.315] GetProcessHeap () returned 0xb40000 [0196.315] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.315] GetProcessHeap () returned 0xb40000 [0196.315] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.316] GetProcessHeap () returned 0xb40000 [0196.316] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.317] GetProcessHeap () returned 0xb40000 [0196.317] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.318] GetProcessHeap () returned 0xb40000 [0196.318] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.318] GetProcessHeap () returned 0xb40000 [0196.318] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.320] GetProcessHeap () returned 0xb40000 [0196.320] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.320] GetProcessHeap () returned 0xb40000 [0196.320] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.322] GetProcessHeap () returned 0xb40000 [0196.322] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.322] GetProcessHeap () returned 0xb40000 [0196.322] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.324] GetProcessHeap () returned 0xb40000 [0196.324] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.324] GetProcessHeap () returned 0xb40000 [0196.324] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.326] GetProcessHeap () returned 0xb40000 [0196.326] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.326] GetProcessHeap () returned 0xb40000 [0196.326] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.327] GetProcessHeap () returned 0xb40000 [0196.327] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.327] GetProcessHeap () returned 0xb40000 [0196.327] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.329] GetProcessHeap () returned 0xb40000 [0196.329] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.329] GetProcessHeap () returned 0xb40000 [0196.329] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.331] GetProcessHeap () returned 0xb40000 [0196.331] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.331] GetProcessHeap () returned 0xb40000 [0196.331] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.333] GetProcessHeap () returned 0xb40000 [0196.333] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.333] GetProcessHeap () returned 0xb40000 [0196.333] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.335] GetProcessHeap () returned 0xb40000 [0196.335] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.335] GetProcessHeap () returned 0xb40000 [0196.335] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.337] GetProcessHeap () returned 0xb40000 [0196.337] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.337] GetProcessHeap () returned 0xb40000 [0196.337] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.339] GetProcessHeap () returned 0xb40000 [0196.339] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.339] GetProcessHeap () returned 0xb40000 [0196.339] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.651] GetProcessHeap () returned 0xb40000 [0196.651] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.651] GetProcessHeap () returned 0xb40000 [0196.651] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.653] GetProcessHeap () returned 0xb40000 [0196.653] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.653] GetProcessHeap () returned 0xb40000 [0196.653] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.655] GetProcessHeap () returned 0xb40000 [0196.655] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.655] GetProcessHeap () returned 0xb40000 [0196.655] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.657] GetProcessHeap () returned 0xb40000 [0196.657] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.657] GetProcessHeap () returned 0xb40000 [0196.657] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.659] GetProcessHeap () returned 0xb40000 [0196.659] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.659] GetProcessHeap () returned 0xb40000 [0196.659] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.661] GetProcessHeap () returned 0xb40000 [0196.661] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.661] GetProcessHeap () returned 0xb40000 [0196.661] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.663] GetProcessHeap () returned 0xb40000 [0196.663] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.663] GetProcessHeap () returned 0xb40000 [0196.663] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.665] GetProcessHeap () returned 0xb40000 [0196.665] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.665] GetProcessHeap () returned 0xb40000 [0196.665] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.667] GetProcessHeap () returned 0xb40000 [0196.667] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.667] GetProcessHeap () returned 0xb40000 [0196.667] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.669] GetProcessHeap () returned 0xb40000 [0196.669] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.669] GetProcessHeap () returned 0xb40000 [0196.669] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.671] GetProcessHeap () returned 0xb40000 [0196.671] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.672] GetProcessHeap () returned 0xb40000 [0196.672] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.674] GetProcessHeap () returned 0xb40000 [0196.674] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.674] GetProcessHeap () returned 0xb40000 [0196.674] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.675] GetProcessHeap () returned 0xb40000 [0196.676] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.676] GetProcessHeap () returned 0xb40000 [0196.676] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.677] GetProcessHeap () returned 0xb40000 [0196.677] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.678] GetProcessHeap () returned 0xb40000 [0196.678] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.679] GetProcessHeap () returned 0xb40000 [0196.679] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.679] GetProcessHeap () returned 0xb40000 [0196.679] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0196.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.916] GetProcessHeap () returned 0xb40000 [0196.916] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0196.917] GetProcessHeap () returned 0xb40000 [0196.917] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0196.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.919] GetProcessHeap () returned 0xb40000 [0196.919] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0196.919] GetProcessHeap () returned 0xb40000 [0196.919] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0196.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.920] GetProcessHeap () returned 0xb40000 [0196.920] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf145ad52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0196.920] GetProcessHeap () returned 0xb40000 [0196.920] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.921] GetProcessHeap () returned 0xb40000 [0196.921] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.921] GetProcessHeap () returned 0xb40000 [0196.921] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.921] GetProcessHeap () returned 0xb40000 [0196.921] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.921] GetProcessHeap () returned 0xb40000 [0196.921] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.921] GetProcessHeap () returned 0xb40000 [0196.921] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.922] GetProcessHeap () returned 0xb40000 [0196.922] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.922] GetProcessHeap () returned 0xb40000 [0196.922] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.923] GetProcessHeap () returned 0xb40000 [0196.923] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.923] GetProcessHeap () returned 0xb40000 [0196.923] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.923] GetProcessHeap () returned 0xb40000 [0196.923] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.923] GetProcessHeap () returned 0xb40000 [0196.923] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.924] GetProcessHeap () returned 0xb40000 [0196.924] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.924] GetProcessHeap () returned 0xb40000 [0196.924] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.924] GetProcessHeap () returned 0xb40000 [0196.924] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.924] GetProcessHeap () returned 0xb40000 [0196.924] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.925] GetProcessHeap () returned 0xb40000 [0196.925] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.925] GetProcessHeap () returned 0xb40000 [0196.925] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.926] GetProcessHeap () returned 0xb40000 [0196.926] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.926] GetProcessHeap () returned 0xb40000 [0196.926] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.927] GetProcessHeap () returned 0xb40000 [0196.927] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.927] GetProcessHeap () returned 0xb40000 [0196.927] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.927] GetProcessHeap () returned 0xb40000 [0196.927] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.927] GetProcessHeap () returned 0xb40000 [0196.927] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.928] GetProcessHeap () returned 0xb40000 [0196.928] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.928] GetProcessHeap () returned 0xb40000 [0196.928] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.928] GetProcessHeap () returned 0xb40000 [0196.928] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.928] GetProcessHeap () returned 0xb40000 [0196.928] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.929] GetProcessHeap () returned 0xb40000 [0196.929] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.929] GetProcessHeap () returned 0xb40000 [0196.929] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.930] GetProcessHeap () returned 0xb40000 [0196.930] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.930] GetProcessHeap () returned 0xb40000 [0196.930] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.930] GetProcessHeap () returned 0xb40000 [0196.930] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.930] GetProcessHeap () returned 0xb40000 [0196.930] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.931] GetProcessHeap () returned 0xb40000 [0196.931] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.931] GetProcessHeap () returned 0xb40000 [0196.931] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.931] GetProcessHeap () returned 0xb40000 [0196.931] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.931] GetProcessHeap () returned 0xb40000 [0196.931] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.932] GetProcessHeap () returned 0xb40000 [0196.932] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.932] GetProcessHeap () returned 0xb40000 [0196.932] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.932] GetProcessHeap () returned 0xb40000 [0196.932] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.932] GetProcessHeap () returned 0xb40000 [0196.932] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.933] GetProcessHeap () returned 0xb40000 [0196.933] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.933] GetProcessHeap () returned 0xb40000 [0196.933] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.933] GetProcessHeap () returned 0xb40000 [0196.933] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.933] GetProcessHeap () returned 0xb40000 [0196.933] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.934] GetProcessHeap () returned 0xb40000 [0196.934] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.934] GetProcessHeap () returned 0xb40000 [0196.934] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.934] GetProcessHeap () returned 0xb40000 [0196.934] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.934] GetProcessHeap () returned 0xb40000 [0196.934] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.934] GetProcessHeap () returned 0xb40000 [0196.934] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.935] GetProcessHeap () returned 0xb40000 [0196.935] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.935] GetProcessHeap () returned 0xb40000 [0196.935] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.935] GetProcessHeap () returned 0xb40000 [0196.935] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.935] GetProcessHeap () returned 0xb40000 [0196.935] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.935] GetProcessHeap () returned 0xb40000 [0196.935] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.936] GetProcessHeap () returned 0xb40000 [0196.936] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.936] GetProcessHeap () returned 0xb40000 [0196.936] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.936] GetProcessHeap () returned 0xb40000 [0196.936] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.936] GetProcessHeap () returned 0xb40000 [0196.936] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.937] GetProcessHeap () returned 0xb40000 [0196.937] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.937] GetProcessHeap () returned 0xb40000 [0196.937] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.937] GetProcessHeap () returned 0xb40000 [0196.937] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.937] GetProcessHeap () returned 0xb40000 [0196.937] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0196.937] GetProcessHeap () returned 0xb40000 [0196.938] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.938] GetProcessHeap () returned 0xb40000 [0196.938] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.938] GetProcessHeap () returned 0xb40000 [0196.938] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.938] GetProcessHeap () returned 0xb40000 [0196.938] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.938] GetProcessHeap () returned 0xb40000 [0196.938] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.938] GetProcessHeap () returned 0xb40000 [0196.938] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.947] GetProcessHeap () returned 0xb40000 [0196.947] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.947] GetProcessHeap () returned 0xb40000 [0196.947] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.947] GetProcessHeap () returned 0xb40000 [0196.947] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.947] GetProcessHeap () returned 0xb40000 [0196.947] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.948] GetProcessHeap () returned 0xb40000 [0196.948] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.948] GetProcessHeap () returned 0xb40000 [0196.948] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.948] GetProcessHeap () returned 0xb40000 [0196.948] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.948] GetProcessHeap () returned 0xb40000 [0196.948] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52e98 [0196.949] GetProcessHeap () returned 0xb40000 [0196.949] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.949] GetProcessHeap () returned 0xb40000 [0196.949] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.949] GetProcessHeap () returned 0xb40000 [0196.949] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.949] GetProcessHeap () returned 0xb40000 [0196.949] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0196.950] GetProcessHeap () returned 0xb40000 [0196.950] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.950] GetProcessHeap () returned 0xb40000 [0196.950] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.950] GetProcessHeap () returned 0xb40000 [0196.950] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.950] GetProcessHeap () returned 0xb40000 [0196.950] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.950] GetProcessHeap () returned 0xb40000 [0196.950] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.950] GetProcessHeap () returned 0xb40000 [0196.950] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0196.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0196.951] GetProcessHeap () returned 0xb40000 [0196.951] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0196.951] GetProcessHeap () returned 0xb40000 [0196.951] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0196.952] GetProcessHeap () returned 0xb40000 [0196.952] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0196.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0196.954] GetProcessHeap () returned 0xb40000 [0196.954] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0196.955] GetProcessHeap () returned 0xb40000 [0196.955] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0196.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.135] GetProcessHeap () returned 0xb40000 [0197.135] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.135] GetProcessHeap () returned 0xb40000 [0197.135] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.137] GetProcessHeap () returned 0xb40000 [0197.137] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.137] GetProcessHeap () returned 0xb40000 [0197.137] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.139] GetProcessHeap () returned 0xb40000 [0197.139] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.139] GetProcessHeap () returned 0xb40000 [0197.139] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.141] GetProcessHeap () returned 0xb40000 [0197.141] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.141] GetProcessHeap () returned 0xb40000 [0197.141] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.143] GetProcessHeap () returned 0xb40000 [0197.143] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.143] GetProcessHeap () returned 0xb40000 [0197.143] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.147] GetProcessHeap () returned 0xb40000 [0197.147] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.147] GetProcessHeap () returned 0xb40000 [0197.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.149] GetProcessHeap () returned 0xb40000 [0197.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.149] GetProcessHeap () returned 0xb40000 [0197.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.151] GetProcessHeap () returned 0xb40000 [0197.151] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.151] GetProcessHeap () returned 0xb40000 [0197.151] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.153] GetProcessHeap () returned 0xb40000 [0197.153] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.153] GetProcessHeap () returned 0xb40000 [0197.153] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.155] GetProcessHeap () returned 0xb40000 [0197.155] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.155] GetProcessHeap () returned 0xb40000 [0197.155] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.157] GetProcessHeap () returned 0xb40000 [0197.157] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.157] GetProcessHeap () returned 0xb40000 [0197.157] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.159] GetProcessHeap () returned 0xb40000 [0197.159] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.159] GetProcessHeap () returned 0xb40000 [0197.159] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0xb52cd8 [0197.161] GetProcessHeap () returned 0xb40000 [0197.161] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.161] GetProcessHeap () returned 0xb40000 [0197.161] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.162] GetProcessHeap () returned 0xb40000 [0197.162] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.162] GetProcessHeap () returned 0xb40000 [0197.162] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17728794, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17728794, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.163] GetProcessHeap () returned 0xb40000 [0197.163] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x176dc2d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.163] GetProcessHeap () returned 0xb40000 [0197.163] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.163] GetProcessHeap () returned 0xb40000 [0197.163] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.165] GetProcessHeap () returned 0xb40000 [0197.165] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.165] GetProcessHeap () returned 0xb40000 [0197.165] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.166] GetProcessHeap () returned 0xb40000 [0197.166] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.369] GetProcessHeap () returned 0xb40000 [0197.369] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.369] GetProcessHeap () returned 0xb40000 [0197.369] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1774e9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1774e9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.371] GetProcessHeap () returned 0xb40000 [0197.371] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.371] GetProcessHeap () returned 0xb40000 [0197.371] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.372] GetProcessHeap () returned 0xb40000 [0197.372] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cd4a32, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.374] GetProcessHeap () returned 0xb40000 [0197.374] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.374] GetProcessHeap () returned 0xb40000 [0197.374] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.375] GetProcessHeap () returned 0xb40000 [0197.375] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.376] GetProcessHeap () returned 0xb40000 [0197.376] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.377] GetProcessHeap () returned 0xb40000 [0197.377] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.377] GetProcessHeap () returned 0xb40000 [0197.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.377] GetProcessHeap () returned 0xb40000 [0197.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.378] GetProcessHeap () returned 0xb40000 [0197.378] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.378] GetProcessHeap () returned 0xb40000 [0197.378] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca90ec5a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca90ec5a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.378] GetProcessHeap () returned 0xb40000 [0197.378] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.381] GetProcessHeap () returned 0xb40000 [0197.381] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.381] GetProcessHeap () returned 0xb40000 [0197.381] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.382] GetProcessHeap () returned 0xb40000 [0197.382] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.382] GetProcessHeap () returned 0xb40000 [0197.382] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ff3259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x186355ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x186355ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.383] GetProcessHeap () returned 0xb40000 [0197.383] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.384] GetProcessHeap () returned 0xb40000 [0197.384] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18aadbcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18aadbcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18aadbcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.385] GetProcessHeap () returned 0xb40000 [0197.385] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.385] GetProcessHeap () returned 0xb40000 [0197.385] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.386] GetProcessHeap () returned 0xb40000 [0197.386] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.386] GetProcessHeap () returned 0xb40000 [0197.386] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.392] GetProcessHeap () returned 0xb40000 [0197.392] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.392] GetProcessHeap () returned 0xb40000 [0197.392] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.393] GetProcessHeap () returned 0xb40000 [0197.393] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.393] GetProcessHeap () returned 0xb40000 [0197.393] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.395] GetProcessHeap () returned 0xb40000 [0197.395] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.396] GetProcessHeap () returned 0xb40000 [0197.396] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.396] GetProcessHeap () returned 0xb40000 [0197.396] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.397] GetProcessHeap () returned 0xb40000 [0197.397] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.397] GetProcessHeap () returned 0xb40000 [0197.397] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0197.399] GetProcessHeap () returned 0xb40000 [0197.399] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.399] GetProcessHeap () returned 0xb40000 [0197.399] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.401] GetProcessHeap () returned 0xb40000 [0197.401] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.401] GetProcessHeap () returned 0xb40000 [0197.401] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.403] GetProcessHeap () returned 0xb40000 [0197.403] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.403] GetProcessHeap () returned 0xb40000 [0197.403] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.403] GetProcessHeap () returned 0xb40000 [0197.403] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.566] GetProcessHeap () returned 0xb40000 [0197.566] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.566] GetProcessHeap () returned 0xb40000 [0197.566] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.566] GetProcessHeap () returned 0xb40000 [0197.566] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbf8340 [0197.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.567] GetProcessHeap () returned 0xb40000 [0197.567] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0197.569] GetProcessHeap () returned 0xb40000 [0197.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.569] GetProcessHeap () returned 0xb40000 [0197.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b07698 [0197.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.570] GetProcessHeap () returned 0xb40000 [0197.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b07698 | out: hHeap=0xb40000) returned 1 [0197.570] GetProcessHeap () returned 0xb40000 [0197.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbf8340 | out: hHeap=0xb40000) returned 1 [0197.571] GetProcessHeap () returned 0xb40000 [0197.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.571] GetProcessHeap () returned 0xb40000 [0197.571] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.573] GetProcessHeap () returned 0xb40000 [0197.573] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.573] GetProcessHeap () returned 0xb40000 [0197.573] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.574] GetProcessHeap () returned 0xb40000 [0197.574] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.575] GetProcessHeap () returned 0xb40000 [0197.575] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.577] GetProcessHeap () returned 0xb40000 [0197.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.577] GetProcessHeap () returned 0xb40000 [0197.577] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\SOLVER\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.577] GetProcessHeap () returned 0xb40000 [0197.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.578] GetProcessHeap () returned 0xb40000 [0197.578] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.578] GetProcessHeap () returned 0xb40000 [0197.579] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.584] GetProcessHeap () returned 0xb40000 [0197.584] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.584] GetProcessHeap () returned 0xb40000 [0197.584] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b22ac67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b22ac67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.588] GetProcessHeap () returned 0xb40000 [0197.588] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.588] GetProcessHeap () returned 0xb40000 [0197.588] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b3a83c3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b3a83c3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.589] GetProcessHeap () returned 0xb40000 [0197.589] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ar\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.590] GetProcessHeap () returned 0xb40000 [0197.590] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.590] GetProcessHeap () returned 0xb40000 [0197.590] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\bg\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.591] GetProcessHeap () returned 0xb40000 [0197.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.591] GetProcessHeap () returned 0xb40000 [0197.591] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53018 [0197.591] GetProcessHeap () returned 0xb40000 [0197.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.591] GetProcessHeap () returned 0xb40000 [0197.591] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\cs\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.591] GetProcessHeap () returned 0xb40000 [0197.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.591] GetProcessHeap () returned 0xb40000 [0197.591] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\da\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.592] GetProcessHeap () returned 0xb40000 [0197.592] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.592] GetProcessHeap () returned 0xb40000 [0197.592] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\de\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.592] GetProcessHeap () returned 0xb40000 [0197.592] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.592] GetProcessHeap () returned 0xb40000 [0197.592] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\el\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.593] GetProcessHeap () returned 0xb40000 [0197.593] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.593] GetProcessHeap () returned 0xb40000 [0197.593] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\en-us\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.593] GetProcessHeap () returned 0xb40000 [0197.593] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.593] GetProcessHeap () returned 0xb40000 [0197.593] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\es\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.593] GetProcessHeap () returned 0xb40000 [0197.593] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.594] GetProcessHeap () returned 0xb40000 [0197.594] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\et\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.594] GetProcessHeap () returned 0xb40000 [0197.594] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.594] GetProcessHeap () returned 0xb40000 [0197.594] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\eu\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.594] GetProcessHeap () returned 0xb40000 [0197.594] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.594] GetProcessHeap () returned 0xb40000 [0197.594] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fi\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.597] GetProcessHeap () returned 0xb40000 [0197.597] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.597] GetProcessHeap () returned 0xb40000 [0197.597] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fr\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52f58 [0197.597] GetProcessHeap () returned 0xb40000 [0197.597] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.597] GetProcessHeap () returned 0xb40000 [0197.597] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\gl\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.598] GetProcessHeap () returned 0xb40000 [0197.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.598] GetProcessHeap () returned 0xb40000 [0197.598] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0197.598] GetProcessHeap () returned 0xb40000 [0197.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.598] GetProcessHeap () returned 0xb40000 [0197.598] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hi\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.598] GetProcessHeap () returned 0xb40000 [0197.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.599] GetProcessHeap () returned 0xb40000 [0197.599] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hr\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0197.599] GetProcessHeap () returned 0xb40000 [0197.599] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.599] GetProcessHeap () returned 0xb40000 [0197.599] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hu\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.599] GetProcessHeap () returned 0xb40000 [0197.599] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.599] GetProcessHeap () returned 0xb40000 [0197.599] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\id\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.600] GetProcessHeap () returned 0xb40000 [0197.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.600] GetProcessHeap () returned 0xb40000 [0197.600] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\it\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b433, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59b433, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59b433, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.600] GetProcessHeap () returned 0xb40000 [0197.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.600] GetProcessHeap () returned 0xb40000 [0197.600] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ja\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.600] GetProcessHeap () returned 0xb40000 [0197.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.601] GetProcessHeap () returned 0xb40000 [0197.601] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\kk\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.601] GetProcessHeap () returned 0xb40000 [0197.601] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.601] GetProcessHeap () returned 0xb40000 [0197.601] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ko\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.601] GetProcessHeap () returned 0xb40000 [0197.601] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.601] GetProcessHeap () returned 0xb40000 [0197.601] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lt\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.602] GetProcessHeap () returned 0xb40000 [0197.602] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.602] GetProcessHeap () returned 0xb40000 [0197.602] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lv\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.866] GetProcessHeap () returned 0xb40000 [0197.866] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.866] GetProcessHeap () returned 0xb40000 [0197.866] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ms\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.867] GetProcessHeap () returned 0xb40000 [0197.867] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.868] GetProcessHeap () returned 0xb40000 [0197.868] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\nl\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf2dd35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf2dd35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.868] GetProcessHeap () returned 0xb40000 [0197.868] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.868] GetProcessHeap () returned 0xb40000 [0197.868] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\no\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.868] GetProcessHeap () returned 0xb40000 [0197.868] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.869] GetProcessHeap () returned 0xb40000 [0197.869] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pl\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.869] GetProcessHeap () returned 0xb40000 [0197.869] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.869] GetProcessHeap () returned 0xb40000 [0197.869] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.869] GetProcessHeap () returned 0xb40000 [0197.869] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.869] GetProcessHeap () returned 0xb40000 [0197.869] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt-BR\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.870] GetProcessHeap () returned 0xb40000 [0197.870] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.870] GetProcessHeap () returned 0xb40000 [0197.870] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ro\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.870] GetProcessHeap () returned 0xb40000 [0197.870] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.870] GetProcessHeap () returned 0xb40000 [0197.870] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ru\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.871] GetProcessHeap () returned 0xb40000 [0197.871] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.871] GetProcessHeap () returned 0xb40000 [0197.871] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sk\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.871] GetProcessHeap () returned 0xb40000 [0197.871] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.871] GetProcessHeap () returned 0xb40000 [0197.871] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sl\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.871] GetProcessHeap () returned 0xb40000 [0197.872] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.872] GetProcessHeap () returned 0xb40000 [0197.872] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-BA\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.872] GetProcessHeap () returned 0xb40000 [0197.872] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.872] GetProcessHeap () returned 0xb40000 [0197.872] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-CS\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.872] GetProcessHeap () returned 0xb40000 [0197.872] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.872] GetProcessHeap () returned 0xb40000 [0197.872] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Latn-CS\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.873] GetProcessHeap () returned 0xb40000 [0197.873] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.873] GetProcessHeap () returned 0xb40000 [0197.873] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sv\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.873] GetProcessHeap () returned 0xb40000 [0197.873] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.873] GetProcessHeap () returned 0xb40000 [0197.873] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\th\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.874] GetProcessHeap () returned 0xb40000 [0197.874] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.874] GetProcessHeap () returned 0xb40000 [0197.874] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\tr\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.874] GetProcessHeap () returned 0xb40000 [0197.874] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.874] GetProcessHeap () returned 0xb40000 [0197.874] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\uk\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.874] GetProcessHeap () returned 0xb40000 [0197.874] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.875] GetProcessHeap () returned 0xb40000 [0197.875] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\vi\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.875] GetProcessHeap () returned 0xb40000 [0197.875] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.875] GetProcessHeap () returned 0xb40000 [0197.875] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-CN\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.877] GetProcessHeap () returned 0xb40000 [0197.877] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.877] GetProcessHeap () returned 0xb40000 [0197.877] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-TW\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.878] GetProcessHeap () returned 0xb40000 [0197.878] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.878] GetProcessHeap () returned 0xb40000 [0197.878] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.880] GetProcessHeap () returned 0xb40000 [0197.880] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0197.882] GetProcessHeap () returned 0xb40000 [0197.882] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.882] GetProcessHeap () returned 0xb40000 [0197.882] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.884] GetProcessHeap () returned 0xb40000 [0197.884] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.884] GetProcessHeap () returned 0xb40000 [0197.884] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.886] GetProcessHeap () returned 0xb40000 [0197.886] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.886] GetProcessHeap () returned 0xb40000 [0197.886] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0197.887] GetProcessHeap () returned 0xb40000 [0197.887] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.888] GetProcessHeap () returned 0xb40000 [0197.888] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.888] GetProcessHeap () returned 0xb40000 [0197.888] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1036\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.889] GetProcessHeap () returned 0xb40000 [0197.889] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.889] GetProcessHeap () returned 0xb40000 [0197.889] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\3082\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.889] GetProcessHeap () returned 0xb40000 [0197.889] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0197.889] GetProcessHeap () returned 0xb40000 [0197.889] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.890] GetProcessHeap () returned 0xb40000 [0197.890] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.892] GetProcessHeap () returned 0xb40000 [0197.892] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.892] GetProcessHeap () returned 0xb40000 [0197.892] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc3bb225, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x241382dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x241382dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0197.895] GetProcessHeap () returned 0xb40000 [0197.895] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.895] GetProcessHeap () returned 0xb40000 [0197.895] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\QUERIES\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0197.895] GetProcessHeap () returned 0xb40000 [0197.895] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.895] GetProcessHeap () returned 0xb40000 [0197.895] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.895] GetProcessHeap () returned 0xb40000 [0197.895] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.896] GetProcessHeap () returned 0xb40000 [0197.896] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\STARTUP\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.896] GetProcessHeap () returned 0xb40000 [0197.896] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0197.896] GetProcessHeap () returned 0xb40000 [0197.896] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0197.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0xa326fd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xa326fd, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0197.896] GetProcessHeap () returned 0xb40000 [0197.896] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0197.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.217] GetProcessHeap () returned 0xb40000 [0198.217] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0198.217] GetProcessHeap () returned 0xb40000 [0198.217] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.218] GetProcessHeap () returned 0xb40000 [0198.218] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\XLSTART\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.223] GetProcessHeap () returned 0xb40000 [0198.223] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.229] GetProcessHeap () returned 0xb40000 [0198.229] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.230] GetProcessHeap () returned 0xb40000 [0198.230] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0198.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\rsod\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0198.232] GetProcessHeap () returned 0xb40000 [0198.232] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0198.233] GetProcessHeap () returned 0xb40000 [0198.233] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0198.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.233] GetProcessHeap () returned 0xb40000 [0198.233] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0198.235] GetProcessHeap () returned 0xb40000 [0198.235] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.235] GetProcessHeap () returned 0xb40000 [0198.235] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0198.236] GetProcessHeap () returned 0xb40000 [0198.236] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0198.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0198.236] GetProcessHeap () returned 0xb40000 [0198.236] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.237] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb571036, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.237] GetProcessHeap () returned 0xb40000 [0198.237] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb5bd4f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb5bd4f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.238] GetProcessHeap () returned 0xb40000 [0198.238] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb62fbf7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.240] GetProcessHeap () returned 0xb40000 [0198.240] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.240] GetProcessHeap () returned 0xb40000 [0198.240] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.242] GetProcessHeap () returned 0xb40000 [0198.242] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.242] GetProcessHeap () returned 0xb40000 [0198.242] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.243] GetProcessHeap () returned 0xb40000 [0198.243] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\GettingStarted16\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e332373, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e332373, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e332373, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.244] GetProcessHeap () returned 0xb40000 [0198.244] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.244] GetProcessHeap () returned 0xb40000 [0198.244] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.244] GetProcessHeap () returned 0xb40000 [0198.244] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.244] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.245] GetProcessHeap () returned 0xb40000 [0198.245] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Notebook Templates\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.245] GetProcessHeap () returned 0xb40000 [0198.246] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.246] GetProcessHeap () returned 0xb40000 [0198.246] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.246] GetProcessHeap () returned 0xb40000 [0198.246] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.246] GetProcessHeap () returned 0xb40000 [0198.246] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.247] GetProcessHeap () returned 0xb40000 [0198.247] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.248] GetProcessHeap () returned 0xb40000 [0198.248] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.248] GetProcessHeap () returned 0xb40000 [0198.249] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.249] GetProcessHeap () returned 0xb40000 [0198.249] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.249] GetProcessHeap () returned 0xb40000 [0198.249] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0198.250] GetProcessHeap () returned 0xb40000 [0198.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0198.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x601, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0198.250] GetProcessHeap () returned 0xb40000 [0198.250] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.251] GetProcessHeap () returned 0xb40000 [0198.251] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.252] GetProcessHeap () returned 0xb40000 [0198.252] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.454] GetProcessHeap () returned 0xb40000 [0198.454] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\Heartbeat\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.455] GetProcessHeap () returned 0xb40000 [0198.455] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.456] GetProcessHeap () returned 0xb40000 [0198.456] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.457] GetProcessHeap () returned 0xb40000 [0198.457] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\VISIO\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.457] GetProcessHeap () returned 0xb40000 [0198.457] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.458] GetProcessHeap () returned 0xb40000 [0198.458] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.458] GetProcessHeap () returned 0xb40000 [0198.458] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.461] GetProcessHeap () returned 0xb40000 [0198.461] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.461] GetProcessHeap () returned 0xb40000 [0198.461] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.462] GetProcessHeap () returned 0xb40000 [0198.462] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.463] GetProcessHeap () returned 0xb40000 [0198.463] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.465] GetProcessHeap () returned 0xb40000 [0198.465] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.465] GetProcessHeap () returned 0xb40000 [0198.465] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.466] GetProcessHeap () returned 0xb40000 [0198.466] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.467] GetProcessHeap () returned 0xb40000 [0198.467] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.470] GetProcessHeap () returned 0xb40000 [0198.470] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.470] GetProcessHeap () returned 0xb40000 [0198.470] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.471] GetProcessHeap () returned 0xb40000 [0198.471] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.472] GetProcessHeap () returned 0xb40000 [0198.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb975fdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb975fdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb975fdf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.473] GetProcessHeap () returned 0xb40000 [0198.473] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.473] GetProcessHeap () returned 0xb40000 [0198.473] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0198.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.473] GetProcessHeap () returned 0xb40000 [0198.473] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.474] GetProcessHeap () returned 0xb40000 [0198.474] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf47e9c8f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.475] GetProcessHeap () returned 0xb40000 [0198.475] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.475] GetProcessHeap () returned 0xb40000 [0198.475] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.476] GetProcessHeap () returned 0xb40000 [0198.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff2d4, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.478] GetProcessHeap () returned 0xb40000 [0198.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4620012, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.479] GetProcessHeap () returned 0xb40000 [0198.479] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.479] GetProcessHeap () returned 0xb40000 [0198.479] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.480] GetProcessHeap () returned 0xb40000 [0198.480] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EURO\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.480] GetProcessHeap () returned 0xb40000 [0198.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.480] GetProcessHeap () returned 0xb40000 [0198.480] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.481] GetProcessHeap () returned 0xb40000 [0198.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.481] GetProcessHeap () returned 0xb40000 [0198.481] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.482] GetProcessHeap () returned 0xb40000 [0198.482] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.483] GetProcessHeap () returned 0xb40000 [0198.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.484] GetProcessHeap () returned 0xb40000 [0198.484] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.484] GetProcessHeap () returned 0xb40000 [0198.484] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.485] GetProcessHeap () returned 0xb40000 [0198.485] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.485] GetProcessHeap () returned 0xb40000 [0198.485] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.485] GetProcessHeap () returned 0xb40000 [0198.485] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc541ed37, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.666] GetProcessHeap () returned 0xb40000 [0198.666] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.667] GetProcessHeap () returned 0xb40000 [0198.667] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc461cf97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc461cf97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc461cf97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.667] GetProcessHeap () returned 0xb40000 [0198.667] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.667] GetProcessHeap () returned 0xb40000 [0198.667] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.667] GetProcessHeap () returned 0xb40000 [0198.667] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0198.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.669] GetProcessHeap () returned 0xb40000 [0198.669] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0198.669] GetProcessHeap () returned 0xb40000 [0198.669] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ec0050 [0198.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.670] GetProcessHeap () returned 0xb40000 [0198.670] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed1060 [0198.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\*", lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3ef, cFileName=".", cAlternateFileName="")) returned 0x3ee1858 [0198.671] GetProcessHeap () returned 0xb40000 [0198.671] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0xb40000) returned 1 [0198.671] GetProcessHeap () returned 0xb40000 [0198.671] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0xb40000) returned 1 [0198.671] GetProcessHeap () returned 0xb40000 [0198.671] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.672] GetProcessHeap () returned 0xb40000 [0198.672] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.673] GetProcessHeap () returned 0xb40000 [0198.673] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.673] GetProcessHeap () returned 0xb40000 [0198.673] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef915def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef915def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.674] GetProcessHeap () returned 0xb40000 [0198.674] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.674] GetProcessHeap () returned 0xb40000 [0198.674] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.674] GetProcessHeap () returned 0xb40000 [0198.674] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.674] GetProcessHeap () returned 0xb40000 [0198.674] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.675] GetProcessHeap () returned 0xb40000 [0198.675] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.676] GetProcessHeap () returned 0xb40000 [0198.676] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.676] GetProcessHeap () returned 0xb40000 [0198.676] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.677] GetProcessHeap () returned 0xb40000 [0198.677] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf07b04e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf07b04e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.678] GetProcessHeap () returned 0xb40000 [0198.678] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.678] GetProcessHeap () returned 0xb40000 [0198.678] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.678] GetProcessHeap () returned 0xb40000 [0198.678] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.679] GetProcessHeap () returned 0xb40000 [0198.679] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.682] GetProcessHeap () returned 0xb40000 [0198.682] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.682] GetProcessHeap () returned 0xb40000 [0198.682] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.683] GetProcessHeap () returned 0xb40000 [0198.683] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.684] GetProcessHeap () returned 0xb40000 [0198.684] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.684] GetProcessHeap () returned 0xb40000 [0198.684] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.684] GetProcessHeap () returned 0xb40000 [0198.684] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.684] GetProcessHeap () returned 0xb40000 [0198.684] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.685] GetProcessHeap () returned 0xb40000 [0198.686] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.686] GetProcessHeap () returned 0xb40000 [0198.686] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.686] GetProcessHeap () returned 0xb40000 [0198.686] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.687] GetProcessHeap () returned 0xb40000 [0198.687] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.687] GetProcessHeap () returned 0xb40000 [0198.687] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.687] GetProcessHeap () returned 0xb40000 [0198.687] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.687] GetProcessHeap () returned 0xb40000 [0198.687] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.688] GetProcessHeap () returned 0xb40000 [0198.688] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.688] GetProcessHeap () returned 0xb40000 [0198.688] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.688] GetProcessHeap () returned 0xb40000 [0198.688] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.688] GetProcessHeap () returned 0xb40000 [0198.689] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.689] GetProcessHeap () returned 0xb40000 [0198.689] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.689] GetProcessHeap () returned 0xb40000 [0198.689] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.689] GetProcessHeap () returned 0xb40000 [0198.689] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.689] GetProcessHeap () returned 0xb40000 [0198.689] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.690] GetProcessHeap () returned 0xb40000 [0198.690] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.690] GetProcessHeap () returned 0xb40000 [0198.690] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.690] GetProcessHeap () returned 0xb40000 [0198.690] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.690] GetProcessHeap () returned 0xb40000 [0198.690] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.690] GetProcessHeap () returned 0xb40000 [0198.691] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.691] GetProcessHeap () returned 0xb40000 [0198.691] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.691] GetProcessHeap () returned 0xb40000 [0198.691] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.691] GetProcessHeap () returned 0xb40000 [0198.691] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.691] GetProcessHeap () returned 0xb40000 [0198.691] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.691] GetProcessHeap () returned 0xb40000 [0198.691] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.692] GetProcessHeap () returned 0xb40000 [0198.692] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.692] GetProcessHeap () returned 0xb40000 [0198.692] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.692] GetProcessHeap () returned 0xb40000 [0198.692] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.692] GetProcessHeap () returned 0xb40000 [0198.692] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.693] GetProcessHeap () returned 0xb40000 [0198.693] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.693] GetProcessHeap () returned 0xb40000 [0198.693] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.693] GetProcessHeap () returned 0xb40000 [0198.693] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.693] GetProcessHeap () returned 0xb40000 [0198.693] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.693] GetProcessHeap () returned 0xb40000 [0198.693] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.693] GetProcessHeap () returned 0xb40000 [0198.693] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.694] GetProcessHeap () returned 0xb40000 [0198.694] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.694] GetProcessHeap () returned 0xb40000 [0198.694] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.694] GetProcessHeap () returned 0xb40000 [0198.694] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.694] GetProcessHeap () returned 0xb40000 [0198.694] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.695] GetProcessHeap () returned 0xb40000 [0198.695] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.695] GetProcessHeap () returned 0xb40000 [0198.695] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.695] GetProcessHeap () returned 0xb40000 [0198.695] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.695] GetProcessHeap () returned 0xb40000 [0198.695] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.695] GetProcessHeap () returned 0xb40000 [0198.695] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.696] GetProcessHeap () returned 0xb40000 [0198.696] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.696] GetProcessHeap () returned 0xb40000 [0198.696] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.696] GetProcessHeap () returned 0xb40000 [0198.696] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.697] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.697] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27ba1ded, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0198.697] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0198.697] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.697] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.697] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.697] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.697] GetProcessHeap () returned 0xb40000 [0198.697] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.697] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0198.697] GetProcessHeap () returned 0xb40000 [0198.697] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.699] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.699] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0198.699] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0198.699] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.699] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.699] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.699] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.699] GetProcessHeap () returned 0xb40000 [0198.699] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.699] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0198.699] GetProcessHeap () returned 0xb40000 [0198.699] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.700] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.700] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0198.700] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0198.700] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.700] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.700] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.700] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.700] GetProcessHeap () returned 0xb40000 [0198.700] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.700] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0198.700] GetProcessHeap () returned 0xb40000 [0198.700] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.701] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.701] GetProcessHeap () returned 0xb40000 [0198.701] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0198.701] GetProcessHeap () returned 0xb40000 [0198.701] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0198.701] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.702] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.702] GetProcessHeap () returned 0xb40000 [0198.702] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0198.702] GetProcessHeap () returned 0xb40000 [0198.702] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.702] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.702] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.703] GetProcessHeap () returned 0xb40000 [0198.703] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="QUAD", cAlternateFileName="")) returned 1 [0198.703] GetProcessHeap () returned 0xb40000 [0198.703] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.703] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.703] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.703] GetProcessHeap () returned 0xb40000 [0198.703] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.703] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0198.703] GetProcessHeap () returned 0xb40000 [0198.703] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.704] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.704] GetProcessHeap () returned 0xb40000 [0198.704] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.704] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="REFINED", cAlternateFileName="")) returned 1 [0198.704] GetProcessHeap () returned 0xb40000 [0198.704] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.704] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.705] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.705] GetProcessHeap () returned 0xb40000 [0198.705] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0198.705] GetProcessHeap () returned 0xb40000 [0198.705] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0198.705] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.706] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.706] GetProcessHeap () returned 0xb40000 [0198.706] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0198.706] GetProcessHeap () returned 0xb40000 [0198.706] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.706] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.706] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.706] GetProcessHeap () returned 0xb40000 [0198.707] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0198.707] GetProcessHeap () returned 0xb40000 [0198.707] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.707] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.707] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.707] GetProcessHeap () returned 0xb40000 [0198.707] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.707] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="SATIN", cAlternateFileName="")) returned 1 [0198.707] GetProcessHeap () returned 0xb40000 [0198.707] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x289576aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28551719, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.708] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.708] GetProcessHeap () returned 0xb40000 [0198.708] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.708] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="SKY", cAlternateFileName="")) returned 1 [0198.708] GetProcessHeap () returned 0xb40000 [0198.708] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.708] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.709] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.709] GetProcessHeap () returned 0xb40000 [0198.709] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="SLATE", cAlternateFileName="")) returned 1 [0198.709] GetProcessHeap () returned 0xb40000 [0198.709] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0198.709] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.710] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.710] GetProcessHeap () returned 0xb40000 [0198.710] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="SONORA", cAlternateFileName="")) returned 1 [0198.710] GetProcessHeap () returned 0xb40000 [0198.710] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.710] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.710] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.711] GetProcessHeap () returned 0xb40000 [0198.711] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="SPRING", cAlternateFileName="")) returned 1 [0198.711] GetProcessHeap () returned 0xb40000 [0198.711] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.711] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.711] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.711] GetProcessHeap () returned 0xb40000 [0198.711] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.711] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0198.711] GetProcessHeap () returned 0xb40000 [0198.711] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.931] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.931] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x28551719, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.931] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0198.931] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0198.931] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.931] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.931] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.931] GetProcessHeap () returned 0xb40000 [0198.931] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.931] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0198.931] GetProcessHeap () returned 0xb40000 [0198.931] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.932] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.932] GetProcessHeap () returned 0xb40000 [0198.932] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.932] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0198.932] GetProcessHeap () returned 0xb40000 [0198.932] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.932] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0198.933] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.933] GetProcessHeap () returned 0xb40000 [0198.933] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="WATER", cAlternateFileName="")) returned 1 [0198.933] GetProcessHeap () returned 0xb40000 [0198.933] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.933] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0198.934] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.934] GetProcessHeap () returned 0xb40000 [0198.934] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0198.934] GetProcessHeap () returned 0xb40000 [0198.934] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0198.934] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0198.934] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.938] GetProcessHeap () returned 0xb40000 [0198.938] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.938] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0198.939] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.939] GetProcessHeap () returned 0xb40000 [0198.939] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.939] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0198.939] GetProcessHeap () returned 0xb40000 [0198.939] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.941] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="..", cAlternateFileName="")) returned 1 [0198.941] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc85db99, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc85db99, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="ENES", cAlternateFileName="")) returned 1 [0198.941] GetProcessHeap () returned 0xb40000 [0198.941] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc85db99, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc85db99, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.941] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc85db99, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc85db99, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.941] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0198.941] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0198.942] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.942] GetProcessHeap () returned 0xb40000 [0198.942] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.942] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="ENFR", cAlternateFileName="")) returned 1 [0198.942] GetProcessHeap () returned 0xb40000 [0198.942] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.942] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.942] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0198.942] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0198.942] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.942] GetProcessHeap () returned 0xb40000 [0198.942] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.942] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="ESEN", cAlternateFileName="")) returned 1 [0198.942] GetProcessHeap () returned 0xb40000 [0198.942] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c8cf9c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c8cf9c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0198.943] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.943] GetProcessHeap () returned 0xb40000 [0198.943] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="FREN", cAlternateFileName="")) returned 1 [0198.943] GetProcessHeap () returned 0xb40000 [0198.943] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63a12a0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf63a12a0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0198.943] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc91c74d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc91c74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0198.944] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc91c74d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc91c74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc9429c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0198.944] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.944] GetProcessHeap () returned 0xb40000 [0198.944] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.944] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0198.944] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0df27d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x324d8, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0198.944] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c45b55, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c45b55, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c45b55, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ed8, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0198.944] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c45b55, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c45b55, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c45b55, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ed8, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 0 [0198.944] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.944] GetProcessHeap () returned 0xb40000 [0198.944] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.945] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0198.945] GetProcessHeap () returned 0xb40000 [0198.945] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.945] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="..", cAlternateFileName="")) returned 1 [0198.945] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0198.945] GetProcessHeap () returned 0xb40000 [0198.945] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.946] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.946] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecf3682d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0198.946] GetProcessHeap () returned 0xb40000 [0198.946] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecf3682d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.947] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecf3682d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcb4d4679, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x26090, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x208c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBEUIINTL.DLL", cAlternateFileName="VBEUII~1.DLL")) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd790bed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x208c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBEUIINTL.DLL", cAlternateFileName="VBEUII~1.DLL")) returned 0 [0198.947] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0198.947] GetProcessHeap () returned 0xb40000 [0198.947] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb652e29, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x281288, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBEUI.DLL", cAlternateFileName="")) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf24004e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x27cd30bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52aae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBEUIRES.DLL", cAlternateFileName="")) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf24004e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x27cd30bd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52aae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBEUIRES.DLL", cAlternateFileName="")) returned 0 [0198.947] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.947] GetProcessHeap () returned 0xb40000 [0198.947] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.947] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0198.947] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.947] GetProcessHeap () returned 0xb40000 [0198.948] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.948] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0198.948] GetProcessHeap () returned 0xb40000 [0198.948] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.949] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="..", cAlternateFileName="")) returned 1 [0198.949] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="Fonts", cAlternateFileName="")) returned 1 [0198.949] GetProcessHeap () returned 0xb40000 [0198.949] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.950] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.950] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x531047b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x531047b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x531047b, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x531047b, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f6e784, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f6e784, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5f6e784, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f6e784, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5f6e784, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0198.951] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x62b5b1e, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62dbd7b, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0198.951] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.952] GetProcessHeap () returned 0xb40000 [0198.952] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.952] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="Fonts", cAlternateFileName="")) returned 0 [0198.952] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.952] GetProcessHeap () returned 0xb40000 [0198.952] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.953] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0198.953] GetProcessHeap () returned 0xb40000 [0198.953] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.953] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="..", cAlternateFileName="")) returned 1 [0198.953] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="16", cAlternateFileName="")) returned 1 [0198.953] GetProcessHeap () returned 0xb40000 [0198.953] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.954] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.954] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0198.954] GetProcessHeap () returned 0xb40000 [0198.954] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0198.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.955] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.955] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0198.955] GetProcessHeap () returned 0xb40000 [0198.955] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0198.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\*", lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee1d18 [0198.955] FindNextFileW (in: hFindFile=0x3ee1d18, lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.955] FindNextFileW (in: hFindFile=0x3ee1d18, lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29b77, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0198.955] FindNextFileW (in: hFindFile=0x3ee1d18, lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29b77, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0198.955] FindClose (in: hFindFile=0x3ee1d18 | out: hFindFile=0x3ee1d18) returned 1 [0198.956] GetProcessHeap () returned 0xb40000 [0198.956] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0198.956] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0198.956] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x284defd5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bf6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0198.956] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x284defd5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1bf6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0198.956] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.956] GetProcessHeap () returned 0xb40000 [0198.956] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0198.956] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0198.956] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.956] GetProcessHeap () returned 0xb40000 [0198.956] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.957] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x16d5, cFileName="16", cAlternateFileName="")) returned 0 [0198.957] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0198.957] GetProcessHeap () returned 0xb40000 [0198.957] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.957] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0198.957] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0198.957] GetProcessHeap () returned 0xb40000 [0198.957] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0198.959] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC", cAlternateFileName="")) returned 1 [0198.959] GetProcessHeap () returned 0xb40000 [0198.959] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0198.959] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.959] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 1 [0198.959] GetProcessHeap () returned 0xb40000 [0198.959] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\Data Sources\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.960] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.960] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.960] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.960] GetProcessHeap () returned 0xb40000 [0198.960] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.960] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0198.960] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0198.960] GetProcessHeap () returned 0xb40000 [0198.960] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.961] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0198.961] GetProcessHeap () returned 0xb40000 [0198.961] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.961] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.961] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0198.962] GetProcessHeap () returned 0xb40000 [0198.962] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.962] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.962] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0198.963] GetProcessHeap () returned 0xb40000 [0198.963] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0198.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0198.963] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.963] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10260, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0198.963] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10260, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0198.963] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0198.963] GetProcessHeap () returned 0xb40000 [0198.963] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0198.963] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0198.963] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0198.963] GetProcessHeap () returned 0xb40000 [0198.963] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.964] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0198.964] GetProcessHeap () returned 0xb40000 [0198.964] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\ole db\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0198.965] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.965] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb8dd674, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb8dd674, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x284defd5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44230, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0198.965] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e298, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0198.965] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e298, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0198.965] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0198.965] GetProcessHeap () returned 0xb40000 [0198.965] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0198.965] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0198.965] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0198.965] GetProcessHeap () returned 0xb40000 [0198.965] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0198.966] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0198.966] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0198.966] GetProcessHeap () returned 0xb40000 [0198.966] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0198.966] GetProcessHeap () returned 0xb40000 [0198.966] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0198.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0198.966] GetProcessHeap () returned 0xb40000 [0198.966] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0198.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0198.967] GetProcessHeap () returned 0xb40000 [0198.967] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0198.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.166] GetProcessHeap () returned 0xb40000 [0199.166] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.166] GetProcessHeap () returned 0xb40000 [0199.166] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.167] GetProcessHeap () returned 0xb40000 [0199.167] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1028\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12dd5ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.168] GetProcessHeap () returned 0xb40000 [0199.168] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.168] GetProcessHeap () returned 0xb40000 [0199.168] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1031\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.169] GetProcessHeap () returned 0xb40000 [0199.169] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.169] GetProcessHeap () returned 0xb40000 [0199.169] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.169] GetProcessHeap () returned 0xb40000 [0199.169] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.169] GetProcessHeap () returned 0xb40000 [0199.169] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1036\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.170] GetProcessHeap () returned 0xb40000 [0199.170] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.170] GetProcessHeap () returned 0xb40000 [0199.170] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1040\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.170] GetProcessHeap () returned 0xb40000 [0199.170] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.170] GetProcessHeap () returned 0xb40000 [0199.170] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1041\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.170] GetProcessHeap () returned 0xb40000 [0199.170] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.170] GetProcessHeap () returned 0xb40000 [0199.170] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1042\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.171] GetProcessHeap () returned 0xb40000 [0199.171] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.171] GetProcessHeap () returned 0xb40000 [0199.171] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1046\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.171] GetProcessHeap () returned 0xb40000 [0199.171] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.171] GetProcessHeap () returned 0xb40000 [0199.171] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1049\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.172] GetProcessHeap () returned 0xb40000 [0199.172] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.172] GetProcessHeap () returned 0xb40000 [0199.172] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\2052\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.172] GetProcessHeap () returned 0xb40000 [0199.172] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.172] GetProcessHeap () returned 0xb40000 [0199.172] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\3082\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.172] GetProcessHeap () returned 0xb40000 [0199.172] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.172] GetProcessHeap () returned 0xb40000 [0199.172] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.173] GetProcessHeap () returned 0xb40000 [0199.173] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.175] GetProcessHeap () returned 0xb40000 [0199.175] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4512fb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd4512fb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.175] GetProcessHeap () returned 0xb40000 [0199.175] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.176] GetProcessHeap () returned 0xb40000 [0199.176] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc436e5a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc436e5a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc436e5a6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.176] GetProcessHeap () returned 0xb40000 [0199.176] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.176] GetProcessHeap () returned 0xb40000 [0199.176] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.176] GetProcessHeap () returned 0xb40000 [0199.176] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.177] GetProcessHeap () returned 0xb40000 [0199.177] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.177] GetProcessHeap () returned 0xb40000 [0199.177] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.178] GetProcessHeap () returned 0xb40000 [0199.178] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.178] GetProcessHeap () returned 0xb40000 [0199.179] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.179] GetProcessHeap () returned 0xb40000 [0199.179] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.179] GetProcessHeap () returned 0xb40000 [0199.179] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.180] GetProcessHeap () returned 0xb40000 [0199.180] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.181] GetProcessHeap () returned 0xb40000 [0199.181] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.181] GetProcessHeap () returned 0xb40000 [0199.181] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.181] GetProcessHeap () returned 0xb40000 [0199.181] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.183] GetProcessHeap () returned 0xb40000 [0199.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.183] GetProcessHeap () returned 0xb40000 [0199.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.183] GetProcessHeap () returned 0xb40000 [0199.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.184] GetProcessHeap () returned 0xb40000 [0199.184] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.185] GetProcessHeap () returned 0xb40000 [0199.185] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.186] GetProcessHeap () returned 0xb40000 [0199.186] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.187] GetProcessHeap () returned 0xb40000 [0199.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.187] GetProcessHeap () returned 0xb40000 [0199.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.187] GetProcessHeap () returned 0xb40000 [0199.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.188] GetProcessHeap () returned 0xb40000 [0199.188] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.188] GetProcessHeap () returned 0xb40000 [0199.188] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.188] GetProcessHeap () returned 0xb40000 [0199.188] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\ole db\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.189] GetProcessHeap () returned 0xb40000 [0199.189] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.189] GetProcessHeap () returned 0xb40000 [0199.189] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.193] GetProcessHeap () returned 0xb40000 [0199.193] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.193] GetProcessHeap () returned 0xb40000 [0199.193] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.193] GetProcessHeap () returned 0xb40000 [0199.193] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.193] GetProcessHeap () returned 0xb40000 [0199.194] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.194] GetProcessHeap () returned 0xb40000 [0199.194] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.195] GetProcessHeap () returned 0xb40000 [0199.195] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2aebe60a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2aebe60a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.197] GetProcessHeap () returned 0xb40000 [0199.197] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.197] GetProcessHeap () returned 0xb40000 [0199.198] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.198] GetProcessHeap () returned 0xb40000 [0199.198] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0199.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee1ad8 [0199.198] GetProcessHeap () returned 0xb40000 [0199.198] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0199.198] GetProcessHeap () returned 0xb40000 [0199.198] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.198] GetProcessHeap () returned 0xb40000 [0199.198] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.199] GetProcessHeap () returned 0xb40000 [0199.199] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.199] GetProcessHeap () returned 0xb40000 [0199.199] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.200] GetProcessHeap () returned 0xb40000 [0199.200] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.202] GetProcessHeap () returned 0xb40000 [0199.202] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.203] GetProcessHeap () returned 0xb40000 [0199.203] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.203] GetProcessHeap () returned 0xb40000 [0199.203] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.203] GetProcessHeap () returned 0xb40000 [0199.203] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.204] GetProcessHeap () returned 0xb40000 [0199.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.204] GetProcessHeap () returned 0xb40000 [0199.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.205] GetProcessHeap () returned 0xb40000 [0199.205] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.205] GetProcessHeap () returned 0xb40000 [0199.205] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.205] GetProcessHeap () returned 0xb40000 [0199.205] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.206] GetProcessHeap () returned 0xb40000 [0199.206] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.206] GetProcessHeap () returned 0xb40000 [0199.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.207] GetProcessHeap () returned 0xb40000 [0199.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.207] GetProcessHeap () returned 0xb40000 [0199.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.207] GetProcessHeap () returned 0xb40000 [0199.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.208] GetProcessHeap () returned 0xb40000 [0199.208] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.208] GetProcessHeap () returned 0xb40000 [0199.208] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.209] GetProcessHeap () returned 0xb40000 [0199.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.210] GetProcessHeap () returned 0xb40000 [0199.210] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.210] GetProcessHeap () returned 0xb40000 [0199.210] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.338] GetProcessHeap () returned 0xb40000 [0199.338] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.338] GetProcessHeap () returned 0xb40000 [0199.338] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.338] GetProcessHeap () returned 0xb40000 [0199.339] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ad2658 [0199.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x342dbe8 | out: lpFindFileData=0x342dbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee1158 [0199.339] GetProcessHeap () returned 0xb40000 [0199.339] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ad2658 | out: hHeap=0xb40000) returned 1 [0199.339] GetProcessHeap () returned 0xb40000 [0199.339] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.339] GetProcessHeap () returned 0xb40000 [0199.339] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.340] GetProcessHeap () returned 0xb40000 [0199.340] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.340] GetProcessHeap () returned 0xb40000 [0199.340] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.341] GetProcessHeap () returned 0xb40000 [0199.341] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.341] GetProcessHeap () returned 0xb40000 [0199.341] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.342] GetProcessHeap () returned 0xb40000 [0199.342] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd43957d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca99edb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e1424f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.344] GetProcessHeap () returned 0xb40000 [0199.344] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.344] GetProcessHeap () returned 0xb40000 [0199.344] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.345] GetProcessHeap () returned 0xb40000 [0199.345] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\1033\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.346] GetProcessHeap () returned 0xb40000 [0199.346] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.346] GetProcessHeap () returned 0xb40000 [0199.346] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.348] GetProcessHeap () returned 0xb40000 [0199.348] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.348] GetProcessHeap () returned 0xb40000 [0199.348] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.348] GetProcessHeap () returned 0xb40000 [0199.348] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.349] GetProcessHeap () returned 0xb40000 [0199.349] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.349] GetProcessHeap () returned 0xb40000 [0199.349] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.349] GetProcessHeap () returned 0xb40000 [0199.349] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.350] GetProcessHeap () returned 0xb40000 [0199.350] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.351] GetProcessHeap () returned 0xb40000 [0199.351] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.351] GetProcessHeap () returned 0xb40000 [0199.351] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.351] GetProcessHeap () returned 0xb40000 [0199.352] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.352] GetProcessHeap () returned 0xb40000 [0199.352] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.352] GetProcessHeap () returned 0xb40000 [0199.352] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.353] GetProcessHeap () returned 0xb40000 [0199.353] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.353] GetProcessHeap () returned 0xb40000 [0199.353] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.356] GetProcessHeap () returned 0xb40000 [0199.356] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.357] GetProcessHeap () returned 0xb40000 [0199.357] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.357] GetProcessHeap () returned 0xb40000 [0199.357] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.357] GetProcessHeap () returned 0xb40000 [0199.357] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.358] GetProcessHeap () returned 0xb40000 [0199.358] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.358] GetProcessHeap () returned 0xb40000 [0199.358] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.359] GetProcessHeap () returned 0xb40000 [0199.359] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.359] GetProcessHeap () returned 0xb40000 [0199.359] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.361] GetProcessHeap () returned 0xb40000 [0199.361] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.361] GetProcessHeap () returned 0xb40000 [0199.361] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.362] GetProcessHeap () returned 0xb40000 [0199.362] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.363] GetProcessHeap () returned 0xb40000 [0199.363] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.363] GetProcessHeap () returned 0xb40000 [0199.363] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.363] GetProcessHeap () returned 0xb40000 [0199.363] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.364] GetProcessHeap () returned 0xb40000 [0199.364] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.365] GetProcessHeap () returned 0xb40000 [0199.365] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.365] GetProcessHeap () returned 0xb40000 [0199.366] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.366] GetProcessHeap () returned 0xb40000 [0199.366] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.366] GetProcessHeap () returned 0xb40000 [0199.366] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.367] GetProcessHeap () returned 0xb40000 [0199.367] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.368] GetProcessHeap () returned 0xb40000 [0199.368] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.369] GetProcessHeap () returned 0xb40000 [0199.369] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.370] GetProcessHeap () returned 0xb40000 [0199.370] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.370] GetProcessHeap () returned 0xb40000 [0199.370] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.370] GetProcessHeap () returned 0xb40000 [0199.370] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.370] GetProcessHeap () returned 0xb40000 [0199.370] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.371] GetProcessHeap () returned 0xb40000 [0199.371] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.371] GetProcessHeap () returned 0xb40000 [0199.371] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.371] GetProcessHeap () returned 0xb40000 [0199.371] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.371] GetProcessHeap () returned 0xb40000 [0199.371] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.374] GetProcessHeap () returned 0xb40000 [0199.374] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.374] GetProcessHeap () returned 0xb40000 [0199.374] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.374] GetProcessHeap () returned 0xb40000 [0199.374] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.374] GetProcessHeap () returned 0xb40000 [0199.374] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.375] GetProcessHeap () returned 0xb40000 [0199.375] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.375] GetProcessHeap () returned 0xb40000 [0199.375] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.375] GetProcessHeap () returned 0xb40000 [0199.375] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.375] GetProcessHeap () returned 0xb40000 [0199.375] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.376] GetProcessHeap () returned 0xb40000 [0199.376] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.376] GetProcessHeap () returned 0xb40000 [0199.376] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.376] GetProcessHeap () returned 0xb40000 [0199.376] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.376] GetProcessHeap () returned 0xb40000 [0199.376] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ac2650 [0199.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x342de70 | out: lpFindFileData=0x342de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.377] GetProcessHeap () returned 0xb40000 [0199.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ac2650 | out: hHeap=0xb40000) returned 1 [0199.377] GetProcessHeap () returned 0xb40000 [0199.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.377] GetProcessHeap () returned 0xb40000 [0199.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.378] GetProcessHeap () returned 0xb40000 [0199.378] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.378] GetProcessHeap () returned 0xb40000 [0199.378] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.378] GetProcessHeap () returned 0xb40000 [0199.378] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.379] GetProcessHeap () returned 0xb40000 [0199.379] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.379] GetProcessHeap () returned 0xb40000 [0199.379] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc434832e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.379] GetProcessHeap () returned 0xb40000 [0199.380] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.380] GetProcessHeap () returned 0xb40000 [0199.380] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.380] GetProcessHeap () returned 0xb40000 [0199.380] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.380] GetProcessHeap () returned 0xb40000 [0199.380] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.380] GetProcessHeap () returned 0xb40000 [0199.380] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.380] GetProcessHeap () returned 0xb40000 [0199.380] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.381] GetProcessHeap () returned 0xb40000 [0199.381] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.381] GetProcessHeap () returned 0xb40000 [0199.381] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.381] GetProcessHeap () returned 0xb40000 [0199.381] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.381] GetProcessHeap () returned 0xb40000 [0199.381] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.382] GetProcessHeap () returned 0xb40000 [0199.382] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.382] GetProcessHeap () returned 0xb40000 [0199.383] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.383] GetProcessHeap () returned 0xb40000 [0199.383] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.528] GetProcessHeap () returned 0xb40000 [0199.542] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.543] GetProcessHeap () returned 0xb40000 [0199.543] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x342e0f8 | out: lpFindFileData=0x342e0f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.557] GetProcessHeap () returned 0xb40000 [0199.557] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.557] GetProcessHeap () returned 0xb40000 [0199.557] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.558] GetProcessHeap () returned 0xb40000 [0199.558] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.558] GetProcessHeap () returned 0xb40000 [0199.558] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.558] GetProcessHeap () returned 0xb40000 [0199.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.559] GetProcessHeap () returned 0xb40000 [0199.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.559] GetProcessHeap () returned 0xb40000 [0199.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.559] GetProcessHeap () returned 0xb40000 [0199.559] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b276a8 | out: hHeap=0xb40000) returned 1 [0199.560] GetProcessHeap () returned 0xb40000 [0199.560] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.561] GetProcessHeap () returned 0xb40000 [0199.561] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe6a2f1b6, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a2f1b6, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.561] GetProcessHeap () returned 0xb40000 [0199.561] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.562] GetProcessHeap () returned 0xb40000 [0199.562] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.562] GetProcessHeap () returned 0xb40000 [0199.562] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.563] GetProcessHeap () returned 0xb40000 [0199.563] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe6a553d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a553d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.564] GetProcessHeap () returned 0xb40000 [0199.564] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb0da723, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xece35df2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xece35df2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.564] GetProcessHeap () returned 0xb40000 [0199.564] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb40aac, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb40aac, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.565] GetProcessHeap () returned 0xb40000 [0199.565] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.565] GetProcessHeap () returned 0xb40000 [0199.565] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\features\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.567] GetProcessHeap () returned 0xb40000 [0199.567] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.567] GetProcessHeap () returned 0xb40000 [0199.567] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.567] GetProcessHeap () returned 0xb40000 [0199.567] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.567] GetProcessHeap () returned 0xb40000 [0199.568] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.568] GetProcessHeap () returned 0xb40000 [0199.568] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec080216, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.568] GetProcessHeap () returned 0xb40000 [0199.568] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0199.568] GetProcessHeap () returned 0xb40000 [0199.568] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.568] GetProcessHeap () returned 0xb40000 [0199.568] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.568] GetProcessHeap () returned 0xb40000 [0199.568] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0199.569] GetProcessHeap () returned 0xb40000 [0199.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.569] GetProcessHeap () returned 0xb40000 [0199.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\fonts\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0f2926, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecbad561, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecbad561, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.569] GetProcessHeap () returned 0xb40000 [0199.569] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.569] GetProcessHeap () returned 0xb40000 [0199.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecaee98b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecaee98b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.569] GetProcessHeap () returned 0xb40000 [0199.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.570] GetProcessHeap () returned 0xb40000 [0199.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.570] GetProcessHeap () returned 0xb40000 [0199.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.570] GetProcessHeap () returned 0xb40000 [0199.570] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9d2ec34, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef639ad2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef639ad2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.570] GetProcessHeap () returned 0xb40000 [0199.570] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.570] GetProcessHeap () returned 0xb40000 [0199.571] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.572] GetProcessHeap () returned 0xb40000 [0199.572] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe6a7b68f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6a7b68f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.573] GetProcessHeap () returned 0xb40000 [0199.573] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.574] GetProcessHeap () returned 0xb40000 [0199.574] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.574] GetProcessHeap () returned 0xb40000 [0199.574] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0199.576] GetProcessHeap () returned 0xb40000 [0199.576] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.576] GetProcessHeap () returned 0xb40000 [0199.576] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.577] GetProcessHeap () returned 0xb40000 [0199.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.577] GetProcessHeap () returned 0xb40000 [0199.577] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.577] GetProcessHeap () returned 0xb40000 [0199.578] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.578] GetProcessHeap () returned 0xb40000 [0199.578] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.578] GetProcessHeap () returned 0xb40000 [0199.578] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe6bd2adf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6bd2adf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.579] GetProcessHeap () returned 0xb40000 [0199.579] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.579] GetProcessHeap () returned 0xb40000 [0199.579] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.580] GetProcessHeap () returned 0xb40000 [0199.580] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.581] GetProcessHeap () returned 0xb40000 [0199.581] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.582] GetProcessHeap () returned 0xb40000 [0199.582] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.582] GetProcessHeap () returned 0xb40000 [0199.582] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.582] GetProcessHeap () returned 0xb40000 [0199.582] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.583] GetProcessHeap () returned 0xb40000 [0199.583] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.583] GetProcessHeap () returned 0xb40000 [0199.584] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0199.584] GetProcessHeap () returned 0xb40000 [0199.584] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0199.584] GetProcessHeap () returned 0xb40000 [0199.584] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0199.585] GetProcessHeap () returned 0xb40000 [0199.585] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.585] GetProcessHeap () returned 0xb40000 [0199.585] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.585] GetProcessHeap () returned 0xb40000 [0199.585] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa73e1bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8390c831, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.587] GetProcessHeap () returned 0xb40000 [0199.587] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\Logs\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.959] GetProcessHeap () returned 0xb40000 [0199.959] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0199.959] GetProcessHeap () returned 0xb40000 [0199.959] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.960] GetProcessHeap () returned 0xb40000 [0199.960] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.964] GetProcessHeap () returned 0xb40000 [0199.964] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0199.964] GetProcessHeap () returned 0xb40000 [0199.964] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0199.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xe69bc7dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69bc7dd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0199.965] GetProcessHeap () returned 0xb40000 [0199.965] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0199.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0199.965] GetProcessHeap () returned 0xb40000 [0199.965] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0199.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0199.966] GetProcessHeap () returned 0xb40000 [0199.966] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0199.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0199.967] GetProcessHeap () returned 0xb40000 [0199.967] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0199.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0199.968] GetProcessHeap () returned 0xb40000 [0199.968] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.970] GetProcessHeap () returned 0xb40000 [0199.970] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.970] GetProcessHeap () returned 0xb40000 [0199.970] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.972] GetProcessHeap () returned 0xb40000 [0199.972] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.972] GetProcessHeap () returned 0xb40000 [0199.972] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.974] GetProcessHeap () returned 0xb40000 [0199.974] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.974] GetProcessHeap () returned 0xb40000 [0199.974] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.976] GetProcessHeap () returned 0xb40000 [0199.976] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.976] GetProcessHeap () returned 0xb40000 [0199.976] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0199.978] GetProcessHeap () returned 0xb40000 [0199.978] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.978] GetProcessHeap () returned 0xb40000 [0199.978] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.979] GetProcessHeap () returned 0xb40000 [0199.980] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.980] GetProcessHeap () returned 0xb40000 [0199.980] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.981] GetProcessHeap () returned 0xb40000 [0199.981] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.981] GetProcessHeap () returned 0xb40000 [0199.981] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.983] GetProcessHeap () returned 0xb40000 [0199.983] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.983] GetProcessHeap () returned 0xb40000 [0199.983] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.985] GetProcessHeap () returned 0xb40000 [0199.985] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.985] GetProcessHeap () returned 0xb40000 [0199.985] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0199.987] GetProcessHeap () returned 0xb40000 [0199.987] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.987] GetProcessHeap () returned 0xb40000 [0199.987] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.989] GetProcessHeap () returned 0xb40000 [0199.989] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.989] GetProcessHeap () returned 0xb40000 [0199.989] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0199.990] GetProcessHeap () returned 0xb40000 [0199.990] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0199.991] GetProcessHeap () returned 0xb40000 [0199.991] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0199.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.179] GetProcessHeap () returned 0xb40000 [0200.179] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.179] GetProcessHeap () returned 0xb40000 [0200.179] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.181] GetProcessHeap () returned 0xb40000 [0200.181] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.181] GetProcessHeap () returned 0xb40000 [0200.181] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.182] GetProcessHeap () returned 0xb40000 [0200.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.183] GetProcessHeap () returned 0xb40000 [0200.183] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.184] GetProcessHeap () returned 0xb40000 [0200.184] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.184] GetProcessHeap () returned 0xb40000 [0200.184] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.186] GetProcessHeap () returned 0xb40000 [0200.186] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.186] GetProcessHeap () returned 0xb40000 [0200.186] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.188] GetProcessHeap () returned 0xb40000 [0200.188] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.188] GetProcessHeap () returned 0xb40000 [0200.188] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.190] GetProcessHeap () returned 0xb40000 [0200.190] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.190] GetProcessHeap () returned 0xb40000 [0200.190] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.192] GetProcessHeap () returned 0xb40000 [0200.192] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.192] GetProcessHeap () returned 0xb40000 [0200.192] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.193] GetProcessHeap () returned 0xb40000 [0200.194] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.194] GetProcessHeap () returned 0xb40000 [0200.194] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.195] GetProcessHeap () returned 0xb40000 [0200.195] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.195] GetProcessHeap () returned 0xb40000 [0200.195] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.197] GetProcessHeap () returned 0xb40000 [0200.197] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.197] GetProcessHeap () returned 0xb40000 [0200.197] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.201] GetProcessHeap () returned 0xb40000 [0200.201] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.201] GetProcessHeap () returned 0xb40000 [0200.201] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.203] GetProcessHeap () returned 0xb40000 [0200.203] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.203] GetProcessHeap () returned 0xb40000 [0200.203] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.204] GetProcessHeap () returned 0xb40000 [0200.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.204] GetProcessHeap () returned 0xb40000 [0200.205] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.206] GetProcessHeap () returned 0xb40000 [0200.206] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.206] GetProcessHeap () returned 0xb40000 [0200.206] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.208] GetProcessHeap () returned 0xb40000 [0200.208] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.208] GetProcessHeap () returned 0xb40000 [0200.208] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.210] GetProcessHeap () returned 0xb40000 [0200.210] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.210] GetProcessHeap () returned 0xb40000 [0200.210] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.369] GetProcessHeap () returned 0xb40000 [0200.369] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.369] GetProcessHeap () returned 0xb40000 [0200.369] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.371] GetProcessHeap () returned 0xb40000 [0200.371] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.371] GetProcessHeap () returned 0xb40000 [0200.371] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.373] GetProcessHeap () returned 0xb40000 [0200.373] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.373] GetProcessHeap () returned 0xb40000 [0200.373] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.375] GetProcessHeap () returned 0xb40000 [0200.375] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.375] GetProcessHeap () returned 0xb40000 [0200.375] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.377] GetProcessHeap () returned 0xb40000 [0200.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.377] GetProcessHeap () returned 0xb40000 [0200.377] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.378] GetProcessHeap () returned 0xb40000 [0200.378] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.378] GetProcessHeap () returned 0xb40000 [0200.379] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.380] GetProcessHeap () returned 0xb40000 [0200.380] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.380] GetProcessHeap () returned 0xb40000 [0200.380] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.382] GetProcessHeap () returned 0xb40000 [0200.382] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.382] GetProcessHeap () returned 0xb40000 [0200.382] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.384] GetProcessHeap () returned 0xb40000 [0200.384] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.384] GetProcessHeap () returned 0xb40000 [0200.384] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.386] GetProcessHeap () returned 0xb40000 [0200.386] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.386] GetProcessHeap () returned 0xb40000 [0200.386] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.388] GetProcessHeap () returned 0xb40000 [0200.388] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.388] GetProcessHeap () returned 0xb40000 [0200.388] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0200.390] GetProcessHeap () returned 0xb40000 [0200.390] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.390] GetProcessHeap () returned 0xb40000 [0200.390] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.392] GetProcessHeap () returned 0xb40000 [0200.392] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.392] GetProcessHeap () returned 0xb40000 [0200.392] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.395] GetProcessHeap () returned 0xb40000 [0200.396] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.396] GetProcessHeap () returned 0xb40000 [0200.396] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.397] GetProcessHeap () returned 0xb40000 [0200.397] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.397] GetProcessHeap () returned 0xb40000 [0200.397] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.399] GetProcessHeap () returned 0xb40000 [0200.399] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.399] GetProcessHeap () returned 0xb40000 [0200.399] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.401] GetProcessHeap () returned 0xb40000 [0200.401] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.401] GetProcessHeap () returned 0xb40000 [0200.401] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.403] GetProcessHeap () returned 0xb40000 [0200.403] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.403] GetProcessHeap () returned 0xb40000 [0200.403] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.817] GetProcessHeap () returned 0xb40000 [0200.817] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.817] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0200.818] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms-MY", cAlternateFileName="")) returned 1 [0200.818] GetProcessHeap () returned 0xb40000 [0200.818] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.823] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.823] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.823] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.823] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.823] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.823] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.823] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.825] GetProcessHeap () returned 0xb40000 [0200.825] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.825] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0200.826] GetProcessHeap () returned 0xb40000 [0200.826] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.839] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.839] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.843] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.843] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.843] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.854] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.854] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.855] GetProcessHeap () returned 0xb40000 [0200.855] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.855] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0200.856] GetProcessHeap () returned 0xb40000 [0200.856] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.857] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.857] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.857] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.858] GetProcessHeap () returned 0xb40000 [0200.858] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.858] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0200.858] GetProcessHeap () returned 0xb40000 [0200.858] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.859] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.859] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.859] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.860] GetProcessHeap () returned 0xb40000 [0200.860] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.860] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0200.860] GetProcessHeap () returned 0xb40000 [0200.860] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.861] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.861] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.861] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.862] GetProcessHeap () returned 0xb40000 [0200.862] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.862] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0200.862] GetProcessHeap () returned 0xb40000 [0200.862] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.863] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.863] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.863] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.864] GetProcessHeap () returned 0xb40000 [0200.864] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.864] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0200.864] GetProcessHeap () returned 0xb40000 [0200.864] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.865] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.865] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.865] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.866] GetProcessHeap () returned 0xb40000 [0200.866] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.866] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0200.866] GetProcessHeap () returned 0xb40000 [0200.866] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.867] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.867] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.867] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.868] GetProcessHeap () returned 0xb40000 [0200.868] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.868] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0200.868] GetProcessHeap () returned 0xb40000 [0200.868] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.869] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.869] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170517_Lock_200.gif", cAlternateFileName="201705~1.GIF")) returned 1 [0200.869] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x4b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Back_0000_Hover.png", cAlternateFileName="BACK_0~1.PNG")) returned 1 [0200.869] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="Back_0001_Static.png", cAlternateFileName="BACK_0~2.PNG")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1ab83100, ftLastWriteTime.dwHighDateTime=0x1d2cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x152b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="jquery-3.1.1.min.js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lock-Confirmation-page-350.png", cAlternateFileName="LOCK-C~1.PNG")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1c907700, ftLastWriteTime.dwHighDateTime=0x1d2a6ca, nFileSizeHigh=0x0, nFileSizeLow=0x237b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Picture2_80.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x28828, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacyContentWrapper.min.js", cAlternateFileName="PRIVAC~1.JS")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5e7dfd00, ftLastWriteTime.dwHighDateTime=0x1d2f192, nFileSizeHigh=0x0, nFileSizeLow=0x3e1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="script.min.js", cAlternateFileName="SCRIPT~1.JS")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="style.min.css", cAlternateFileName="STYLEM~1.CSS")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="style_ltr.min.css", cAlternateFileName="STYLE_~1.CSS")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="style_rtl.min.css", cAlternateFileName="STYLE_~2.CSS")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x585d4e00, ftLastWriteTime.dwHighDateTime=0x1d29e39, nFileSizeHigh=0x0, nFileSizeLow=0x3f73, dwReserved0=0x0, dwReserved1=0x0, cFileName="Win10_Brand.png", cAlternateFileName="WIN10_~1.PNG")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 1 [0200.870] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 0 [0200.870] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0200.871] GetProcessHeap () returned 0xb40000 [0200.871] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.871] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0200.871] GetProcessHeap () returned 0xb40000 [0200.871] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.872] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.872] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.872] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.873] GetProcessHeap () returned 0xb40000 [0200.873] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.873] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0200.873] GetProcessHeap () returned 0xb40000 [0200.873] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0200.874] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.874] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.874] FindClose (in: hFindFile=0xb53058 | out: hFindFile=0xb53058) returned 1 [0200.875] GetProcessHeap () returned 0xb40000 [0200.875] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.875] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0200.875] GetProcessHeap () returned 0xb40000 [0200.875] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.876] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.876] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.876] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.876] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.876] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.876] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.876] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.877] GetProcessHeap () returned 0xb40000 [0200.877] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.877] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0200.877] GetProcessHeap () returned 0xb40000 [0200.877] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.878] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9931, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x66d5ac00, ftLastWriteTime.dwHighDateTime=0x1d2a223, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.878] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.879] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.879] GetProcessHeap () returned 0xb40000 [0200.879] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.879] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0200.879] GetProcessHeap () returned 0xb40000 [0200.879] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.880] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.880] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.880] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.880] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.880] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.881] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.881] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.881] GetProcessHeap () returned 0xb40000 [0200.881] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.881] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0200.881] GetProcessHeap () returned 0xb40000 [0200.881] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0200.882] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.882] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9702, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0200.882] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0200.882] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0200.882] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0200.883] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0200.883] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0200.883] GetProcessHeap () returned 0xb40000 [0200.883] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0200.883] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0200.883] GetProcessHeap () returned 0xb40000 [0200.883] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0200.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.163] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.179] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x1007a, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.180] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.180] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.180] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.180] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.180] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.181] GetProcessHeap () returned 0xb40000 [0201.181] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.181] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0201.181] GetProcessHeap () returned 0xb40000 [0201.181] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0201.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.182] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.182] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.182] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.182] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.182] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.182] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.182] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.183] GetProcessHeap () returned 0xb40000 [0201.183] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.183] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0201.183] GetProcessHeap () returned 0xb40000 [0201.183] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0201.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.184] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.184] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.184] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x19338e00, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.184] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.184] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.184] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.184] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.185] GetProcessHeap () returned 0xb40000 [0201.185] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.185] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0201.185] GetProcessHeap () returned 0xb40000 [0201.185] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0201.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.186] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.186] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.186] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.186] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.186] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.186] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.186] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.187] GetProcessHeap () returned 0xb40000 [0201.187] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.187] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0201.187] GetProcessHeap () returned 0xb40000 [0201.187] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0201.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.188] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.188] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8e1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.188] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.188] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.188] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.188] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.188] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.189] GetProcessHeap () returned 0xb40000 [0201.189] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.189] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0201.189] GetProcessHeap () returned 0xb40000 [0201.189] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0201.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.190] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.190] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.190] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.190] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.190] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.190] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.190] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.191] GetProcessHeap () returned 0xb40000 [0201.191] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.191] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0201.191] GetProcessHeap () returned 0xb40000 [0201.191] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0201.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.192] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.192] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0201.192] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0201.192] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0201.192] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0201.192] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0201.192] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.193] GetProcessHeap () returned 0xb40000 [0201.193] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0201.193] FindNextFileW (in: hFindFile=0xb52e18, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0201.193] FindClose (in: hFindFile=0xb52e18 | out: hFindFile=0xb52e18) returned 1 [0201.193] GetProcessHeap () returned 0xb40000 [0201.193] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0201.194] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0201.194] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 0 [0201.194] FindClose (in: hFindFile=0xb52d98 | out: hFindFile=0xb52d98) returned 1 [0201.194] GetProcessHeap () returned 0xb40000 [0201.194] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0201.194] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0201.194] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0201.194] GetProcessHeap () returned 0xb40000 [0201.194] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.195] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0201.195] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0201.195] GetProcessHeap () returned 0xb40000 [0201.195] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.195] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0714d0, ftCreationTime.dwHighDateTime=0x1d5c71c, ftLastAccessTime.dwLowDateTime=0xe1437280, ftLastAccessTime.dwHighDateTime=0x1d5e035, ftLastWriteTime.dwLowDateTime=0xe1437280, ftLastWriteTime.dwHighDateTime=0x1d5e035, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0201.195] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xb9e664f2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb9e664f2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0201.195] GetProcessHeap () returned 0xb40000 [0201.195] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xb9e664f2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb9e664f2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xb9e664f2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb9e664f2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xb9e664f2, ftLastAccessTime.dwHighDateTime=0x1d65788, ftLastWriteTime.dwLowDateTime=0xb9e664f2, ftLastWriteTime.dwHighDateTime=0x1d65788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.001.etl", cAlternateFileName="UN6414~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcf0ae126, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xd12f3ee4, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.002.etl", cAlternateFileName="UN8F7C~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xf95053af, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x9b236e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.003.etl", cAlternateFileName="UN3A48~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.004.etl", cAlternateFileName="UNE414~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.005.etl", cAlternateFileName="UN7020~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.006.etl", cAlternateFileName="UN4AAB~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.007.etl", cAlternateFileName="UN1B88~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.008.etl", cAlternateFileName="UNFF10~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x361fe290, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.009.etl", cAlternateFileName="UNB5F0~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x885ec92b, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.010.etl", cAlternateFileName="UN7AC6~1.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xce292e60, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.011.etl", cAlternateFileName="UNIVER~4.ETL")) returned 1 [0201.197] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x107a2333, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.022.etl", cAlternateFileName="UNIVER~3.ETL")) returned 1 [0201.198] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xcd5eb67, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.023.etl", cAlternateFileName="UNIVER~2.ETL")) returned 1 [0201.198] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.030.etl", cAlternateFileName="UNIVER~1.ETL")) returned 1 [0201.198] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniversalNotificationPlatform.030.etl", cAlternateFileName="UNIVER~1.ETL")) returned 0 [0201.198] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0201.198] GetProcessHeap () returned 0xb40000 [0201.199] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.199] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0201.199] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 0 [0201.199] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0201.199] GetProcessHeap () returned 0xb40000 [0201.199] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.199] FindNextFileW (in: hFindFile=0xb529d8, lpFindFileData=0x342f2b0 | out: lpFindFileData=0x342f2b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0201.199] GetProcessHeap () returned 0xb40000 [0201.199] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22ad95c0, ftCreationTime.dwHighDateTime=0x1d5efb8, ftLastAccessTime.dwLowDateTime=0xe26e3a60, ftLastAccessTime.dwHighDateTime=0x1d590b6, ftLastWriteTime.dwLowDateTime=0xe26e3a60, ftLastWriteTime.dwHighDateTime=0x1d590b6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmMonitoringInstall.mof", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMMonitoringProvider.dll", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x520c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmStatusInstall.mof", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientWMIInstall.mof", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConfigSecurityPolicy.exe", cAlternateFileName="")) returned 1 [0201.200] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataLayer.dll", cAlternateFileName="")) returned 1 [0201.201] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x171cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DbgHelp.dll", cAlternateFileName="")) returned 1 [0201.201] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefenderCSP.dll", cAlternateFileName="")) returned 1 [0201.201] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Defendericon.png", cAlternateFileName="")) returned 1 [0201.201] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0201.201] GetProcessHeap () returned 0xb40000 [0201.201] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xcd996200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll.mui", cAlternateFileName="")) returned 1 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x401d6034, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7b19a1d2, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe0ac3200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpResL.dll.mui", cAlternateFileName="")) returned 1 [0201.202] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineScannerShell.exe.mui", cAlternateFileName="")) returned 1 [0201.203] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll.mui", cAlternateFileName="")) returned 1 [0201.203] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9063ce53, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x13c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.mfl", cAlternateFileName="")) returned 1 [0201.203] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea3c949, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc321b00, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement_Uninstall.mfl", cAlternateFileName="")) returned 1 [0201.203] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 1 [0201.203] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea62ba2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x67afd900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 0 [0201.203] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0201.204] GetProcessHeap () returned 0xb40000 [0201.204] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="FepUnregister.mof", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6f9baad, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x173a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x70b0173c, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b1fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAzSubmit.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ca0b8b, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xe9da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6f2939c, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x6af10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x874d15c, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x53fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x880bd29, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0201.204] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpProvider.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6507363, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xac7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpRtp.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x842bfe5, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x2099a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x53a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpuxhostproxy.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x139a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpUXSrv.exe", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x92ec92b, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x137d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x999a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCuiL.exe", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x8537061, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x147a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x849e6f2, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x191a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpEng.exe", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x8537061, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x33a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5152ad10, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x89d596d, ftLastAccessTime.dwHighDateTime=0x1d2fa0b, ftLastWriteTime.dwLowDateTime=0x5152ad10, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x6c9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpResL.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisLog.dll", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x538f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisSrv.exe", cAlternateFileName="")) returned 1 [0201.205] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisWfp.dll", cAlternateFileName="")) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline", cAlternateFileName="")) returned 1 [0201.206] GetProcessHeap () returned 0xb40000 [0201.206] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.206] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a0eddf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a0eddf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a0eddf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269e8b6c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x269e8b6c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x269e8b6c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x161a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269e8b6c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x269e8b6c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x269e8b6c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineScannerShell.exe", cAlternateFileName="")) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a8150d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a8150d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a8150d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineScannerShell.exe", cAlternateFileName="")) returned 0 [0201.206] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0201.206] GetProcessHeap () returned 0xb40000 [0201.206] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.206] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0201.207] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acd9d7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26acd9d7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26acd9d7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe050, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.mof", cAlternateFileName="")) returned 1 [0201.207] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement_Uninstall.mof", cAlternateFileName="")) returned 1 [0201.207] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x505a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1 [0201.207] GetProcessHeap () returned 0xb40000 [0201.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.208] GetProcessHeap () returned 0xb40000 [0201.208] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xe6b863e2, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b863e2, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.209] GetProcessHeap () returned 0xb40000 [0201.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.210] GetProcessHeap () returned 0xb40000 [0201.210] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.210] GetProcessHeap () returned 0xb40000 [0201.210] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.211] GetProcessHeap () returned 0xb40000 [0201.211] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe69e2cba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe69e2cba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.543] GetProcessHeap () returned 0xb40000 [0201.543] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.580] GetProcessHeap () returned 0xb40000 [0201.580] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.580] GetProcessHeap () returned 0xb40000 [0201.580] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.581] GetProcessHeap () returned 0xb40000 [0201.581] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.582] GetProcessHeap () returned 0xb40000 [0201.582] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.583] GetProcessHeap () returned 0xb40000 [0201.583] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.584] GetProcessHeap () returned 0xb40000 [0201.584] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.584] GetProcessHeap () returned 0xb40000 [0201.584] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.584] GetProcessHeap () returned 0xb40000 [0201.584] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.586] GetProcessHeap () returned 0xb40000 [0201.586] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.586] GetProcessHeap () returned 0xb40000 [0201.586] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.587] GetProcessHeap () returned 0xb40000 [0201.587] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.587] GetProcessHeap () returned 0xb40000 [0201.587] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0201.588] GetProcessHeap () returned 0xb40000 [0201.588] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.588] GetProcessHeap () returned 0xb40000 [0201.588] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.588] GetProcessHeap () returned 0xb40000 [0201.588] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.588] GetProcessHeap () returned 0xb40000 [0201.588] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.589] GetProcessHeap () returned 0xb40000 [0201.589] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.589] GetProcessHeap () returned 0xb40000 [0201.589] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.589] GetProcessHeap () returned 0xb40000 [0201.589] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b3a1ae, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b3a1ae, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.590] GetProcessHeap () returned 0xb40000 [0201.590] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.590] GetProcessHeap () returned 0xb40000 [0201.590] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0201.591] GetProcessHeap () returned 0xb40000 [0201.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.591] GetProcessHeap () returned 0xb40000 [0201.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.592] GetProcessHeap () returned 0xb40000 [0201.592] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.593] GetProcessHeap () returned 0xb40000 [0201.593] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.593] GetProcessHeap () returned 0xb40000 [0201.594] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.594] GetProcessHeap () returned 0xb40000 [0201.594] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.594] GetProcessHeap () returned 0xb40000 [0201.594] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.595] GetProcessHeap () returned 0xb40000 [0201.595] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.596] GetProcessHeap () returned 0xb40000 [0201.596] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.596] GetProcessHeap () returned 0xb40000 [0201.596] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.596] GetProcessHeap () returned 0xb40000 [0201.597] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.597] GetProcessHeap () returned 0xb40000 [0201.597] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe8df25ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8df25ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.598] GetProcessHeap () returned 0xb40000 [0201.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.598] GetProcessHeap () returned 0xb40000 [0201.598] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b13f10, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b13f10, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.599] GetProcessHeap () returned 0xb40000 [0201.599] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0201.599] GetProcessHeap () returned 0xb40000 [0201.599] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.600] GetProcessHeap () returned 0xb40000 [0201.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.600] GetProcessHeap () returned 0xb40000 [0201.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.600] GetProcessHeap () returned 0xb40000 [0201.600] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.601] GetProcessHeap () returned 0xb40000 [0201.601] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe6b6048a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6b6048a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.602] GetProcessHeap () returned 0xb40000 [0201.602] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0201.603] GetProcessHeap () returned 0xb40000 [0201.603] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.603] GetProcessHeap () returned 0xb40000 [0201.603] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0201.604] GetProcessHeap () returned 0xb40000 [0201.604] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.604] GetProcessHeap () returned 0xb40000 [0201.604] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xbe8338 | out: hHeap=0xb40000) returned 1 [0201.604] GetProcessHeap () returned 0xb40000 [0201.604] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xbe8338 [0201.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53058 [0201.613] GetProcessHeap () returned 0xb40000 [0201.613] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x223c89ad, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93a9ec0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0201.920] GetProcessHeap () returned 0xb40000 [0201.920] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93abe68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x228b384c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.922] GetProcessHeap () returned 0xb40000 [0201.922] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.922] GetProcessHeap () returned 0xb40000 [0201.922] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa94b581e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2310be20, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0201.948] GetProcessHeap () returned 0xb40000 [0201.948] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0201.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95725d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a0ae1c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.951] GetProcessHeap () returned 0xb40000 [0201.951] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0201.951] GetProcessHeap () returned 0xb40000 [0201.951] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0201.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95a0375, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a572ca, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0201.954] GetProcessHeap () returned 0xb40000 [0201.954] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0201.984] GetProcessHeap () returned 0xb40000 [0201.984] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.985] GetProcessHeap () returned 0xb40000 [0201.985] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967b88f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2313207f, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0201.987] GetProcessHeap () returned 0xb40000 [0201.987] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.988] GetProcessHeap () returned 0xb40000 [0201.988] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3002ee68, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967c915, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.989] GetProcessHeap () returned 0xb40000 [0201.989] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.989] GetProcessHeap () returned 0xb40000 [0201.989] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.989] GetProcessHeap () returned 0xb40000 [0201.989] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.989] GetProcessHeap () returned 0xb40000 [0201.989] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.989] GetProcessHeap () returned 0xb40000 [0201.989] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0201.991] GetProcessHeap () returned 0xb40000 [0201.991] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9730ad4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0201.991] GetProcessHeap () returned 0xb40000 [0201.991] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.991] GetProcessHeap () returned 0xb40000 [0201.991] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0201.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0201.993] GetProcessHeap () returned 0xb40000 [0201.993] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0201.993] GetProcessHeap () returned 0xb40000 [0201.993] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0201.994] GetProcessHeap () returned 0xb40000 [0201.994] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0201.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.213] GetProcessHeap () returned 0xb40000 [0202.213] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9785683, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.215] GetProcessHeap () returned 0xb40000 [0202.215] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.215] GetProcessHeap () returned 0xb40000 [0202.215] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa97d9a35, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.220] GetProcessHeap () returned 0xb40000 [0202.220] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a3eee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970877d7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.223] GetProcessHeap () returned 0xb40000 [0202.223] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.223] GetProcessHeap () returned 0xb40000 [0202.223] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.223] GetProcessHeap () returned 0xb40000 [0202.223] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a634d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.224] GetProcessHeap () returned 0xb40000 [0202.224] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.225] GetProcessHeap () returned 0xb40000 [0202.225] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.225] GetProcessHeap () returned 0xb40000 [0202.225] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.225] GetProcessHeap () returned 0xb40000 [0202.225] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.226] GetProcessHeap () returned 0xb40000 [0202.226] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.226] GetProcessHeap () returned 0xb40000 [0202.226] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.226] GetProcessHeap () returned 0xb40000 [0202.226] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.227] GetProcessHeap () returned 0xb40000 [0202.227] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.227] GetProcessHeap () returned 0xb40000 [0202.227] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9987cd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.231] GetProcessHeap () returned 0xb40000 [0202.231] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.231] GetProcessHeap () returned 0xb40000 [0202.231] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998957e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972da738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.232] GetProcessHeap () returned 0xb40000 [0202.232] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.232] GetProcessHeap () returned 0xb40000 [0202.232] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998a0eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.233] GetProcessHeap () returned 0xb40000 [0202.233] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a18213, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9739a738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.236] GetProcessHeap () returned 0xb40000 [0202.236] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.236] GetProcessHeap () returned 0xb40000 [0202.236] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.239] GetProcessHeap () returned 0xb40000 [0202.239] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.239] GetProcessHeap () returned 0xb40000 [0202.239] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.239] GetProcessHeap () returned 0xb40000 [0202.239] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa16f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x975664ea, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.242] GetProcessHeap () returned 0xb40000 [0202.242] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.242] GetProcessHeap () returned 0xb40000 [0202.242] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.245] GetProcessHeap () returned 0xb40000 [0202.245] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.245] GetProcessHeap () returned 0xb40000 [0202.245] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b12d9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.248] GetProcessHeap () returned 0xb40000 [0202.248] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.248] GetProcessHeap () returned 0xb40000 [0202.248] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.249] GetProcessHeap () returned 0xb40000 [0202.249] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976e822e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd111d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x977346e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.252] GetProcessHeap () returned 0xb40000 [0202.252] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.252] GetProcessHeap () returned 0xb40000 [0202.252] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.253] GetProcessHeap () returned 0xb40000 [0202.253] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.253] GetProcessHeap () returned 0xb40000 [0202.253] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd24bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.253] GetProcessHeap () returned 0xb40000 [0202.253] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.253] GetProcessHeap () returned 0xb40000 [0202.253] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.254] GetProcessHeap () returned 0xb40000 [0202.254] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.254] GetProcessHeap () returned 0xb40000 [0202.254] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.255] GetProcessHeap () returned 0xb40000 [0202.255] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.508] GetProcessHeap () returned 0xb40000 [0202.519] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cb9e99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.520] GetProcessHeap () returned 0xb40000 [0202.520] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.520] GetProcessHeap () returned 0xb40000 [0202.520] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cba947, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.521] GetProcessHeap () returned 0xb40000 [0202.521] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.521] GetProcessHeap () returned 0xb40000 [0202.521] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb4a05954, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.521] GetProcessHeap () returned 0xb40000 [0202.521] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.523] GetProcessHeap () returned 0xb40000 [0202.523] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.523] GetProcessHeap () returned 0xb40000 [0202.523] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.524] GetProcessHeap () returned 0xb40000 [0202.524] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.524] GetProcessHeap () returned 0xb40000 [0202.524] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.525] GetProcessHeap () returned 0xb40000 [0202.525] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e44ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.526] GetProcessHeap () returned 0xb40000 [0202.526] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.526] GetProcessHeap () returned 0xb40000 [0202.526] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e45833, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.527] GetProcessHeap () returned 0xb40000 [0202.527] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.527] GetProcessHeap () returned 0xb40000 [0202.527] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb523798b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.527] GetProcessHeap () returned 0xb40000 [0202.527] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.528] GetProcessHeap () returned 0xb40000 [0202.528] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.528] GetProcessHeap () returned 0xb40000 [0202.528] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.529] GetProcessHeap () returned 0xb40000 [0202.529] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.529] GetProcessHeap () returned 0xb40000 [0202.529] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.531] GetProcessHeap () returned 0xb40000 [0202.531] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2be01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.532] GetProcessHeap () returned 0xb40000 [0202.532] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.532] GetProcessHeap () returned 0xb40000 [0202.532] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2cc20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.535] GetProcessHeap () returned 0xb40000 [0202.535] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.535] GetProcessHeap () returned 0xb40000 [0202.535] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.535] GetProcessHeap () returned 0xb40000 [0202.535] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.535] GetProcessHeap () returned 0xb40000 [0202.535] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.536] GetProcessHeap () returned 0xb40000 [0202.536] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.537] GetProcessHeap () returned 0xb40000 [0202.537] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.537] GetProcessHeap () returned 0xb40000 [0202.537] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.538] GetProcessHeap () returned 0xb40000 [0202.538] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.538] GetProcessHeap () returned 0xb40000 [0202.538] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.540] GetProcessHeap () returned 0xb40000 [0202.540] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa04335f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.544] GetProcessHeap () returned 0xb40000 [0202.544] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.544] GetProcessHeap () returned 0xb40000 [0202.544] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.544] GetProcessHeap () returned 0xb40000 [0202.544] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.544] GetProcessHeap () returned 0xb40000 [0202.544] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.545] GetProcessHeap () returned 0xb40000 [0202.545] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.547] GetProcessHeap () returned 0xb40000 [0202.547] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa096b21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.548] GetProcessHeap () returned 0xb40000 [0202.548] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.548] GetProcessHeap () returned 0xb40000 [0202.548] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eed6166, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa097114, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.548] GetProcessHeap () returned 0xb40000 [0202.548] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.548] GetProcessHeap () returned 0xb40000 [0202.548] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.549] GetProcessHeap () returned 0xb40000 [0202.549] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.552] GetProcessHeap () returned 0xb40000 [0202.552] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa098c51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.552] GetProcessHeap () returned 0xb40000 [0202.552] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.552] GetProcessHeap () returned 0xb40000 [0202.552] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0991e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.553] GetProcessHeap () returned 0xb40000 [0202.553] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.701] GetProcessHeap () returned 0xb40000 [0202.701] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0df02e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.769] GetProcessHeap () returned 0xb40000 [0202.769] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.769] GetProcessHeap () returned 0xb40000 [0202.769] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.848] GetProcessHeap () returned 0xb40000 [0202.848] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.848] GetProcessHeap () returned 0xb40000 [0202.848] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.849] GetProcessHeap () returned 0xb40000 [0202.849] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.849] GetProcessHeap () returned 0xb40000 [0202.849] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa1412e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.849] GetProcessHeap () returned 0xb40000 [0202.849] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.849] GetProcessHeap () returned 0xb40000 [0202.849] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.852] GetProcessHeap () returned 0xb40000 [0202.852] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.852] GetProcessHeap () returned 0xb40000 [0202.852] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.853] GetProcessHeap () returned 0xb40000 [0202.853] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.853] GetProcessHeap () returned 0xb40000 [0202.854] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.854] GetProcessHeap () returned 0xb40000 [0202.854] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.854] GetProcessHeap () returned 0xb40000 [0202.854] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.854] GetProcessHeap () returned 0xb40000 [0202.854] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.854] GetProcessHeap () returned 0xb40000 [0202.854] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.857] GetProcessHeap () returned 0xb40000 [0202.857] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28d627, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.858] GetProcessHeap () returned 0xb40000 [0202.858] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.858] GetProcessHeap () returned 0xb40000 [0202.858] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.858] GetProcessHeap () returned 0xb40000 [0202.858] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.858] GetProcessHeap () returned 0xb40000 [0202.858] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.859] GetProcessHeap () returned 0xb40000 [0202.859] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.859] GetProcessHeap () returned 0xb40000 [0202.859] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.859] GetProcessHeap () returned 0xb40000 [0202.859] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.859] GetProcessHeap () returned 0xb40000 [0202.859] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.860] GetProcessHeap () returned 0xb40000 [0202.860] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.860] GetProcessHeap () returned 0xb40000 [0202.860] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.860] GetProcessHeap () returned 0xb40000 [0202.860] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.860] GetProcessHeap () returned 0xb40000 [0202.860] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.861] GetProcessHeap () returned 0xb40000 [0202.861] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.861] GetProcessHeap () returned 0xb40000 [0202.861] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.862] GetProcessHeap () returned 0xb40000 [0202.862] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.863] GetProcessHeap () returned 0xb40000 [0202.863] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.864] GetProcessHeap () returned 0xb40000 [0202.864] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.865] GetProcessHeap () returned 0xb40000 [0202.865] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.866] GetProcessHeap () returned 0xb40000 [0202.866] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.866] GetProcessHeap () returned 0xb40000 [0202.866] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.866] GetProcessHeap () returned 0xb40000 [0202.866] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.867] GetProcessHeap () returned 0xb40000 [0202.867] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.867] GetProcessHeap () returned 0xb40000 [0202.867] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.868] GetProcessHeap () returned 0xb40000 [0202.868] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.868] GetProcessHeap () returned 0xb40000 [0202.868] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.870] GetProcessHeap () returned 0xb40000 [0202.870] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.870] GetProcessHeap () returned 0xb40000 [0202.870] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.871] GetProcessHeap () returned 0xb40000 [0202.871] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.871] GetProcessHeap () returned 0xb40000 [0202.871] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.871] GetProcessHeap () returned 0xb40000 [0202.871] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.873] GetProcessHeap () returned 0xb40000 [0202.873] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.876] GetProcessHeap () returned 0xb40000 [0202.876] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.876] GetProcessHeap () returned 0xb40000 [0202.876] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.876] GetProcessHeap () returned 0xb40000 [0202.876] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.876] GetProcessHeap () returned 0xb40000 [0202.876] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.877] GetProcessHeap () returned 0xb40000 [0202.877] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0202.966] GetProcessHeap () returned 0xb40000 [0202.966] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.967] GetProcessHeap () returned 0xb40000 [0202.967] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.967] GetProcessHeap () returned 0xb40000 [0202.967] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.968] GetProcessHeap () returned 0xb40000 [0202.968] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.969] GetProcessHeap () returned 0xb40000 [0202.969] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.972] GetProcessHeap () returned 0xb40000 [0202.972] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.972] GetProcessHeap () returned 0xb40000 [0202.972] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.975] GetProcessHeap () returned 0xb40000 [0202.975] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.975] GetProcessHeap () returned 0xb40000 [0202.975] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.975] GetProcessHeap () returned 0xb40000 [0202.975] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.976] GetProcessHeap () returned 0xb40000 [0202.976] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.977] GetProcessHeap () returned 0xb40000 [0202.977] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.977] GetProcessHeap () returned 0xb40000 [0202.977] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.977] GetProcessHeap () returned 0xb40000 [0202.977] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.978] GetProcessHeap () returned 0xb40000 [0202.978] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.978] GetProcessHeap () returned 0xb40000 [0202.978] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.979] GetProcessHeap () returned 0xb40000 [0202.979] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.981] GetProcessHeap () returned 0xb40000 [0202.981] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0202.982] GetProcessHeap () returned 0xb40000 [0202.982] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.984] GetProcessHeap () returned 0xb40000 [0202.984] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45dd3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.985] GetProcessHeap () returned 0xb40000 [0202.985] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.985] GetProcessHeap () returned 0xb40000 [0202.985] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.986] GetProcessHeap () returned 0xb40000 [0202.986] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.986] GetProcessHeap () returned 0xb40000 [0202.986] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.986] GetProcessHeap () returned 0xb40000 [0202.986] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.986] GetProcessHeap () returned 0xb40000 [0202.986] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.987] GetProcessHeap () returned 0xb40000 [0202.987] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.987] GetProcessHeap () returned 0xb40000 [0202.987] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.987] GetProcessHeap () returned 0xb40000 [0202.987] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.988] GetProcessHeap () returned 0xb40000 [0202.988] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0202.988] GetProcessHeap () returned 0xb40000 [0202.988] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.988] GetProcessHeap () returned 0xb40000 [0202.988] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.989] GetProcessHeap () returned 0xb40000 [0202.989] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.989] GetProcessHeap () returned 0xb40000 [0202.989] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.990] GetProcessHeap () returned 0xb40000 [0202.990] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.991] GetProcessHeap () returned 0xb40000 [0202.991] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0202.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0202.991] GetProcessHeap () returned 0xb40000 [0202.991] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0202.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0202.992] GetProcessHeap () returned 0xb40000 [0202.992] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0202.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0202.993] GetProcessHeap () returned 0xb40000 [0202.993] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0202.993] GetProcessHeap () returned 0xb40000 [0202.993] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0202.994] GetProcessHeap () returned 0xb40000 [0202.994] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0202.994] GetProcessHeap () returned 0xb40000 [0202.994] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.995] GetProcessHeap () returned 0xb40000 [0202.995] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.996] GetProcessHeap () returned 0xb40000 [0202.996] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.996] GetProcessHeap () returned 0xb40000 [0202.996] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.997] GetProcessHeap () returned 0xb40000 [0202.997] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.997] GetProcessHeap () returned 0xb40000 [0202.997] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0202.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0202.997] GetProcessHeap () returned 0xb40000 [0202.997] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0202.997] GetProcessHeap () returned 0xb40000 [0202.997] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0202.998] GetProcessHeap () returned 0xb40000 [0202.998] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0202.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.000] GetProcessHeap () returned 0xb40000 [0203.000] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.001] GetProcessHeap () returned 0xb40000 [0203.001] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.001] GetProcessHeap () returned 0xb40000 [0203.001] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.001] GetProcessHeap () returned 0xb40000 [0203.001] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.001] GetProcessHeap () returned 0xb40000 [0203.001] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.002] GetProcessHeap () returned 0xb40000 [0203.002] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0203.128] GetProcessHeap () returned 0xb40000 [0203.128] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.129] GetProcessHeap () returned 0xb40000 [0203.129] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.129] GetProcessHeap () returned 0xb40000 [0203.129] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0203.129] GetProcessHeap () returned 0xb40000 [0203.129] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d4131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.132] GetProcessHeap () returned 0xb40000 [0203.132] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa66b57d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.134] GetProcessHeap () returned 0xb40000 [0203.134] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.134] GetProcessHeap () returned 0xb40000 [0203.134] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.137] GetProcessHeap () returned 0xb40000 [0203.137] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.137] GetProcessHeap () returned 0xb40000 [0203.137] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.137] GetProcessHeap () returned 0xb40000 [0203.137] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.138] GetProcessHeap () returned 0xb40000 [0203.138] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0203.139] GetProcessHeap () returned 0xb40000 [0203.139] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.139] GetProcessHeap () returned 0xb40000 [0203.139] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.140] GetProcessHeap () returned 0xb40000 [0203.140] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0203.141] GetProcessHeap () returned 0xb40000 [0203.141] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.141] GetProcessHeap () returned 0xb40000 [0203.141] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.141] GetProcessHeap () returned 0xb40000 [0203.141] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c5add, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.142] GetProcessHeap () returned 0xb40000 [0203.142] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0203.143] GetProcessHeap () returned 0xb40000 [0203.143] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73b0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.146] GetProcessHeap () returned 0xb40000 [0203.146] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73c941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.147] GetProcessHeap () returned 0xb40000 [0203.147] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.147] GetProcessHeap () returned 0xb40000 [0203.147] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73d444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.148] GetProcessHeap () returned 0xb40000 [0203.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.148] GetProcessHeap () returned 0xb40000 [0203.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73dce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.148] GetProcessHeap () returned 0xb40000 [0203.148] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.148] GetProcessHeap () returned 0xb40000 [0203.148] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.149] GetProcessHeap () returned 0xb40000 [0203.149] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.149] GetProcessHeap () returned 0xb40000 [0203.149] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73ed8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.155] GetProcessHeap () returned 0xb40000 [0203.155] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.155] GetProcessHeap () returned 0xb40000 [0203.155] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.156] GetProcessHeap () returned 0xb40000 [0203.156] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.156] GetProcessHeap () returned 0xb40000 [0203.156] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.157] GetProcessHeap () returned 0xb40000 [0203.157] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.157] GetProcessHeap () returned 0xb40000 [0203.157] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.157] GetProcessHeap () returned 0xb40000 [0203.158] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.158] GetProcessHeap () returned 0xb40000 [0203.158] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.351] GetProcessHeap () returned 0xb40000 [0203.351] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0203.352] GetProcessHeap () returned 0xb40000 [0203.352] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.353] GetProcessHeap () returned 0xb40000 [0203.353] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.354] GetProcessHeap () returned 0xb40000 [0203.354] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.354] GetProcessHeap () returned 0xb40000 [0203.355] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.355] GetProcessHeap () returned 0xb40000 [0203.355] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.356] GetProcessHeap () returned 0xb40000 [0203.356] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0203.357] GetProcessHeap () returned 0xb40000 [0203.357] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.357] GetProcessHeap () returned 0xb40000 [0203.357] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.358] GetProcessHeap () returned 0xb40000 [0203.358] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.358] GetProcessHeap () returned 0xb40000 [0203.358] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.359] GetProcessHeap () returned 0xb40000 [0203.359] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.359] GetProcessHeap () returned 0xb40000 [0203.359] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.360] GetProcessHeap () returned 0xb40000 [0203.360] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.361] GetProcessHeap () returned 0xb40000 [0203.361] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0203.361] GetProcessHeap () returned 0xb40000 [0203.361] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.361] GetProcessHeap () returned 0xb40000 [0203.361] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.362] GetProcessHeap () returned 0xb40000 [0203.362] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.365] GetProcessHeap () returned 0xb40000 [0203.365] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.365] GetProcessHeap () returned 0xb40000 [0203.365] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.367] GetProcessHeap () returned 0xb40000 [0203.367] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa84e071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0203.372] GetProcessHeap () returned 0xb40000 [0203.372] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.372] GetProcessHeap () returned 0xb40000 [0203.372] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0203.374] GetProcessHeap () returned 0xb40000 [0203.374] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.374] GetProcessHeap () returned 0xb40000 [0203.375] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.375] GetProcessHeap () returned 0xb40000 [0203.375] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.375] GetProcessHeap () returned 0xb40000 [0203.375] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0203.376] GetProcessHeap () returned 0xb40000 [0203.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.377] GetProcessHeap () returned 0xb40000 [0203.377] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.377] GetProcessHeap () returned 0xb40000 [0203.377] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.463] GetProcessHeap () returned 0xb40000 [0203.463] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.466] GetProcessHeap () returned 0xb40000 [0203.466] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.466] GetProcessHeap () returned 0xb40000 [0203.466] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.467] GetProcessHeap () returned 0xb40000 [0203.467] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.467] GetProcessHeap () returned 0xb40000 [0203.467] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.468] GetProcessHeap () returned 0xb40000 [0203.468] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.470] GetProcessHeap () returned 0xb40000 [0203.470] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0203.471] GetProcessHeap () returned 0xb40000 [0203.471] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.471] GetProcessHeap () returned 0xb40000 [0203.471] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.472] GetProcessHeap () returned 0xb40000 [0203.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9d2e10, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0203.549] GetProcessHeap () returned 0xb40000 [0203.549] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa1d3b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.551] GetProcessHeap () returned 0xb40000 [0203.552] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.552] GetProcessHeap () returned 0xb40000 [0203.552] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa975ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.554] GetProcessHeap () returned 0xb40000 [0203.554] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.554] GetProcessHeap () returned 0xb40000 [0203.555] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaac88c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.557] GetProcessHeap () returned 0xb40000 [0203.557] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.557] GetProcessHeap () returned 0xb40000 [0203.557] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabbfeb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.560] GetProcessHeap () returned 0xb40000 [0203.560] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.560] GetProcessHeap () returned 0xb40000 [0203.560] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabc1237, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.561] GetProcessHeap () returned 0xb40000 [0203.561] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac222e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.567] GetProcessHeap () returned 0xb40000 [0203.567] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.567] GetProcessHeap () returned 0xb40000 [0203.567] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.568] GetProcessHeap () returned 0xb40000 [0203.568] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac23e3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9f144d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.569] GetProcessHeap () returned 0xb40000 [0203.569] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaca3951, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9cb1f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.572] GetProcessHeap () returned 0xb40000 [0203.572] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.573] GetProcessHeap () returned 0xb40000 [0203.573] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9f144d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad0c763, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db303c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.575] GetProcessHeap () returned 0xb40000 [0203.575] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.575] GetProcessHeap () returned 0xb40000 [0203.575] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.576] GetProcessHeap () returned 0xb40000 [0203.576] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.576] GetProcessHeap () returned 0xb40000 [0203.576] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2db7c876, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad78aac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.580] GetProcessHeap () returned 0xb40000 [0203.580] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.580] GetProcessHeap () returned 0xb40000 [0203.580] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.581] GetProcessHeap () returned 0xb40000 [0203.581] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad79c2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.581] GetProcessHeap () returned 0xb40000 [0203.581] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.581] GetProcessHeap () returned 0xb40000 [0203.581] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7a6fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.586] GetProcessHeap () returned 0xb40000 [0203.586] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.586] GetProcessHeap () returned 0xb40000 [0203.586] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ad84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd2927f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.586] GetProcessHeap () returned 0xb40000 [0203.586] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.586] GetProcessHeap () returned 0xb40000 [0203.586] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7b5bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.589] GetProcessHeap () returned 0xb40000 [0203.589] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7c2d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.590] GetProcessHeap () returned 0xb40000 [0203.590] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7cee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.591] GetProcessHeap () returned 0xb40000 [0203.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.591] GetProcessHeap () returned 0xb40000 [0203.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.591] GetProcessHeap () returned 0xb40000 [0203.591] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.592] GetProcessHeap () returned 0xb40000 [0203.592] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7d91e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0203.592] GetProcessHeap () returned 0xb40000 [0203.592] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0203.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7e777, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.594] GetProcessHeap () returned 0xb40000 [0203.594] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0203.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7f48f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.595] GetProcessHeap () returned 0xb40000 [0203.595] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0203.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ff09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd75732, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0203.595] GetProcessHeap () returned 0xb40000 [0203.595] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0203.595] GetProcessHeap () returned 0xb40000 [0203.595] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0203.596] GetProcessHeap () returned 0xb40000 [0203.596] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0203.596] GetProcessHeap () returned 0xb40000 [0203.596] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.597] GetProcessHeap () returned 0xb40000 [0203.597] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x2d31f11, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2d31f11, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.598] GetProcessHeap () returned 0xb40000 [0203.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.598] GetProcessHeap () returned 0xb40000 [0203.598] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9368ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d1965e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.598] GetProcessHeap () returned 0xb40000 [0203.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.598] GetProcessHeap () returned 0xb40000 [0203.598] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.599] GetProcessHeap () returned 0xb40000 [0203.599] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.750] GetProcessHeap () returned 0xb40000 [0203.750] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3d897, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.754] GetProcessHeap () returned 0xb40000 [0203.754] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.754] GetProcessHeap () returned 0xb40000 [0203.754] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0203.754] GetProcessHeap () returned 0xb40000 [0203.754] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.754] GetProcessHeap () returned 0xb40000 [0203.754] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.755] GetProcessHeap () returned 0xb40000 [0203.755] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.757] GetProcessHeap () returned 0xb40000 [0203.757] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebe349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.766] GetProcessHeap () returned 0xb40000 [0203.766] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.766] GetProcessHeap () returned 0xb40000 [0203.766] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaaebeeeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0203.768] GetProcessHeap () returned 0xb40000 [0203.768] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.768] GetProcessHeap () returned 0xb40000 [0203.768] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.776] GetProcessHeap () returned 0xb40000 [0203.776] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0203.807] GetProcessHeap () returned 0xb40000 [0203.807] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf18f1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.808] GetProcessHeap () returned 0xb40000 [0203.808] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.808] GetProcessHeap () returned 0xb40000 [0203.808] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaafbd2f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68bca1ad, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0203.814] GetProcessHeap () returned 0xb40000 [0203.814] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.814] GetProcessHeap () returned 0xb40000 [0203.814] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0203.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x134444f, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x134444f, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0203.816] GetProcessHeap () returned 0xb40000 [0203.816] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0203.816] GetProcessHeap () returned 0xb40000 [0203.817] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0203.817] GetProcessHeap () returned 0xb40000 [0203.817] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0203.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.016] GetProcessHeap () returned 0xb40000 [0204.016] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab022752, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd526822a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.017] GetProcessHeap () returned 0xb40000 [0204.017] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.017] GetProcessHeap () returned 0xb40000 [0204.017] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab022fb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.018] GetProcessHeap () returned 0xb40000 [0204.018] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.018] GetProcessHeap () returned 0xb40000 [0204.018] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.019] GetProcessHeap () returned 0xb40000 [0204.019] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.021] GetProcessHeap () returned 0xb40000 [0204.021] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08a798, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.022] GetProcessHeap () returned 0xb40000 [0204.022] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.022] GetProcessHeap () returned 0xb40000 [0204.022] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08aff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.024] GetProcessHeap () returned 0xb40000 [0204.025] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.025] GetProcessHeap () returned 0xb40000 [0204.025] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08b876, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.025] GetProcessHeap () returned 0xb40000 [0204.025] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08c849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.026] GetProcessHeap () returned 0xb40000 [0204.026] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.026] GetProcessHeap () returned 0xb40000 [0204.026] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08d12b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.027] GetProcessHeap () returned 0xb40000 [0204.027] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.027] GetProcessHeap () returned 0xb40000 [0204.027] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.027] GetProcessHeap () returned 0xb40000 [0204.028] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.029] GetProcessHeap () returned 0xb40000 [0204.029] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.029] GetProcessHeap () returned 0xb40000 [0204.029] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08e5b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.029] GetProcessHeap () returned 0xb40000 [0204.029] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08f2fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0204.030] GetProcessHeap () returned 0xb40000 [0204.030] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.030] GetProcessHeap () returned 0xb40000 [0204.030] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08fb6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0204.031] GetProcessHeap () returned 0xb40000 [0204.031] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.031] GetProcessHeap () returned 0xb40000 [0204.031] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.031] GetProcessHeap () returned 0xb40000 [0204.031] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.031] GetProcessHeap () returned 0xb40000 [0204.031] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.031] GetProcessHeap () returned 0xb40000 [0204.031] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.032] GetProcessHeap () returned 0xb40000 [0204.032] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.035] GetProcessHeap () returned 0xb40000 [0204.035] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab13f343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.037] GetProcessHeap () returned 0xb40000 [0204.037] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1ce307, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.040] GetProcessHeap () returned 0xb40000 [0204.040] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.040] GetProcessHeap () returned 0xb40000 [0204.040] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.042] GetProcessHeap () returned 0xb40000 [0204.042] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.042] GetProcessHeap () returned 0xb40000 [0204.042] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.043] GetProcessHeap () returned 0xb40000 [0204.043] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.045] GetProcessHeap () returned 0xb40000 [0204.045] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.045] GetProcessHeap () returned 0xb40000 [0204.045] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.045] GetProcessHeap () returned 0xb40000 [0204.045] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0204.047] GetProcessHeap () returned 0xb40000 [0204.047] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab228e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.048] GetProcessHeap () returned 0xb40000 [0204.048] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.048] GetProcessHeap () returned 0xb40000 [0204.048] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab2732ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.051] GetProcessHeap () returned 0xb40000 [0204.051] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab3100a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0204.162] GetProcessHeap () returned 0xb40000 [0204.162] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.162] GetProcessHeap () returned 0xb40000 [0204.162] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab39d704, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d18b39b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.168] GetProcessHeap () returned 0xb40000 [0204.168] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.168] GetProcessHeap () returned 0xb40000 [0204.168] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.171] GetProcessHeap () returned 0xb40000 [0204.171] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.171] GetProcessHeap () returned 0xb40000 [0204.171] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.172] GetProcessHeap () returned 0xb40000 [0204.172] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfe80d855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe80d855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.173] GetProcessHeap () returned 0xb40000 [0204.173] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.173] GetProcessHeap () returned 0xb40000 [0204.173] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.174] GetProcessHeap () returned 0xb40000 [0204.174] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.176] GetProcessHeap () returned 0xb40000 [0204.176] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab4afc0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c3b24a6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.178] GetProcessHeap () returned 0xb40000 [0204.178] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.178] GetProcessHeap () returned 0xb40000 [0204.178] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.184] GetProcessHeap () returned 0xb40000 [0204.184] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.184] GetProcessHeap () returned 0xb40000 [0204.184] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.185] GetProcessHeap () returned 0xb40000 [0204.185] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.187] GetProcessHeap () returned 0xb40000 [0204.187] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab549f27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab549f27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-200.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-200.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1553, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-200.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe7b04f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fe7b04f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fe7b04f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fea12a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fea6684, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fea6684, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x801, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0204.200] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fea80f8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feaa819, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feaa819, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x48f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-200.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x48f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-200.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7feab8fd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7feab8fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7feab8fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x54ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200_contrast-black.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 1 [0204.201] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-200_contrast-white.png", cAlternateFileName="")) returned 0 [0204.201] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.202] GetProcessHeap () returned 0xb40000 [0204.202] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.202] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0204.202] GetProcessHeap () returned 0xb40000 [0204.202] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.203] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.203] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.203] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0204.203] GetProcessHeap () returned 0xb40000 [0204.203] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.203] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0204.203] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0204.203] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0204.203] GetProcessHeap () returned 0xb40000 [0204.203] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.204] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_N")) returned 1 [0204.204] GetProcessHeap () returned 0xb40000 [0204.204] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.206] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.206] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee96925, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ee96925, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ee96925, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0204.206] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5eb5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0204.206] GetProcessHeap () returned 0xb40000 [0204.206] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5eb5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.207] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5eb5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.207] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ed19195, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x406d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0204.207] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ed19195, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x406d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0204.207] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.207] GetProcessHeap () returned 0xb40000 [0204.207] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.207] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee96925, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eebcb7e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eebcb7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0204.207] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0204.207] GetProcessHeap () returned 0xb40000 [0204.207] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.208] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.208] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.208] FindClose (in: hFindFile=0xb52d18 | out: hFindFile=0xb52d18) returned 1 [0204.208] GetProcessHeap () returned 0xb40000 [0204.208] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.208] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0204.208] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0204.208] GetProcessHeap () returned 0xb40000 [0204.208] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.209] FindNextFileW (in: hFindFile=0xb53058, lpFindFileData=0x342f028 | out: lpFindFileData=0x342f028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI79E2~1.0_X")) returned 1 [0204.209] GetProcessHeap () returned 0xb40000 [0204.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.210] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.211] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eee2de1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eee2de1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7cf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0204.211] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eee2de1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eee2de1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0204.211] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0204.211] GetProcessHeap () returned 0xb40000 [0204.211] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.211] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.211] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef554ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef554ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0204.211] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef554ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef554ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0204.212] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.212] GetProcessHeap () returned 0xb40000 [0204.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.212] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef09035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0204.212] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0204.212] GetProcessHeap () returned 0xb40000 [0204.212] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2d055d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2d055d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-100.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2f67b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2f67b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2f67b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2f67b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f2f67b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f2f67b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f31ca10, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f31ca10, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f31ca10, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f31ca10, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f31ca10, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f31ca10, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f342c6e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f342c6e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f342c6e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f342c6e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f342c6e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f342c6e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.214] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f368ec7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f368ec7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f368ec7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_contrast-black.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f368ec7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f368ec7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f368ec7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-16_contrast-white.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f38f120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f38f120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f38f120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f38f120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f38f120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f38f120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3b537e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f3b537e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f3b537e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3b537e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f3b537e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f3b537e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3b537e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f3b537e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f3b537e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_contrast-black.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f433724, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f433724, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f433724, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-20_contrast-white.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4599a7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4599a7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4599a7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4599a7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4599a7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4599a7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4599a7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4599a7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4599a7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4d3c2c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4d3c2c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4d3c2c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.215] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4f9e85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4f9e85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4f9e85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_contrast-black.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4f9e85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4f9e85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4f9e85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-24_contrast-white.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f4f9e85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f4f9e85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f4f9e85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5251df, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f529f5c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f529f5c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f52c2d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f52c2d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f52c2d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f52c2d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f52c2d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f52c2d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_contrast-black.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f52c2d5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-256_contrast-white.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f552554, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30.png", cAlternateFileName="")) returned 1 [0204.455] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f552554, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f552554, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f552554, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f552554, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_contrast-black.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-30_contrast-white.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5787ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5787ad, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5787ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f59ea0b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f59ea0b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f59ea0b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f59ea0b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5f1c49, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5f1c49, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5f1c49, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f5f1c49, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f5f1c49, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f617ecd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f617ecd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f617ecd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_contrast-black.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f617ecd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f617ecd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f617ecd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-32_contrast-white.png", cAlternateFileName="")) returned 1 [0204.456] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f617ecd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f617ecd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f617ecd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36.png", cAlternateFileName="")) returned 1 [0204.457] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.457] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.457] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.457] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f63e12b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f63e12b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f63e12b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_contrast-black.png", cAlternateFileName="")) returned 1 [0204.457] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f664388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f664388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f664388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-36_contrast-white.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f68a5dd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f68a5dd, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f68a5dd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f68a5dd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6b083b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6b083b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6b083b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6b083b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6b083b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_contrast-black.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6d6a94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6d6a94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6d6a94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-40_contrast-white.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6d6a94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6d6a94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6d6a94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6d6a94, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6d6a94, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6d6a94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_contrast-black.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6fccee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f6fccee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f6fccee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-48_contrast-white.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f722f4b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f74f7c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f74f7c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60.png", cAlternateFileName="")) returned 1 [0204.458] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f74f7c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f74f7c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f74f7c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.459] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f74f7c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f74f7c1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f74f7c1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.459] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f775a1a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f775a1a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f775a1a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.459] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f775a1a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f775a1a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f775a1a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_contrast-black.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f775a1a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f775a1a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f775a1a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-60_contrast-white.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f79bc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f79bc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f79bc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f79bc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f79bc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f79bc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f79bc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f79bc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f79bc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_contrast-black.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-64_contrast-white.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7c1ed1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7c1ed1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7c1ed1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7e812b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7e812b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7e812b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7e812b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7e812b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7e812b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7e812b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7e812b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7e812b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7e812b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f7e812b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f7e812b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_contrast-black.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f80e388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f80e388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f80e388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-72_contrast-white.png", cAlternateFileName="")) returned 1 [0204.460] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f80e388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f80e388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f80e388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-80.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f80e388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f80e388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f80e388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-80_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f80e388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f80e388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f80e388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-80_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f80e388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f80e388, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f80e388, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x385, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-80_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f80e388, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8345e2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8345e2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-80_contrast-black.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8345e2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8345e2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8345e2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x385, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-80_contrast-white.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8345e2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8345e2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8345e2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x429, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-96.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8345e2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8345e2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8345e2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x429, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-96_altform-unplated.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8345e2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8345e2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8345e2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x429, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png", cAlternateFileName="")) returned 1 [0204.461] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f85a840, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f85a840, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f85a840, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f85a840, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f85a840, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f85a840, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x429, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-96_contrast-black.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f85a840, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f85a840, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f85a840, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedAppList.targetsize-96_contrast-white.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f85a840, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f85a840, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f85a840, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-100.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f85a840, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f85a840, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f85a840, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x719, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f880a99, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f880a99, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f880a99, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x823, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedLargeTile.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f880a99, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f880a99, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f880a99, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-100.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f880a99, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f880a99, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f880a99, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f880a99, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f880a99, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f880a99, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedMedTile.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f880a99, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f880a99, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f880a99, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-100.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8a6cf2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8a6cf2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8a6cf2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8a6cf2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8a6cf2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8a6cf2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSmallTile.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8a6cf2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8a6cf2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8a6cf2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-100.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8a6cf2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8a6cf2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8a6cf2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.462] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8a6cf2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8a6cf2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8a6cf2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4266, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedSplash.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8ccf50, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8ccf50, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8ccf50, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedStoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8ccf50, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8ccf50, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8ccf50, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedStoreLogo.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8ccf50, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8ccf50, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8ccf50, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedStoreLogo.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8ccf50, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-100.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-100_contrast-black.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-100_contrast-white.png", cAlternateFileName="")) returned 1 [0204.463] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedWideTile.scale-100_contrast-white.png", cAlternateFileName="")) returned 0 [0204.463] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.464] GetProcessHeap () returned 0xb40000 [0204.464] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.464] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0204.464] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0204.464] GetProcessHeap () returned 0xb40000 [0204.464] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.464] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.464] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c1a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop", cAlternateFileName="")) returned 1 [0204.465] GetProcessHeap () returned 0xb40000 [0204.465] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c1a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.466] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c1a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.466] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c20a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0204.466] GetProcessHeap () returned 0xb40000 [0204.466] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c20a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0204.466] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c20a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.466] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f919407, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_accessibility.xml", cAlternateFileName="")) returned 1 [0204.467] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f919407, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2953, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_getconnected.xml", cAlternateFileName="")) returned 1 [0204.467] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f919407, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_narrator.xml", cAlternateFileName="")) returned 1 [0204.467] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f919407, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_speechrecognition.xml", cAlternateFileName="")) returned 1 [0204.467] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f919407, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1171, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.467] FindNextFileW (in: hFindFile=0xb52d98, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f919407, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1171, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.467] FindClose (in: hFindFile=0xb52d98 | out: hFindFile=0xb52d98) returned 1 [0204.467] GetProcessHeap () returned 0xb40000 [0204.467] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.467] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0204.467] GetProcessHeap () returned 0xb40000 [0204.467] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f93f661, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_accessibility.xml", cAlternateFileName="")) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f93f661, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f93f661, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2937, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_getconnected.xml", cAlternateFileName="")) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f93f661, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f93f661, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_narrator.xml", cAlternateFileName="")) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f93f661, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f93f661, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_speechrecognition.xml", cAlternateFileName="")) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f93f661, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x115f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f93f661, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x115f, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.468] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.468] GetProcessHeap () returned 0xb40000 [0204.468] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.468] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0204.468] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.468] GetProcessHeap () returned 0xb40000 [0204.468] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.469] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2a52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="holoLens", cAlternateFileName="")) returned 1 [0204.469] GetProcessHeap () returned 0xb40000 [0204.469] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2a52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.470] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2a52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.470] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2f47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0204.470] GetProcessHeap () returned 0xb40000 [0204.470] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2f47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.471] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2f47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.471] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_use.xml", cAlternateFileName="")) returned 1 [0204.471] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_wifi.xml", cAlternateFileName="")) returned 1 [0204.471] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.471] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.471] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.471] GetProcessHeap () returned 0xb40000 [0204.471] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.471] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2f47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0204.471] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.471] GetProcessHeap () returned 0xb40000 [0204.471] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.472] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c3363, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0204.472] GetProcessHeap () returned 0xb40000 [0204.472] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c3363, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.473] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c3363, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.473] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c39d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0204.473] GetProcessHeap () returned 0xb40000 [0204.473] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c39d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.473] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c39d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.473] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9658ba, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows-main-08294e1b-0ad7-4937-9616-fcbc42ff7ff1.png", cAlternateFileName="")) returned 1 [0204.473] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="winlogo.png", cAlternateFileName="")) returned 1 [0204.473] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="winlogo.png", cAlternateFileName="")) returned 0 [0204.473] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.473] GetProcessHeap () returned 0xb40000 [0204.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.474] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c39d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0204.474] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.474] GetProcessHeap () returned 0xb40000 [0204.474] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.474] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4278, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mobile", cAlternateFileName="")) returned 1 [0204.474] GetProcessHeap () returned 0xb40000 [0204.474] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4278, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.475] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4278, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.475] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4ac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0204.475] GetProcessHeap () returned 0xb40000 [0204.475] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4ac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.476] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4ac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.476] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_getconnected.xml", cAlternateFileName="")) returned 1 [0204.476] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.476] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.476] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.476] GetProcessHeap () returned 0xb40000 [0204.476] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.476] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0204.476] GetProcessHeap () returned 0xb40000 [0204.476] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.477] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.477] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_getconnected.xml", cAlternateFileName="")) returned 1 [0204.477] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.477] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.477] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.477] GetProcessHeap () returned 0xb40000 [0204.477] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.477] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0204.477] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.477] GetProcessHeap () returned 0xb40000 [0204.477] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.478] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="surfaceHub", cAlternateFileName="SURFAC~1")) returned 1 [0204.478] GetProcessHeap () returned 0xb40000 [0204.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.478] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.478] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c60ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0204.478] GetProcessHeap () returned 0xb40000 [0204.478] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c60ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.479] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c60ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.479] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f98bb1c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_getconnected.xml", cAlternateFileName="")) returned 1 [0204.479] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9fe269, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.479] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9fe269, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.479] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.479] GetProcessHeap () returned 0xb40000 [0204.479] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.479] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0204.479] GetProcessHeap () returned 0xb40000 [0204.479] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.480] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.480] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f9fe269, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="doc_offline_getconnected.xml", cAlternateFileName="")) returned 1 [0204.480] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa28bd5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa28bd5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 1 [0204.480] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa28bd5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa28bd5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="toc.xml", cAlternateFileName="")) returned 0 [0204.480] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0204.480] GetProcessHeap () returned 0xb40000 [0204.480] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.480] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0204.480] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.481] GetProcessHeap () returned 0xb40000 [0204.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.481] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="surfaceHub", cAlternateFileName="SURFAC~1")) returned 0 [0204.481] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0204.481] GetProcessHeap () returned 0xb40000 [0204.481] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.481] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa28bd5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa28bd5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CPub.BackgroundTasks.winmd", cAlternateFileName="")) returned 1 [0204.481] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa4ee54, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa4ee54, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CPub.SkuInterop.winmd", cAlternateFileName="")) returned 1 [0204.482] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0204.482] GetProcessHeap () returned 0xb40000 [0204.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.482] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.482] FindNextFileW (in: hFindFile=0xb52d58, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.482] FindClose (in: hFindFile=0xb52d58 | out: hFindFile=0xb52d58) returned 1 [0204.482] GetProcessHeap () returned 0xb40000 [0204.482] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.482] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0204.482] GetProcessHeap () returned 0xb40000 [0204.482] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa750b2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2e018, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetSMDL2.ttf", cAlternateFileName="")) returned 1 [0204.482] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TopicPage", cAlternateFileName="TOPICP~1")) returned 1 [0204.483] GetProcessHeap () returned 0xb40000 [0204.483] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.484] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.484] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa750b2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="core.css", cAlternateFileName="")) returned 1 [0204.484] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x505c, dwReserved0=0x0, dwReserved1=0x0, cFileName="core.js", cAlternateFileName="")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="core.xslt", cAlternateFileName="")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_ltr.css", cAlternateFileName="")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="core_rtl.css", cAlternateFileName="")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbf4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="directionalnavigation-1.0.0.0.js", cAlternateFileName="")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78f63a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0204.485] GetProcessHeap () returned 0xb40000 [0204.485] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78f63a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78f63a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fac1569, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x0, dwReserved1=0x0, cFileName="playbutton-rollover.png", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="playbutton.png", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa9b30b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa9b30b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="playbutton.png", cAlternateFileName="")) returned 0 [0204.486] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0204.486] GetProcessHeap () returned 0xb40000 [0204.486] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerJS", cAlternateFileName="PARTNE~1")) returned 1 [0204.486] GetProcessHeap () returned 0xb40000 [0204.486] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\PartnerJS\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fac1569, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4518, dwReserved0=0x0, dwReserved1=0x0, cFileName="retailDemo.js", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb53098, lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fac1569, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4518, dwReserved0=0x0, dwReserved1=0x0, cFileName="retailDemo.js", cAlternateFileName="")) returned 0 [0204.486] FindClose (in: hFindFile=0xb53098 | out: hFindFile=0xb53098) returned 1 [0204.486] GetProcessHeap () returned 0xb40000 [0204.486] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.486] FindNextFileW (in: hFindFile=0xb52ed8, lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerJS", cAlternateFileName="PARTNE~1")) returned 0 [0204.487] FindClose (in: hFindFile=0xb52ed8 | out: hFindFile=0xb52ed8) returned 1 [0204.487] GetProcessHeap () returned 0xb40000 [0204.487] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.487] FindNextFileW (in: hFindFile=0xb52998, lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TopicPage", cAlternateFileName="TOPICP~1")) returned 0 [0204.487] FindClose (in: hFindFile=0xb52998 | out: hFindFile=0xb52998) returned 1 [0204.487] GetProcessHeap () returned 0xb40000 [0204.487] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.488] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa4ee54, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa4ee54, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x206c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0204.488] FindNextFileW (in: hFindFile=0xb52d18, lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fac1569, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SkuInterop.dll", cAlternateFileName="")) returned 1 [0204.488] GetProcessHeap () returned 0xb40000 [0204.488] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.489] GetProcessHeap () returned 0xb40000 [0204.489] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.489] GetProcessHeap () returned 0xb40000 [0204.489] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.490] GetProcessHeap () returned 0xb40000 [0204.490] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.525] GetProcessHeap () returned 0xb40000 [0204.525] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab841b4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x287b925a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.528] GetProcessHeap () returned 0xb40000 [0204.528] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.528] GetProcessHeap () returned 0xb40000 [0204.528] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.530] GetProcessHeap () returned 0xb40000 [0204.530] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.530] GetProcessHeap () returned 0xb40000 [0204.530] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.531] GetProcessHeap () returned 0xb40000 [0204.531] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.533] GetProcessHeap () returned 0xb40000 [0204.533] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9559ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.536] GetProcessHeap () returned 0xb40000 [0204.536] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.536] GetProcessHeap () returned 0xb40000 [0204.536] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.537] GetProcessHeap () returned 0xb40000 [0204.537] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.537] GetProcessHeap () returned 0xb40000 [0204.537] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.538] GetProcessHeap () returned 0xb40000 [0204.538] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0204.593] GetProcessHeap () returned 0xb40000 [0204.593] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2891078c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9bb295, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2891078c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.594] GetProcessHeap () returned 0xb40000 [0204.594] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.594] GetProcessHeap () returned 0xb40000 [0204.594] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2895cc43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb21004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.611] GetProcessHeap () returned 0xb40000 [0204.611] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x289a90fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb2233c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x289a90fa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.612] GetProcessHeap () returned 0xb40000 [0204.612] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.612] GetProcessHeap () returned 0xb40000 [0204.612] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Sounds\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28a67cbd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb22dfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28a67cbd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.612] GetProcessHeap () returned 0xb40000 [0204.612] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.616] GetProcessHeap () returned 0xb40000 [0204.616] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.617] GetProcessHeap () returned 0xb40000 [0204.617] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfbac0b62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbac0b62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.617] GetProcessHeap () returned 0xb40000 [0204.617] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.617] GetProcessHeap () returned 0xb40000 [0204.618] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\TEE\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957986f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb25901, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2993daf0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.628] GetProcessHeap () returned 0xb40000 [0204.628] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.628] GetProcessHeap () returned 0xb40000 [0204.628] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x289369e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9baa69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x289369e5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.629] GetProcessHeap () returned 0xb40000 [0204.629] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.629] GetProcessHeap () returned 0xb40000 [0204.629] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.630] GetProcessHeap () returned 0xb40000 [0204.630] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac06201d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0204.636] GetProcessHeap () returned 0xb40000 [0204.636] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb9e6bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.636] GetProcessHeap () returned 0xb40000 [0204.636] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.636] GetProcessHeap () returned 0xb40000 [0204.636] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.645] GetProcessHeap () returned 0xb40000 [0204.645] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.645] GetProcessHeap () returned 0xb40000 [0204.645] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.646] GetProcessHeap () returned 0xb40000 [0204.646] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.647] GetProcessHeap () returned 0xb40000 [0204.647] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba0d3c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.652] GetProcessHeap () returned 0xb40000 [0204.652] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.652] GetProcessHeap () returned 0xb40000 [0204.652] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba158a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.652] GetProcessHeap () returned 0xb40000 [0204.652] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba219f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.653] GetProcessHeap () returned 0xb40000 [0204.653] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.653] GetProcessHeap () returned 0xb40000 [0204.653] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba2cef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.653] GetProcessHeap () returned 0xb40000 [0204.653] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0204.657] GetProcessHeap () returned 0xb40000 [0204.657] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.657] GetProcessHeap () returned 0xb40000 [0204.657] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.658] GetProcessHeap () returned 0xb40000 [0204.658] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf429c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac657e5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.658] GetProcessHeap () returned 0xb40000 [0204.658] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.658] GetProcessHeap () returned 0xb40000 [0204.658] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.658] GetProcessHeap () returned 0xb40000 [0204.658] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabbf4c99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0204.659] GetProcessHeap () returned 0xb40000 [0204.659] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.659] GetProcessHeap () returned 0xb40000 [0204.659] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.659] GetProcessHeap () returned 0xb40000 [0204.659] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.659] GetProcessHeap () returned 0xb40000 [0204.659] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.660] GetProcessHeap () returned 0xb40000 [0204.660] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.665] GetProcessHeap () returned 0xb40000 [0204.665] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4070c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.668] GetProcessHeap () returned 0xb40000 [0204.668] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.668] GetProcessHeap () returned 0xb40000 [0204.668] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc41746, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.672] GetProcessHeap () returned 0xb40000 [0204.672] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.672] GetProcessHeap () returned 0xb40000 [0204.672] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc423fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.677] GetProcessHeap () returned 0xb40000 [0204.677] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.677] GetProcessHeap () returned 0xb40000 [0204.677] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0204.679] GetProcessHeap () returned 0xb40000 [0204.679] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.679] GetProcessHeap () returned 0xb40000 [0204.679] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4357d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x63720995, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.680] GetProcessHeap () returned 0xb40000 [0204.680] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\1033\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4416c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x636ae280, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.682] GetProcessHeap () returned 0xb40000 [0204.682] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.683] GetProcessHeap () returned 0xb40000 [0204.683] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.683] GetProcessHeap () returned 0xb40000 [0204.683] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc44b63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.683] GetProcessHeap () returned 0xb40000 [0204.683] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.683] GetProcessHeap () returned 0xb40000 [0204.683] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc45469, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.683] GetProcessHeap () returned 0xb40000 [0204.683] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.683] GetProcessHeap () returned 0xb40000 [0204.683] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.721] GetProcessHeap () returned 0xb40000 [0204.721] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.721] GetProcessHeap () returned 0xb40000 [0204.721] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.722] GetProcessHeap () returned 0xb40000 [0204.722] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.727] GetProcessHeap () returned 0xb40000 [0204.728] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabdaf1a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.728] GetProcessHeap () returned 0xb40000 [0204.728] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.728] GetProcessHeap () returned 0xb40000 [0204.728] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.729] GetProcessHeap () returned 0xb40000 [0204.729] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.729] GetProcessHeap () returned 0xb40000 [0204.729] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.729] GetProcessHeap () returned 0xb40000 [0204.729] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.732] GetProcessHeap () returned 0xb40000 [0204.732] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe0794e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.733] GetProcessHeap () returned 0xb40000 [0204.733] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39211056, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe5a941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x392372b0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.735] GetProcessHeap () returned 0xb40000 [0204.735] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.735] GetProcessHeap () returned 0xb40000 [0204.735] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.736] GetProcessHeap () returned 0xb40000 [0204.736] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.743] GetProcessHeap () returned 0xb40000 [0204.743] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.743] GetProcessHeap () returned 0xb40000 [0204.743] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.743] GetProcessHeap () returned 0xb40000 [0204.743] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.750] GetProcessHeap () returned 0xb40000 [0204.750] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabec308c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33798b5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.751] GetProcessHeap () returned 0xb40000 [0204.751] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.751] GetProcessHeap () returned 0xb40000 [0204.751] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.753] GetProcessHeap () returned 0xb40000 [0204.753] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.754] GetProcessHeap () returned 0xb40000 [0204.754] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3eb0048 | out: hHeap=0xb40000) returned 1 [0204.808] GetProcessHeap () returned 0xb40000 [0204.808] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3eb0048 [0204.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x342eda0 | out: lpFindFileData=0x342eda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52e18 [0204.811] GetProcessHeap () returned 0xb40000 [0204.811] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf3049c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.812] GetProcessHeap () returned 0xb40000 [0204.812] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.812] GetProcessHeap () returned 0xb40000 [0204.812] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf30abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342422a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.812] GetProcessHeap () returned 0xb40000 [0204.812] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.815] GetProcessHeap () returned 0xb40000 [0204.815] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.815] GetProcessHeap () returned 0xb40000 [0204.815] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.816] GetProcessHeap () returned 0xb40000 [0204.816] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf9793f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.817] GetProcessHeap () returned 0xb40000 [0204.817] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.896] GetProcessHeap () returned 0xb40000 [0204.897] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Animation\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac04346d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x344583a2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.911] GetProcessHeap () returned 0xb40000 [0204.911] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.911] GetProcessHeap () returned 0xb40000 [0204.911] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Audio\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3447e5fb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac043e7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3447e5fb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.911] GetProcessHeap () returned 0xb40000 [0204.911] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.911] GetProcessHeap () returned 0xb40000 [0204.911] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Calendar\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344f0d0c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac044536, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x344f0d0c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.912] GetProcessHeap () returned 0xb40000 [0204.912] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.912] GetProcessHeap () returned 0xb40000 [0204.912] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Perfect\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3453d1c3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac044a68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x345651d2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.913] GetProcessHeap () returned 0xb40000 [0204.913] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.913] GetProcessHeap () returned 0xb40000 [0204.913] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Popups\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3458b455, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac0bb1e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3464a018, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.914] GetProcessHeap () returned 0xb40000 [0204.914] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0204.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Popups\\Upsell\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3464a018, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac12f3ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34670276, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.917] GetProcessHeap () returned 0xb40000 [0204.917] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0204.917] GetProcessHeap () returned 0xb40000 [0204.917] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.918] GetProcessHeap () returned 0xb40000 [0204.918] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\PrizeHistory\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34670276, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18e78c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34708be4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.922] GetProcessHeap () returned 0xb40000 [0204.922] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.922] GetProcessHeap () returned 0xb40000 [0204.922] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\ProgressBar\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34708be4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18f047, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34708be4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.923] GetProcessHeap () returned 0xb40000 [0204.923] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.923] GetProcessHeap () returned 0xb40000 [0204.923] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Tab\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3472fed7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18f99f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.923] GetProcessHeap () returned 0xb40000 [0204.923] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.923] GetProcessHeap () returned 0xb40000 [0204.923] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.924] GetProcessHeap () returned 0xb40000 [0204.924] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.924] GetProcessHeap () returned 0xb40000 [0204.924] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac190436, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.924] GetProcessHeap () returned 0xb40000 [0204.924] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.931] GetProcessHeap () returned 0xb40000 [0204.931] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.931] GetProcessHeap () returned 0xb40000 [0204.931] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.931] GetProcessHeap () returned 0xb40000 [0204.931] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fd71d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0204.932] GetProcessHeap () returned 0xb40000 [0204.932] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.934] GetProcessHeap () returned 0xb40000 [0204.934] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Animation\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac318bc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347eead2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.937] GetProcessHeap () returned 0xb40000 [0204.937] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.937] GetProcessHeap () returned 0xb40000 [0204.937] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Badges\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34814d2b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3196ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34814d2b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0204.938] GetProcessHeap () returned 0xb40000 [0204.938] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.938] GetProcessHeap () returned 0xb40000 [0204.938] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Pin\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x348db826, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac319e44, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x348db826, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.939] GetProcessHeap () returned 0xb40000 [0204.939] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.939] GetProcessHeap () returned 0xb40000 [0204.939] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Sounds\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x348db826, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac36e3cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34927cf5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.941] GetProcessHeap () returned 0xb40000 [0204.941] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.941] GetProcessHeap () returned 0xb40000 [0204.941] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0204.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Stripes\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac36f571, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0204.942] GetProcessHeap () returned 0xb40000 [0204.942] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0204.942] GetProcessHeap () returned 0xb40000 [0204.942] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.943] GetProcessHeap () returned 0xb40000 [0204.943] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.943] GetProcessHeap () returned 0xb40000 [0204.943] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3703f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0204.944] GetProcessHeap () returned 0xb40000 [0204.944] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.944] GetProcessHeap () returned 0xb40000 [0204.944] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0204.944] GetProcessHeap () returned 0xb40000 [0204.944] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0204.945] GetProcessHeap () returned 0xb40000 [0204.945] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0204.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371ee7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0204.946] GetProcessHeap () returned 0xb40000 [0204.946] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0204.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac487abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d58 [0205.091] GetProcessHeap () returned 0xb40000 [0205.091] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0205.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Buttons\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac488be1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a0cb16, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0205.319] GetProcessHeap () returned 0xb40000 [0205.319] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0205.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Buttons\\Back\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac489905, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0205.320] GetProcessHeap () returned 0xb40000 [0205.320] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0205.320] GetProcessHeap () returned 0xb40000 [0205.320] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3b176a0 [0205.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Buttons\\Menu\\*", lpFindFileData=0x342e380 | out: lpFindFileData=0x342e380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34a0cb16, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac52ad21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a32d6a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52998 [0205.322] GetProcessHeap () returned 0xb40000 [0205.322] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3b176a0 | out: hHeap=0xb40000) returned 1 [0205.322] GetProcessHeap () returned 0xb40000 [0205.322] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0205.323] GetProcessHeap () returned 0xb40000 [0205.323] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0205.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Hud\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34acb6c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac52b9f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0205.324] GetProcessHeap () returned 0xb40000 [0205.324] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0205.324] GetProcessHeap () returned 0xb40000 [0205.324] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ee2070 [0205.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\XboxControl\\*", lpFindFileData=0x342e608 | out: lpFindFileData=0x342e608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34af1924, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac5cdd03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34b17b7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d98 [0205.327] GetProcessHeap () returned 0xb40000 [0205.327] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ee2070 | out: hHeap=0xb40000) returned 1 [0205.327] GetProcessHeap () returned 0xb40000 [0205.327] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0xb40000) returned 1 [0205.327] GetProcessHeap () returned 0xb40000 [0205.327] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0205.327] GetProcessHeap () returned 0xb40000 [0205.328] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ed0058 [0205.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x342eb18 | out: lpFindFileData=0x342eb18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac644067, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52d18 [0205.331] GetProcessHeap () returned 0xb40000 [0205.331] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0205.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Advertisement\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac645b09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34b64035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb52ed8 [0205.331] GetProcessHeap () returned 0xb40000 [0205.331] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0205.331] GetProcessHeap () returned 0xb40000 [0205.331] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0205.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Audio\\*", lpFindFileData=0x342e890 | out: lpFindFileData=0x342e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cbcfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34c48e56, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb53098 [0205.333] GetProcessHeap () returned 0xb40000 [0205.333] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0x3ae5678 | out: hHeap=0xb40000) returned 1 [0205.333] GetProcessHeap () returned 0xb40000 [0205.333] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3ae5678 [0205.333] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\*", lpFindFileData=0x342e890) Thread: id = 111 os_tid = 0x93c [0192.208] GetProcessHeap () returned 0xb40000 [0192.208] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xc09c30 [0192.209] GetProcessHeap () returned 0xb40000 [0192.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0xc19c38 [0192.209] GetProcessHeap () returned 0xb40000 [0192.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb63580 [0192.209] GetProcessHeap () returned 0xb40000 [0192.209] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x110102) returned 0x3936020 [0192.212] GetProcessHeap () returned 0xb40000 [0192.212] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb4a9b8 [0192.212] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0192.212] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0192.212] Wow64DisableWow64FsRedirection (in: OldValue=0x356f8c4 | out: OldValue=0x356f8c4*=0x0) returned 1 [0192.212] GetProcessHeap () returned 0xb40000 [0192.212] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a9b8 | out: hHeap=0xb40000) returned 1 [0192.213] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0192.213] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=129) returned 1 [0192.213] CloseHandle (hObject=0x2d8) returned 1 [0192.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0192.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0192.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0x26 [0192.214] ResetEvent (hEvent=0x2a0) returned 1 [0192.214] SetEvent (hEvent=0x2a4) returned 1 [0192.214] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0192.214] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=0) returned 1 [0192.214] CloseHandle (hObject=0x2d8) returned 1 [0192.214] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.537] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.837] ResetEvent (hEvent=0x2a0) returned 1 [0192.838] SetEvent (hEvent=0x2a4) returned 1 [0192.838] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.838] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3695719) returned 1 [0192.838] CloseHandle (hObject=0x2ec) returned 1 [0192.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0192.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0192.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0192.839] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.841] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.841] ResetEvent (hEvent=0x2a0) returned 1 [0192.841] SetEvent (hEvent=0x2a4) returned 1 [0192.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.845] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1985867) returned 1 [0192.846] CloseHandle (hObject=0x2ec) returned 1 [0192.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0192.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0192.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0192.846] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.848] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.848] ResetEvent (hEvent=0x2a0) returned 1 [0192.848] SetEvent (hEvent=0x2a4) returned 1 [0192.849] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.849] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=174959) returned 1 [0192.850] CloseHandle (hObject=0x2ec) returned 1 [0192.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0192.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0192.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.850] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.852] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.852] ResetEvent (hEvent=0x2a0) returned 1 [0192.852] SetEvent (hEvent=0x2a4) returned 1 [0192.853] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.853] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=143754) returned 1 [0192.854] CloseHandle (hObject=0x2ec) returned 1 [0192.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0192.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0192.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.854] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.856] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.856] ResetEvent (hEvent=0x2a0) returned 1 [0192.856] SetEvent (hEvent=0x2a4) returned 1 [0192.856] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.857] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=162331) returned 1 [0192.857] CloseHandle (hObject=0x2ec) returned 1 [0192.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0192.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0192.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.857] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.857] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.859] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.859] ResetEvent (hEvent=0x2a0) returned 1 [0192.859] SetEvent (hEvent=0x2a4) returned 1 [0192.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.859] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=154427) returned 1 [0192.859] CloseHandle (hObject=0x2ec) returned 1 [0192.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0192.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0192.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.860] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.860] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.861] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.862] ResetEvent (hEvent=0x2a0) returned 1 [0192.862] SetEvent (hEvent=0x2a4) returned 1 [0192.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.862] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=44859) returned 1 [0192.862] CloseHandle (hObject=0x2ec) returned 1 [0192.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0192.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0192.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.863] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.869] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.869] ResetEvent (hEvent=0x2a0) returned 1 [0192.869] SetEvent (hEvent=0x2a4) returned 1 [0192.869] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.869] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=86178) returned 1 [0192.869] CloseHandle (hObject=0x2ec) returned 1 [0192.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0192.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0192.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.870] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.870] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.871] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.872] ResetEvent (hEvent=0x2a0) returned 1 [0192.872] SetEvent (hEvent=0x2a4) returned 1 [0192.872] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.872] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=79200) returned 1 [0192.872] CloseHandle (hObject=0x2ec) returned 1 [0192.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0192.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0192.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.873] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.873] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.875] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.875] ResetEvent (hEvent=0x2a0) returned 1 [0192.875] SetEvent (hEvent=0x2a4) returned 1 [0192.875] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.875] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45984) returned 1 [0192.875] CloseHandle (hObject=0x2ec) returned 1 [0192.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0192.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0192.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.876] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.878] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.878] ResetEvent (hEvent=0x2a0) returned 1 [0192.878] SetEvent (hEvent=0x2a4) returned 1 [0192.878] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.879] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=78688) returned 1 [0192.879] CloseHandle (hObject=0x2ec) returned 1 [0192.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0192.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0192.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.879] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.880] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.881] ResetEvent (hEvent=0x2a0) returned 1 [0192.881] SetEvent (hEvent=0x2a4) returned 1 [0192.881] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.882] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=77144) returned 1 [0192.882] CloseHandle (hObject=0x2ec) returned 1 [0192.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0192.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0192.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.882] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.883] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.884] ResetEvent (hEvent=0x2a0) returned 1 [0192.884] SetEvent (hEvent=0x2a4) returned 1 [0192.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.884] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=67424) returned 1 [0192.885] CloseHandle (hObject=0x2ec) returned 1 [0192.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0192.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0192.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.885] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.885] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.886] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.887] ResetEvent (hEvent=0x2a0) returned 1 [0192.887] SetEvent (hEvent=0x2a4) returned 1 [0192.887] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.887] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=66912) returned 1 [0192.888] CloseHandle (hObject=0x2ec) returned 1 [0192.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0192.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0192.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.888] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.888] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.889] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.890] ResetEvent (hEvent=0x2a0) returned 1 [0192.890] SetEvent (hEvent=0x2a4) returned 1 [0192.890] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.890] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=75616) returned 1 [0192.890] CloseHandle (hObject=0x2ec) returned 1 [0192.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0192.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0192.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.891] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.891] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.893] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.893] ResetEvent (hEvent=0x2a0) returned 1 [0192.893] SetEvent (hEvent=0x2a4) returned 1 [0192.893] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0192.894] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=811936) returned 1 [0192.894] CloseHandle (hObject=0x2b8) returned 1 [0192.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0192.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0192.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\memtest.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.894] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.894] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.896] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.896] ResetEvent (hEvent=0x2a0) returned 1 [0192.896] SetEvent (hEvent=0x2a4) returned 1 [0192.896] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.897] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45472) returned 1 [0192.897] CloseHandle (hObject=0x2ec) returned 1 [0192.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0192.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0192.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.897] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.897] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.899] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.899] ResetEvent (hEvent=0x2a0) returned 1 [0192.899] SetEvent (hEvent=0x2a4) returned 1 [0192.899] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.900] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45472) returned 1 [0192.900] CloseHandle (hObject=0x2ec) returned 1 [0192.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0192.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0192.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.900] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.900] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.902] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.902] ResetEvent (hEvent=0x2a0) returned 1 [0192.902] SetEvent (hEvent=0x2a4) returned 1 [0192.902] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.903] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45984) returned 1 [0192.903] CloseHandle (hObject=0x2ec) returned 1 [0192.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0192.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0192.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.903] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.903] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.905] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.905] ResetEvent (hEvent=0x2a0) returned 1 [0192.905] SetEvent (hEvent=0x2a4) returned 1 [0192.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.906] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45472) returned 1 [0192.906] CloseHandle (hObject=0x2ec) returned 1 [0192.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0192.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0192.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.906] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.906] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.911] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.911] ResetEvent (hEvent=0x2a0) returned 1 [0192.911] SetEvent (hEvent=0x2a4) returned 1 [0192.911] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.911] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45984) returned 1 [0192.911] CloseHandle (hObject=0x2ec) returned 1 [0192.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0192.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0192.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.912] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.914] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.914] ResetEvent (hEvent=0x2a0) returned 1 [0192.914] SetEvent (hEvent=0x2a4) returned 1 [0192.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.914] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=54168) returned 1 [0192.914] CloseHandle (hObject=0x2ec) returned 1 [0192.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0192.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0192.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.915] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.915] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.917] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.918] ResetEvent (hEvent=0x2a0) returned 1 [0192.918] SetEvent (hEvent=0x2a4) returned 1 [0192.918] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0192.918] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=12192) returned 1 [0192.918] CloseHandle (hObject=0x2f0) returned 1 [0192.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0192.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0192.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.919] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.919] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.922] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.922] ResetEvent (hEvent=0x2a0) returned 1 [0192.922] SetEvent (hEvent=0x2a4) returned 1 [0192.923] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.923] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=77152) returned 1 [0192.923] CloseHandle (hObject=0x2ec) returned 1 [0192.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0192.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0192.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.923] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.923] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.925] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.926] ResetEvent (hEvent=0x2a0) returned 1 [0192.926] SetEvent (hEvent=0x2a4) returned 1 [0192.926] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.926] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=77144) returned 1 [0192.926] CloseHandle (hObject=0x2ec) returned 1 [0192.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0192.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0192.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.927] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.927] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.929] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.929] ResetEvent (hEvent=0x2a0) returned 1 [0192.929] SetEvent (hEvent=0x2a4) returned 1 [0192.929] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.930] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=77152) returned 1 [0192.930] CloseHandle (hObject=0x2ec) returned 1 [0192.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0192.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0192.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.930] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.930] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.932] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.932] ResetEvent (hEvent=0x2a0) returned 1 [0192.932] SetEvent (hEvent=0x2a4) returned 1 [0192.932] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.933] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=77152) returned 1 [0192.933] CloseHandle (hObject=0x2ec) returned 1 [0192.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0192.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0192.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.933] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.933] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.935] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.935] ResetEvent (hEvent=0x2a0) returned 1 [0192.935] SetEvent (hEvent=0x2a4) returned 1 [0192.935] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.936] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=44952) returned 1 [0192.936] CloseHandle (hObject=0x2ec) returned 1 [0192.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0192.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0192.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.936] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.936] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.938] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.938] ResetEvent (hEvent=0x2a0) returned 1 [0192.938] SetEvent (hEvent=0x2a4) returned 1 [0192.938] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.939] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=45472) returned 1 [0192.939] CloseHandle (hObject=0x2ec) returned 1 [0192.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0192.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0192.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.939] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.939] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.941] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.941] ResetEvent (hEvent=0x2a0) returned 1 [0192.942] SetEvent (hEvent=0x2a4) returned 1 [0192.942] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0192.942] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=4662) returned 1 [0192.942] CloseHandle (hObject=0x2b8) returned 1 [0192.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0192.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0192.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.942] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.942] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.944] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.945] ResetEvent (hEvent=0x2a0) returned 1 [0192.945] SetEvent (hEvent=0x2a4) returned 1 [0192.945] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.945] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=42400) returned 1 [0192.945] CloseHandle (hObject=0x2ec) returned 1 [0192.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0192.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0192.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.945] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.945] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.947] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.948] ResetEvent (hEvent=0x2a0) returned 1 [0192.948] SetEvent (hEvent=0x2a4) returned 1 [0192.948] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.948] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=42328) returned 1 [0192.948] CloseHandle (hObject=0x2ec) returned 1 [0192.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0192.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0192.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.948] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.948] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.950] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.951] ResetEvent (hEvent=0x2a0) returned 1 [0192.951] SetEvent (hEvent=0x2a4) returned 1 [0192.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.951] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=42392) returned 1 [0192.951] CloseHandle (hObject=0x2ec) returned 1 [0192.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0192.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0192.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.951] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.954] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.955] ResetEvent (hEvent=0x2a0) returned 1 [0192.955] SetEvent (hEvent=0x2a4) returned 1 [0192.955] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.956] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.962] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.962] ResetEvent (hEvent=0x2a0) returned 1 [0192.962] SetEvent (hEvent=0x2a4) returned 1 [0192.963] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0192.963] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=69632) returned 1 [0192.964] CloseHandle (hObject=0x2b8) returned 1 [0192.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0192.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0192.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0x20 [0192.964] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.965] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.967] ResetEvent (hEvent=0x2a0) returned 1 [0192.967] SetEvent (hEvent=0x2a4) returned 1 [0192.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0192.967] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=15984) returned 1 [0192.967] CloseHandle (hObject=0x2f0) returned 1 [0192.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0192.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0192.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0192.968] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0192.968] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0192.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0192.970] ReadFile (in: hFile=0x2f0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3e70, lpOverlapped=0x0) returned 1 [0193.237] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3e80, lpOverlapped=0x0) returned 1 [0193.239] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0193.239] CloseHandle (hObject=0x2f0) returned 1 [0193.239] CloseHandle (hObject=0x2f4) returned 1 [0193.239] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0193.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0193.241] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=18624) returned 1 [0193.241] CloseHandle (hObject=0x2f4) returned 1 [0193.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0193.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0193.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0193.247] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.247] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0193.275] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x48c0, lpOverlapped=0x0) returned 1 [0193.279] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x48d0, lpOverlapped=0x0) returned 1 [0193.281] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x112, lpOverlapped=0x0) returned 1 [0193.281] CloseHandle (hObject=0x2f4) returned 1 [0193.281] CloseHandle (hObject=0x300) returned 1 [0193.281] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0193.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.283] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=19136) returned 1 [0193.283] CloseHandle (hObject=0x300) returned 1 [0193.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0193.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0193.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.283] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.283] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0193.284] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4ac0, lpOverlapped=0x0) returned 1 [0193.292] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4ad0, lpOverlapped=0x0) returned 1 [0193.293] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x132, lpOverlapped=0x0) returned 1 [0193.293] CloseHandle (hObject=0x300) returned 1 [0193.293] CloseHandle (hObject=0x2f4) returned 1 [0193.293] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0193.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0193.295] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=18624) returned 1 [0193.295] CloseHandle (hObject=0x2f4) returned 1 [0193.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0193.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0193.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0193.296] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.296] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0193.296] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x48c0, lpOverlapped=0x0) returned 1 [0193.310] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x48d0, lpOverlapped=0x0) returned 1 [0193.311] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x122, lpOverlapped=0x0) returned 1 [0193.311] CloseHandle (hObject=0x2f4) returned 1 [0193.311] CloseHandle (hObject=0x300) returned 1 [0193.311] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0193.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.313] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=19648) returned 1 [0193.313] CloseHandle (hObject=0x300) returned 1 [0193.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0193.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0193.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.313] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.313] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0193.314] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4cc0, lpOverlapped=0x0) returned 1 [0193.322] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4cd0, lpOverlapped=0x0) returned 1 [0193.323] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x112, lpOverlapped=0x0) returned 1 [0193.323] CloseHandle (hObject=0x300) returned 1 [0193.323] CloseHandle (hObject=0x2f4) returned 1 [0193.323] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0193.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0193.325] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=19136) returned 1 [0193.325] CloseHandle (hObject=0x2f4) returned 1 [0193.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0193.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0193.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0193.325] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.325] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0193.326] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4ac0, lpOverlapped=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4ad0, lpOverlapped=0x0) returned 1 [0193.335] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x122, lpOverlapped=0x0) returned 1 [0193.335] CloseHandle (hObject=0x2f4) returned 1 [0193.335] CloseHandle (hObject=0x300) returned 1 [0193.335] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0193.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.337] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=19648) returned 1 [0193.337] CloseHandle (hObject=0x300) returned 1 [0193.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0193.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0193.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.338] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.338] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0193.338] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4cc0, lpOverlapped=0x0) returned 1 [0193.340] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4cd0, lpOverlapped=0x0) returned 1 [0193.582] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x112, lpOverlapped=0x0) returned 1 [0193.582] CloseHandle (hObject=0x300) returned 1 [0193.582] CloseHandle (hObject=0x2f4) returned 1 [0193.582] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0193.934] SetEvent (hEvent=0x29c) returned 1 [0193.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0193.936] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=27840) returned 1 [0193.936] CloseHandle (hObject=0x304) returned 1 [0193.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0193.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0193.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0193.936] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.936] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0193.937] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x6cc0, lpOverlapped=0x0) returned 1 [0193.939] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x6cd0, lpOverlapped=0x0) returned 1 [0193.941] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x112, lpOverlapped=0x0) returned 1 [0193.941] CloseHandle (hObject=0x304) returned 1 [0193.941] CloseHandle (hObject=0x300) returned 1 [0193.941] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0193.942] SetEvent (hEvent=0x29c) returned 1 [0193.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.943] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=26816) returned 1 [0193.943] CloseHandle (hObject=0x300) returned 1 [0193.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0193.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0193.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.943] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.943] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0193.944] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x68c0, lpOverlapped=0x0) returned 1 [0193.946] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x68d0, lpOverlapped=0x0) returned 1 [0193.947] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x122, lpOverlapped=0x0) returned 1 [0193.948] CloseHandle (hObject=0x300) returned 1 [0193.948] CloseHandle (hObject=0x304) returned 1 [0193.948] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0193.949] SetEvent (hEvent=0x29c) returned 1 [0193.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0193.950] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=70848) returned 1 [0193.950] CloseHandle (hObject=0x304) returned 1 [0193.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0193.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0193.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0193.950] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.950] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0193.951] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x114c0, lpOverlapped=0x0) returned 1 [0193.953] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x114d0, lpOverlapped=0x0) returned 1 [0193.955] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x122, lpOverlapped=0x0) returned 1 [0193.956] CloseHandle (hObject=0x304) returned 1 [0193.956] CloseHandle (hObject=0x300) returned 1 [0193.956] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0193.957] SetEvent (hEvent=0x29c) returned 1 [0193.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.958] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=19648) returned 1 [0193.958] CloseHandle (hObject=0x300) returned 1 [0193.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0193.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0193.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0193.958] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.958] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0193.959] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4cc0, lpOverlapped=0x0) returned 1 [0193.961] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4cd0, lpOverlapped=0x0) returned 1 [0193.962] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x122, lpOverlapped=0x0) returned 1 [0193.963] CloseHandle (hObject=0x300) returned 1 [0193.963] CloseHandle (hObject=0x304) returned 1 [0193.963] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0193.964] SetEvent (hEvent=0x29c) returned 1 [0193.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0193.964] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=23232) returned 1 [0193.965] CloseHandle (hObject=0x304) returned 1 [0193.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0193.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0193.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0193.965] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.965] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0193.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0193.966] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x5ac0, lpOverlapped=0x0) returned 1 [0193.968] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x5ad0, lpOverlapped=0x0) returned 1 [0194.185] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x122, lpOverlapped=0x0) returned 1 [0194.185] CloseHandle (hObject=0x304) returned 1 [0194.185] CloseHandle (hObject=0x300) returned 1 [0194.185] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0194.187] SetEvent (hEvent=0x29c) returned 1 [0194.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0194.187] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=307416) returned 1 [0194.187] CloseHandle (hObject=0x300) returned 1 [0194.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0194.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0194.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.188] SetEvent (hEvent=0x29c) returned 1 [0194.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0194.188] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2118360) returned 1 [0194.188] CloseHandle (hObject=0x300) returned 1 [0194.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0194.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0194.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0194.190] SetEvent (hEvent=0x29c) returned 1 [0194.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0194.191] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=468696) returned 1 [0194.191] CloseHandle (hObject=0x300) returned 1 [0194.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0194.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0194.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.191] SetEvent (hEvent=0x29c) returned 1 [0194.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0194.192] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=396960) returned 1 [0194.192] CloseHandle (hObject=0x300) returned 1 [0194.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0194.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0194.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0194.193] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0194.193] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0194.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0194.193] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x60ea0, lpOverlapped=0x0) returned 1 [0194.201] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x60eb0, lpOverlapped=0x0) returned 1 [0194.208] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0194.208] CloseHandle (hObject=0x300) returned 1 [0194.208] CloseHandle (hObject=0x304) returned 1 [0194.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0194.212] SetEvent (hEvent=0x29c) returned 1 [0194.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0194.213] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=473760) returned 1 [0194.213] CloseHandle (hObject=0x304) returned 1 [0194.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0194.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0194.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0194.214] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0194.214] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0194.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0194.214] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x73aa0, lpOverlapped=0x0) returned 1 [0194.499] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x73ab0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x73ab0, lpOverlapped=0x0) returned 1 [0194.507] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0194.508] CloseHandle (hObject=0x304) returned 1 [0194.508] CloseHandle (hObject=0x300) returned 1 [0194.508] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 1 [0194.513] SetEvent (hEvent=0x29c) returned 1 [0194.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0194.515] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=210648) returned 1 [0194.515] CloseHandle (hObject=0x2fc) returned 1 [0194.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0194.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0194.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.515] SetEvent (hEvent=0x29c) returned 1 [0194.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0194.516] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1402584) returned 1 [0194.516] CloseHandle (hObject=0x2fc) returned 1 [0194.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0194.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0194.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.516] SetEvent (hEvent=0x29c) returned 1 [0194.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0194.518] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1761448) returned 1 [0194.518] CloseHandle (hObject=0x2f0) returned 1 [0194.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0194.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0194.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0194.519] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0194.519] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0194.519] ReadFile (in: hFile=0x2f0, lpBuffer=0x3936058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3936058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0194.522] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0194.522] ReadFile (in: hFile=0x2f0, lpBuffer=0x3976058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3976058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0194.528] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0194.528] ReadFile (in: hFile=0x2f0, lpBuffer=0x39b6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x39b6058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0194.858] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f830 | out: lpNewFilePointer=0x0) returned 1 [0194.858] WriteFile (in: hFile=0x2f0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xc0122, lpOverlapped=0x0) returned 1 [0194.889] SetEndOfFile (hFile=0x2f0) returned 1 [0194.890] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0194.890] WriteFile (in: hFile=0x2f0, lpBuffer=0x39f615a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f615a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0194.892] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0194.892] WriteFile (in: hFile=0x2f0, lpBuffer=0x39f615a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f615a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0194.894] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0194.894] WriteFile (in: hFile=0x2f0, lpBuffer=0x39f615a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f615a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0195.005] CloseHandle (hObject=0x2f0) returned 1 [0195.456] SetEvent (hEvent=0x29c) returned 1 [0195.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.457] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=263896) returned 1 [0195.457] CloseHandle (hObject=0x300) returned 1 [0195.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0195.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0195.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.457] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0195.457] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0195.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0195.458] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x406d8, lpOverlapped=0x0) returned 1 [0195.579] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x406e0, lpOverlapped=0x0) returned 1 [0195.584] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0195.585] CloseHandle (hObject=0x300) returned 1 [0195.585] CloseHandle (hObject=0x304) returned 1 [0195.585] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0195.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0195.589] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1208928) returned 1 [0195.589] CloseHandle (hObject=0x304) returned 1 [0195.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0195.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0195.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0195.589] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0195.589] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0195.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0195.590] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x110100, lpOverlapped=0x0) returned 1 [0195.730] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x110100, lpOverlapped=0x0) returned 1 [0195.984] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x17160, lpOverlapped=0x0) returned 1 [0195.985] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x17170, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x17170, lpOverlapped=0x0) returned 1 [0195.987] WriteFile (in: hFile=0x300, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0195.987] CloseHandle (hObject=0x304) returned 1 [0195.987] CloseHandle (hObject=0x300) returned 1 [0195.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 1 [0195.990] SetEvent (hEvent=0x29c) returned 1 [0195.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.990] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=332968) returned 1 [0195.990] CloseHandle (hObject=0x300) returned 1 [0195.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0195.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0195.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.991] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0195.991] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0195.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0195.991] ReadFile (in: hFile=0x300, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x514a8, lpOverlapped=0x0) returned 1 [0195.999] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x514b0, lpOverlapped=0x0) returned 1 [0196.005] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0196.005] CloseHandle (hObject=0x300) returned 1 [0196.005] CloseHandle (hObject=0x304) returned 1 [0196.005] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0196.223] SetEvent (hEvent=0x29c) returned 1 [0196.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.344] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=102) returned 1 [0196.345] CloseHandle (hObject=0x2f0) returned 1 [0196.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0196.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0196.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.345] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0196.345] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0196.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0196.346] ReadFile (in: hFile=0x2f0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x66, lpOverlapped=0x0) returned 1 [0196.347] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x70, lpOverlapped=0x0) returned 1 [0196.348] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0196.348] CloseHandle (hObject=0x2f0) returned 1 [0196.348] CloseHandle (hObject=0x2e4) returned 1 [0196.348] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0196.349] SetEvent (hEvent=0x29c) returned 1 [0196.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0196.350] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=102) returned 1 [0196.350] CloseHandle (hObject=0x2e4) returned 1 [0196.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0196.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0196.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0196.350] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0196.351] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0196.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0196.351] ReadFile (in: hFile=0x2e4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x66, lpOverlapped=0x0) returned 1 [0196.352] WriteFile (in: hFile=0x2f0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x70, lpOverlapped=0x0) returned 1 [0196.353] WriteFile (in: hFile=0x2f0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0196.353] CloseHandle (hObject=0x2e4) returned 1 [0196.353] CloseHandle (hObject=0x2f0) returned 1 [0196.353] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0196.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.355] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1093248) returned 1 [0196.355] CloseHandle (hObject=0x2f0) returned 1 [0196.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0196.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0196.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.356] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0196.356] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0196.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0196.357] ReadFile (in: hFile=0x2f0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x10ae80, lpOverlapped=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x10ae90, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x10ae90, lpOverlapped=0x0) returned 1 [0196.733] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0196.733] CloseHandle (hObject=0x2f0) returned 1 [0196.733] CloseHandle (hObject=0x2e4) returned 1 [0196.734] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0196.736] SetEvent (hEvent=0x29c) returned 1 [0196.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.737] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=660136) returned 1 [0196.737] CloseHandle (hObject=0x304) returned 1 [0196.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0196.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0196.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.738] SetEvent (hEvent=0x29c) returned 1 [0196.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.738] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=635040) returned 1 [0196.738] CloseHandle (hObject=0x304) returned 1 [0196.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0196.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0196.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.739] SetEvent (hEvent=0x29c) returned 1 [0196.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.740] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=963240) returned 1 [0196.740] CloseHandle (hObject=0x2f8) returned 1 [0196.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0196.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0196.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.741] SetEvent (hEvent=0x29c) returned 1 [0196.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.742] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=5967976) returned 1 [0196.742] CloseHandle (hObject=0x2f8) returned 1 [0196.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0196.742] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0196.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.957] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0196.958] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0196.958] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3936058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0196.963] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0196.963] ReadFile (in: hFile=0x2f8, lpBuffer=0x3976058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3976058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0196.972] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0196.972] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x39b6058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0196.984] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f830 | out: lpNewFilePointer=0x0) returned 1 [0196.984] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xc0112, lpOverlapped=0x0) returned 1 [0197.003] SetEndOfFile (hFile=0x2f8) returned 1 [0197.004] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0197.004] WriteFile (in: hFile=0x2f8, lpBuffer=0x39f614a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f614a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0197.006] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0197.006] WriteFile (in: hFile=0x2f8, lpBuffer=0x39f614a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f614a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0197.174] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0197.174] WriteFile (in: hFile=0x2f8, lpBuffer=0x39f614a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f614a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0197.175] CloseHandle (hObject=0x2f8) returned 1 [0197.175] SetEvent (hEvent=0x29c) returned 1 [0197.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.176] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=390320) returned 1 [0197.176] CloseHandle (hObject=0x2f8) returned 1 [0197.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0197.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0197.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.177] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0197.177] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0197.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e8 [0197.178] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x5f4b0, lpOverlapped=0x0) returned 1 [0197.185] WriteFile (in: hFile=0x2e8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x5f4c0, lpOverlapped=0x0) returned 1 [0197.193] WriteFile (in: hFile=0x2e8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0197.193] CloseHandle (hObject=0x2f8) returned 1 [0197.193] CloseHandle (hObject=0x2e8) returned 1 [0197.193] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0197.198] SetEvent (hEvent=0x29c) returned 1 [0197.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.198] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=88752) returned 1 [0197.198] CloseHandle (hObject=0x2e8) returned 1 [0197.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0197.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0197.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.199] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=791421) returned 1 [0197.199] CloseHandle (hObject=0x2e8) returned 1 [0197.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0197.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0197.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.200] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.200] CloseHandle (hObject=0x2e8) returned 1 [0197.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0197.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0197.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.201] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.201] CloseHandle (hObject=0x2e8) returned 1 [0197.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0197.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0197.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.202] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=27045) returned 1 [0197.202] CloseHandle (hObject=0x2e8) returned 1 [0197.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0197.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0197.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.203] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=9728) returned 1 [0197.203] CloseHandle (hObject=0x2e8) returned 1 [0197.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0197.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0197.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.203] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10240) returned 1 [0197.203] CloseHandle (hObject=0x2e8) returned 1 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.204] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.204] CloseHandle (hObject=0x2e8) returned 1 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0197.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.205] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.205] CloseHandle (hObject=0x2e8) returned 1 [0197.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0197.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0197.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.206] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=9728) returned 1 [0197.206] CloseHandle (hObject=0x2e8) returned 1 [0197.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0197.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0197.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.207] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=111320) returned 1 [0197.207] CloseHandle (hObject=0x2e8) returned 1 [0197.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0197.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0197.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.208] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=48936) returned 1 [0197.208] CloseHandle (hObject=0x2e8) returned 1 [0197.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0197.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0197.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.209] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=46622) returned 1 [0197.209] CloseHandle (hObject=0x2e8) returned 1 [0197.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0197.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0197.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.210] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=84190) returned 1 [0197.210] CloseHandle (hObject=0x2e8) returned 1 [0197.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0197.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0197.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.211] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=180172) returned 1 [0197.211] CloseHandle (hObject=0x2e8) returned 1 [0197.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0197.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0197.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.409] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=208408) returned 1 [0197.409] CloseHandle (hObject=0x2e8) returned 1 [0197.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0197.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0197.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.410] SetEvent (hEvent=0x29c) returned 1 [0197.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.411] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=8704) returned 1 [0197.411] CloseHandle (hObject=0x2e8) returned 1 [0197.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0197.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0197.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.411] SetEvent (hEvent=0x29c) returned 1 [0197.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.412] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=5120) returned 1 [0197.412] CloseHandle (hObject=0x2e8) returned 1 [0197.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0197.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0197.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.412] SetEvent (hEvent=0x29c) returned 1 [0197.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.413] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3072) returned 1 [0197.413] CloseHandle (hObject=0x2e8) returned 1 [0197.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0197.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0197.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.414] SetEvent (hEvent=0x29c) returned 1 [0197.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.414] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=23040) returned 1 [0197.414] CloseHandle (hObject=0x2e8) returned 1 [0197.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0197.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0197.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.415] SetEvent (hEvent=0x29c) returned 1 [0197.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.415] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0197.415] CloseHandle (hObject=0x2e8) returned 1 [0197.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0197.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0197.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.416] SetEvent (hEvent=0x29c) returned 1 [0197.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.416] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=199994) returned 1 [0197.417] CloseHandle (hObject=0x2e8) returned 1 [0197.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0197.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0197.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.417] SetEvent (hEvent=0x29c) returned 1 [0197.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.418] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=9216) returned 1 [0197.418] CloseHandle (hObject=0x2e8) returned 1 [0197.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0197.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0197.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.418] SetEvent (hEvent=0x29c) returned 1 [0197.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.419] CloseHandle (hObject=0x2e8) returned 1 [0197.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0197.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0197.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.419] SetEvent (hEvent=0x29c) returned 1 [0197.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.420] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3072) returned 1 [0197.420] CloseHandle (hObject=0x2e8) returned 1 [0197.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0197.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0197.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.420] SetEvent (hEvent=0x29c) returned 1 [0197.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.421] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3072) returned 1 [0197.421] CloseHandle (hObject=0x2e8) returned 1 [0197.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0197.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0197.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.421] SetEvent (hEvent=0x29c) returned 1 [0197.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.422] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=44032) returned 1 [0197.422] CloseHandle (hObject=0x2e8) returned 1 [0197.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0197.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0197.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.422] SetEvent (hEvent=0x29c) returned 1 [0197.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.423] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=181964) returned 1 [0197.423] CloseHandle (hObject=0x2e8) returned 1 [0197.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0197.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0197.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.423] SetEvent (hEvent=0x29c) returned 1 [0197.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.424] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=5120) returned 1 [0197.424] CloseHandle (hObject=0x2e8) returned 1 [0197.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0197.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0197.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.424] SetEvent (hEvent=0x29c) returned 1 [0197.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.425] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0197.425] CloseHandle (hObject=0x2e8) returned 1 [0197.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0197.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0197.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.426] SetEvent (hEvent=0x29c) returned 1 [0197.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.426] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=25088) returned 1 [0197.426] CloseHandle (hObject=0x2e8) returned 1 [0197.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0197.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0197.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.427] SetEvent (hEvent=0x29c) returned 1 [0197.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.427] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=9728) returned 1 [0197.427] CloseHandle (hObject=0x2e8) returned 1 [0197.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0197.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0197.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.428] SetEvent (hEvent=0x29c) returned 1 [0197.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.428] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3584) returned 1 [0197.428] CloseHandle (hObject=0x2e8) returned 1 [0197.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0197.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0197.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.429] SetEvent (hEvent=0x29c) returned 1 [0197.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.429] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.429] CloseHandle (hObject=0x2e8) returned 1 [0197.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0197.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0197.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.430] SetEvent (hEvent=0x29c) returned 1 [0197.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.431] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.431] CloseHandle (hObject=0x2e8) returned 1 [0197.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0197.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0197.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.431] SetEvent (hEvent=0x29c) returned 1 [0197.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.432] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10752) returned 1 [0197.432] CloseHandle (hObject=0x2e8) returned 1 [0197.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0197.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0197.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.432] SetEvent (hEvent=0x29c) returned 1 [0197.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.433] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10240) returned 1 [0197.433] CloseHandle (hObject=0x2e8) returned 1 [0197.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0197.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0197.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.433] SetEvent (hEvent=0x29c) returned 1 [0197.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.434] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1600388) returned 1 [0197.434] CloseHandle (hObject=0x2e8) returned 1 [0197.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0197.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0197.435] SetEvent (hEvent=0x29c) returned 1 [0197.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.435] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=804864) returned 1 [0197.435] CloseHandle (hObject=0x2e8) returned 1 [0197.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0197.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0197.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.436] SetEvent (hEvent=0x29c) returned 1 [0197.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.436] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=11264) returned 1 [0197.437] CloseHandle (hObject=0x2e8) returned 1 [0197.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0197.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0197.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.437] SetEvent (hEvent=0x29c) returned 1 [0197.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.438] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=11264) returned 1 [0197.438] CloseHandle (hObject=0x2e8) returned 1 [0197.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0197.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0197.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.438] SetEvent (hEvent=0x29c) returned 1 [0197.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.439] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1434) returned 1 [0197.439] CloseHandle (hObject=0x2e8) returned 1 [0197.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0197.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0197.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.439] SetEvent (hEvent=0x29c) returned 1 [0197.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.440] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=212) returned 1 [0197.440] CloseHandle (hObject=0x2e8) returned 1 [0197.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0197.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0197.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.440] SetEvent (hEvent=0x29c) returned 1 [0197.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.441] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=903) returned 1 [0197.441] CloseHandle (hObject=0x2e8) returned 1 [0197.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0197.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0197.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.441] SetEvent (hEvent=0x29c) returned 1 [0197.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.442] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=215) returned 1 [0197.442] CloseHandle (hObject=0x2e8) returned 1 [0197.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0197.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0197.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.442] SetEvent (hEvent=0x29c) returned 1 [0197.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.443] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=384) returned 1 [0197.443] CloseHandle (hObject=0x2e8) returned 1 [0197.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0197.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0197.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.443] SetEvent (hEvent=0x29c) returned 1 [0197.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.444] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=903) returned 1 [0197.444] CloseHandle (hObject=0x2e8) returned 1 [0197.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0197.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0197.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.444] SetEvent (hEvent=0x29c) returned 1 [0197.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.699] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=392) returned 1 [0197.700] CloseHandle (hObject=0x2ec) returned 1 [0197.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0197.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0197.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.700] SetEvent (hEvent=0x29c) returned 1 [0197.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.701] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=367104) returned 1 [0197.701] CloseHandle (hObject=0x2ec) returned 1 [0197.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0197.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0197.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.701] SetEvent (hEvent=0x29c) returned 1 [0197.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.702] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2418) returned 1 [0197.702] CloseHandle (hObject=0x2ec) returned 1 [0197.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0197.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0197.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.703] SetEvent (hEvent=0x29c) returned 1 [0197.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.703] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2592) returned 1 [0197.703] CloseHandle (hObject=0x2ec) returned 1 [0197.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0197.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0197.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.704] SetEvent (hEvent=0x29c) returned 1 [0197.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.704] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2462) returned 1 [0197.704] CloseHandle (hObject=0x2ec) returned 1 [0197.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0197.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0197.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.705] SetEvent (hEvent=0x29c) returned 1 [0197.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.705] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2436) returned 1 [0197.705] CloseHandle (hObject=0x2ec) returned 1 [0197.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0197.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0197.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.706] SetEvent (hEvent=0x29c) returned 1 [0197.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.706] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2556) returned 1 [0197.707] CloseHandle (hObject=0x2ec) returned 1 [0197.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0197.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0197.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.707] SetEvent (hEvent=0x29c) returned 1 [0197.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.708] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2514) returned 1 [0197.708] CloseHandle (hObject=0x2ec) returned 1 [0197.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0197.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0197.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.708] SetEvent (hEvent=0x29c) returned 1 [0197.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.711] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2616) returned 1 [0197.711] CloseHandle (hObject=0x2f8) returned 1 [0197.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0197.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0197.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.711] SetEvent (hEvent=0x29c) returned 1 [0197.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.712] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2618) returned 1 [0197.712] CloseHandle (hObject=0x2f8) returned 1 [0197.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0197.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0197.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.713] SetEvent (hEvent=0x29c) returned 1 [0197.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.713] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2578) returned 1 [0197.713] CloseHandle (hObject=0x2f8) returned 1 [0197.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0197.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0197.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.714] SetEvent (hEvent=0x29c) returned 1 [0197.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.714] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3024) returned 1 [0197.714] CloseHandle (hObject=0x2f8) returned 1 [0197.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0197.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0197.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.715] SetEvent (hEvent=0x29c) returned 1 [0197.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.715] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0197.715] CloseHandle (hObject=0x2f8) returned 1 [0197.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0197.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0197.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.716] SetEvent (hEvent=0x29c) returned 1 [0197.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.716] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2658) returned 1 [0197.716] CloseHandle (hObject=0x2f8) returned 1 [0197.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0197.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0197.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.717] SetEvent (hEvent=0x29c) returned 1 [0197.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.717] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2628) returned 1 [0197.717] CloseHandle (hObject=0x2f8) returned 1 [0197.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0197.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0197.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.718] SetEvent (hEvent=0x29c) returned 1 [0197.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.718] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2532) returned 1 [0197.718] CloseHandle (hObject=0x2f8) returned 1 [0197.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0197.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0197.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.719] SetEvent (hEvent=0x29c) returned 1 [0197.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.719] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2518) returned 1 [0197.719] CloseHandle (hObject=0x2f8) returned 1 [0197.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0197.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0197.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.720] SetEvent (hEvent=0x29c) returned 1 [0197.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.720] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2652) returned 1 [0197.720] CloseHandle (hObject=0x2f8) returned 1 [0197.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0197.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0197.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.721] SetEvent (hEvent=0x29c) returned 1 [0197.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.721] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2570) returned 1 [0197.721] CloseHandle (hObject=0x2f8) returned 1 [0197.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0197.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0197.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.722] SetEvent (hEvent=0x29c) returned 1 [0197.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.722] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2526) returned 1 [0197.722] CloseHandle (hObject=0x2f8) returned 1 [0197.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0197.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0197.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.723] SetEvent (hEvent=0x29c) returned 1 [0197.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.723] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2522) returned 1 [0197.723] CloseHandle (hObject=0x2f8) returned 1 [0197.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0197.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0197.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.724] SetEvent (hEvent=0x29c) returned 1 [0197.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.724] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2568) returned 1 [0197.724] CloseHandle (hObject=0x2f8) returned 1 [0197.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0197.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0197.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.725] SetEvent (hEvent=0x29c) returned 1 [0197.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.725] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=41984) returned 1 [0197.726] CloseHandle (hObject=0x2f8) returned 1 [0197.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0197.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0197.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.726] SetEvent (hEvent=0x29c) returned 1 [0197.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.727] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2626) returned 1 [0197.727] CloseHandle (hObject=0x2f8) returned 1 [0197.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0197.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0197.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.727] SetEvent (hEvent=0x29c) returned 1 [0197.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.728] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2580) returned 1 [0197.728] CloseHandle (hObject=0x2f8) returned 1 [0197.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0197.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0197.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.728] SetEvent (hEvent=0x29c) returned 1 [0197.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.729] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2600) returned 1 [0197.729] CloseHandle (hObject=0x2f8) returned 1 [0197.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0197.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0197.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.729] SetEvent (hEvent=0x29c) returned 1 [0197.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.730] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=125952) returned 1 [0197.730] CloseHandle (hObject=0x2f8) returned 1 [0197.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0197.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0197.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.730] SetEvent (hEvent=0x29c) returned 1 [0197.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.731] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2246) returned 1 [0197.731] CloseHandle (hObject=0x2f8) returned 1 [0197.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0197.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0197.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.731] SetEvent (hEvent=0x29c) returned 1 [0197.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.732] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2240) returned 1 [0197.732] CloseHandle (hObject=0x2f8) returned 1 [0197.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0197.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0197.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.732] SetEvent (hEvent=0x29c) returned 1 [0197.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.733] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2644) returned 1 [0197.733] CloseHandle (hObject=0x2f8) returned 1 [0197.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0197.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0197.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.734] SetEvent (hEvent=0x29c) returned 1 [0197.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.734] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2542) returned 1 [0197.734] CloseHandle (hObject=0x2f8) returned 1 [0197.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0197.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0197.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.735] SetEvent (hEvent=0x29c) returned 1 [0197.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.735] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2568) returned 1 [0197.735] CloseHandle (hObject=0x2f8) returned 1 [0197.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0197.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0197.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.736] SetEvent (hEvent=0x29c) returned 1 [0197.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.736] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2596) returned 1 [0197.736] CloseHandle (hObject=0x2f8) returned 1 [0197.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0197.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0197.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.737] SetEvent (hEvent=0x29c) returned 1 [0197.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0197.962] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2520) returned 1 [0197.963] CloseHandle (hObject=0x304) returned 1 [0197.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0197.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0197.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.963] SetEvent (hEvent=0x29c) returned 1 [0197.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0197.964] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1475160) returned 1 [0197.964] CloseHandle (hObject=0x304) returned 1 [0197.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0197.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0197.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0197.965] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0197.965] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0197.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0197.966] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x110100, lpOverlapped=0x0) returned 1 [0198.000] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x110100, lpOverlapped=0x0) returned 1 [0198.334] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x58158, lpOverlapped=0x0) returned 1 [0198.339] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x58160, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x58160, lpOverlapped=0x0) returned 1 [0198.346] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0198.346] CloseHandle (hObject=0x304) returned 1 [0198.346] CloseHandle (hObject=0x2e4) returned 1 [0198.346] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0198.351] SetEvent (hEvent=0x29c) returned 1 [0198.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.507] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=18624) returned 1 [0198.540] CloseHandle (hObject=0x304) returned 1 [0198.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0198.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0198.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.541] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.541] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0198.541] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x48c0, lpOverlapped=0x0) returned 1 [0198.543] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x48d0, lpOverlapped=0x0) returned 1 [0198.544] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x112, lpOverlapped=0x0) returned 1 [0198.544] CloseHandle (hObject=0x304) returned 1 [0198.544] CloseHandle (hObject=0x308) returned 1 [0198.545] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0198.546] SetEvent (hEvent=0x29c) returned 1 [0198.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.547] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=4734) returned 1 [0198.547] CloseHandle (hObject=0x308) returned 1 [0198.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0198.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0198.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.547] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=232) returned 1 [0198.547] CloseHandle (hObject=0x308) returned 1 [0198.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0198.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0198.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.548] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=10569) returned 1 [0198.548] CloseHandle (hObject=0x308) returned 1 [0198.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0198.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0198.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.549] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=230) returned 1 [0198.549] CloseHandle (hObject=0x308) returned 1 [0198.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0198.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0198.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.549] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.550] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=7505) returned 1 [0198.550] CloseHandle (hObject=0x308) returned 1 [0198.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0198.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0198.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.551] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=990032) returned 1 [0198.551] CloseHandle (hObject=0x308) returned 1 [0198.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0198.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0198.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.551] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.551] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0198.552] ReadFile (in: hFile=0x308, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xf1b50, lpOverlapped=0x0) returned 1 [0198.569] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf1b60, lpOverlapped=0x0) returned 1 [0198.745] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0198.746] CloseHandle (hObject=0x308) returned 1 [0198.746] CloseHandle (hObject=0x304) returned 1 [0198.811] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0198.824] SetEvent (hEvent=0x29c) returned 1 [0198.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.825] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=987136) returned 1 [0198.825] CloseHandle (hObject=0x304) returned 1 [0198.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0198.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0198.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.826] SetEvent (hEvent=0x29c) returned 1 [0198.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.827] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=12448) returned 1 [0198.827] CloseHandle (hObject=0x304) returned 1 [0198.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0198.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0198.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.827] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.827] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0198.830] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x30a0, lpOverlapped=0x0) returned 1 [0198.832] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x30b0, lpOverlapped=0x0) returned 1 [0198.833] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0198.833] CloseHandle (hObject=0x304) returned 1 [0198.833] CloseHandle (hObject=0x308) returned 1 [0198.833] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0198.835] SetEvent (hEvent=0x29c) returned 1 [0198.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.835] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=20608) returned 1 [0198.835] CloseHandle (hObject=0x308) returned 1 [0198.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0198.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0198.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.836] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.836] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0198.837] ReadFile (in: hFile=0x308, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x5080, lpOverlapped=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x5090, lpOverlapped=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0198.841] CloseHandle (hObject=0x308) returned 1 [0198.841] CloseHandle (hObject=0x304) returned 1 [0198.841] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0198.842] SetEvent (hEvent=0x29c) returned 1 [0198.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.843] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=100488) returned 1 [0198.843] CloseHandle (hObject=0x304) returned 1 [0198.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0198.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0198.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0198.843] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.843] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0198.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0198.844] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x18888, lpOverlapped=0x0) returned 1 [0198.995] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x18890, lpOverlapped=0x0) returned 1 [0199.020] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0199.020] CloseHandle (hObject=0x304) returned 1 [0199.020] CloseHandle (hObject=0x308) returned 1 [0199.020] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0199.022] SetEvent (hEvent=0x29c) returned 1 [0199.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.022] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=168064) returned 1 [0199.022] CloseHandle (hObject=0x308) returned 1 [0199.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0199.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0199.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.023] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.023] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0199.025] ReadFile (in: hFile=0x308, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x29080, lpOverlapped=0x0) returned 1 [0199.029] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x29090, lpOverlapped=0x0) returned 1 [0199.032] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0199.033] CloseHandle (hObject=0x308) returned 1 [0199.033] CloseHandle (hObject=0x304) returned 1 [0199.033] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0199.035] SetEvent (hEvent=0x29c) returned 1 [0199.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.036] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=17048) returned 1 [0199.036] CloseHandle (hObject=0x304) returned 1 [0199.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0199.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0199.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.036] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.036] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0199.037] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4298, lpOverlapped=0x0) returned 1 [0199.041] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x42a0, lpOverlapped=0x0) returned 1 [0199.042] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0199.042] CloseHandle (hObject=0x304) returned 1 [0199.042] CloseHandle (hObject=0x308) returned 1 [0199.042] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0199.044] SetEvent (hEvent=0x29c) returned 1 [0199.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.044] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=22680) returned 1 [0199.044] CloseHandle (hObject=0x308) returned 1 [0199.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0199.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0199.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.045] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.045] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0199.045] ReadFile (in: hFile=0x308, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x5898, lpOverlapped=0x0) returned 1 [0199.047] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x58a0, lpOverlapped=0x0) returned 1 [0199.048] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0199.048] CloseHandle (hObject=0x308) returned 1 [0199.048] CloseHandle (hObject=0x304) returned 1 [0199.049] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0199.050] SetEvent (hEvent=0x29c) returned 1 [0199.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.050] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2702) returned 1 [0199.050] CloseHandle (hObject=0x304) returned 1 [0199.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0199.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0199.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.052] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=14856) returned 1 [0199.052] CloseHandle (hObject=0x304) returned 1 [0199.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0199.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0199.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.053] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=15195) returned 1 [0199.053] CloseHandle (hObject=0x304) returned 1 [0199.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0199.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0199.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.054] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=17920) returned 1 [0199.054] CloseHandle (hObject=0x304) returned 1 [0199.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0199.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0199.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.055] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0199.055] CloseHandle (hObject=0x304) returned 1 [0199.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0199.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0199.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.386] SetEvent (hEvent=0x29c) returned 1 [0199.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.386] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=221696) returned 1 [0199.386] CloseHandle (hObject=0x304) returned 1 [0199.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0199.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0199.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.387] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0199.387] CloseHandle (hObject=0x304) returned 1 [0199.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0199.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0199.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.388] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=31744) returned 1 [0199.388] CloseHandle (hObject=0x304) returned 1 [0199.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0199.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0199.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.479] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=6144) returned 1 [0199.479] CloseHandle (hObject=0x304) returned 1 [0199.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0199.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0199.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.479] SetEvent (hEvent=0x29c) returned 1 [0199.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.480] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=44032) returned 1 [0199.480] CloseHandle (hObject=0x304) returned 1 [0199.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0199.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0199.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.481] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=18432) returned 1 [0199.481] CloseHandle (hObject=0x304) returned 1 [0199.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0199.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0199.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.482] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=99840) returned 1 [0199.482] CloseHandle (hObject=0x304) returned 1 [0199.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0199.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0199.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.482] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=376320) returned 1 [0199.482] CloseHandle (hObject=0x304) returned 1 [0199.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0199.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0199.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.483] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=698368) returned 1 [0199.483] CloseHandle (hObject=0x304) returned 1 [0199.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0199.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0199.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.484] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=54784) returned 1 [0199.484] CloseHandle (hObject=0x304) returned 1 [0199.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0199.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0199.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.484] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.485] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=117248) returned 1 [0199.485] CloseHandle (hObject=0x304) returned 1 [0199.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0199.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0199.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.485] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16384) returned 1 [0199.485] CloseHandle (hObject=0x304) returned 1 [0199.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0199.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0199.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.486] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=942080) returned 1 [0199.486] CloseHandle (hObject=0x304) returned 1 [0199.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0199.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0199.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.487] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=77824) returned 1 [0199.487] CloseHandle (hObject=0x304) returned 1 [0199.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0199.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0199.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.488] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=9804) returned 1 [0199.488] CloseHandle (hObject=0x304) returned 1 [0199.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0199.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0199.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.489] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=9975) returned 1 [0199.489] CloseHandle (hObject=0x304) returned 1 [0199.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0199.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0199.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.489] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=868352) returned 1 [0199.489] CloseHandle (hObject=0x304) returned 1 [0199.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0199.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0199.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.490] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=4608) returned 1 [0199.490] CloseHandle (hObject=0x304) returned 1 [0199.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0199.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0199.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.493] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=326144) returned 1 [0199.493] CloseHandle (hObject=0x304) returned 1 [0199.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0199.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0199.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.494] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0199.494] CloseHandle (hObject=0x304) returned 1 [0199.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0199.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0199.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.495] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=854528) returned 1 [0199.495] CloseHandle (hObject=0x304) returned 1 [0199.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0199.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0199.495] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.496] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=964096) returned 1 [0199.496] CloseHandle (hObject=0x304) returned 1 [0199.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0199.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0199.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.496] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=174) returned 1 [0199.496] CloseHandle (hObject=0x304) returned 1 [0199.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0199.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0199.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.497] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.497] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x308 [0199.497] ReadFile (in: hFile=0x304, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xae, lpOverlapped=0x0) returned 1 [0199.498] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xb0, lpOverlapped=0x0) returned 1 [0199.499] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0199.499] CloseHandle (hObject=0x304) returned 1 [0199.500] CloseHandle (hObject=0x308) returned 1 [0199.500] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0199.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.502] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=80384) returned 1 [0199.502] CloseHandle (hObject=0x308) returned 1 [0199.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe")) returned 0x20 [0199.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe")) returned 0x20 [0199.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.502] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.502] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0199.503] ReadFile (in: hFile=0x308, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x13a00, lpOverlapped=0x0) returned 1 [0199.505] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x13a10, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x13a10, lpOverlapped=0x0) returned 1 [0199.507] WriteFile (in: hFile=0x304, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x112, lpOverlapped=0x0) returned 1 [0199.508] CloseHandle (hObject=0x308) returned 1 [0199.508] CloseHandle (hObject=0x304) returned 1 [0199.508] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\appointment_impressed.exe" (normalized: "c:\\program files\\internet explorer\\appointment_impressed.exe")) returned 1 [0199.509] SetEvent (hEvent=0x29c) returned 1 [0199.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.510] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0199.510] CloseHandle (hObject=0x304) returned 1 [0199.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0199.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0199.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.510] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.511] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=2560) returned 1 [0199.511] CloseHandle (hObject=0x304) returned 1 [0199.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0199.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0199.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.511] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=5632) returned 1 [0199.511] CloseHandle (hObject=0x304) returned 1 [0199.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0199.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0199.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.512] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=53248) returned 1 [0199.512] CloseHandle (hObject=0x304) returned 1 [0199.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0199.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0199.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.513] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=80384) returned 1 [0199.513] CloseHandle (hObject=0x304) returned 1 [0199.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe")) returned 0x20 [0199.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe")) returned 0x20 [0199.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0199.885] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.885] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0199.886] ReadFile (in: hFile=0x2e0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x13a00, lpOverlapped=0x0) returned 1 [0199.889] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x13a10, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x13a10, lpOverlapped=0x0) returned 1 [0199.891] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0199.891] CloseHandle (hObject=0x2e0) returned 1 [0199.891] CloseHandle (hObject=0x2f4) returned 1 [0199.891] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\foxmailincmail.exe" (normalized: "c:\\program files\\internet explorer\\foxmailincmail.exe")) returned 1 [0199.893] SetEvent (hEvent=0x29c) returned 1 [0199.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0199.893] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16960) returned 1 [0199.893] CloseHandle (hObject=0x2f4) returned 1 [0199.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0199.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0199.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0199.894] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.894] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e0 [0199.895] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4240, lpOverlapped=0x0) returned 1 [0199.897] WriteFile (in: hFile=0x2e0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4250, lpOverlapped=0x0) returned 1 [0199.899] WriteFile (in: hFile=0x2e0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe2, lpOverlapped=0x0) returned 1 [0199.899] CloseHandle (hObject=0x2f4) returned 1 [0199.899] CloseHandle (hObject=0x2e0) returned 1 [0199.899] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0199.900] SetEvent (hEvent=0x29c) returned 1 [0199.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0199.901] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=159808) returned 1 [0199.901] CloseHandle (hObject=0x2e0) returned 1 [0199.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0199.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0199.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0199.901] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.901] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0199.902] ReadFile (in: hFile=0x2e0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x27040, lpOverlapped=0x0) returned 1 [0199.905] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x27050, lpOverlapped=0x0) returned 1 [0199.909] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0199.909] CloseHandle (hObject=0x2e0) returned 1 [0199.909] CloseHandle (hObject=0x2f4) returned 1 [0199.909] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0199.911] SetEvent (hEvent=0x29c) returned 1 [0199.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0199.911] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=86080) returned 1 [0199.911] CloseHandle (hObject=0x2f4) returned 1 [0199.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0199.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0199.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0199.912] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.912] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e0 [0199.912] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x15040, lpOverlapped=0x0) returned 1 [0199.918] WriteFile (in: hFile=0x2e0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x15050, lpOverlapped=0x0) returned 1 [0199.920] WriteFile (in: hFile=0x2e0, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0199.920] CloseHandle (hObject=0x2f4) returned 1 [0199.920] CloseHandle (hObject=0x2e0) returned 1 [0199.920] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0199.922] SetEvent (hEvent=0x29c) returned 1 [0199.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0199.922] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=587840) returned 1 [0199.922] CloseHandle (hObject=0x2e0) returned 1 [0199.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0199.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0199.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0199.922] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.923] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0199.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0199.923] ReadFile (in: hFile=0x2e0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x8f840, lpOverlapped=0x0) returned 1 [0200.140] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x8f850, lpOverlapped=0x0) returned 1 [0200.152] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0200.152] CloseHandle (hObject=0x2e0) returned 1 [0200.152] CloseHandle (hObject=0x2f4) returned 1 [0200.153] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0200.159] SetEvent (hEvent=0x29c) returned 1 [0200.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0200.160] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1026112) returned 1 [0200.160] CloseHandle (hObject=0x2f4) returned 1 [0200.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0200.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0200.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0200.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0200.160] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0200.160] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0200.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0200.681] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xfa840, lpOverlapped=0x0) returned 1 [0200.699] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xfa850, lpOverlapped=0x0) returned 1 [0200.718] WriteFile (in: hFile=0x308, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0200.718] CloseHandle (hObject=0x2f4) returned 1 [0200.718] CloseHandle (hObject=0x308) returned 1 [0200.718] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0201.087] SetEvent (hEvent=0x29c) returned 1 [0201.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.088] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=29760) returned 1 [0201.088] CloseHandle (hObject=0x2f8) returned 1 [0201.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0201.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0201.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.089] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.089] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0201.090] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x7440, lpOverlapped=0x0) returned 1 [0201.092] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x7450, lpOverlapped=0x0) returned 1 [0201.093] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.094] CloseHandle (hObject=0x2f8) returned 1 [0201.094] CloseHandle (hObject=0x2f4) returned 1 [0201.094] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0201.095] SetEvent (hEvent=0x29c) returned 1 [0201.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.096] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=24640) returned 1 [0201.096] CloseHandle (hObject=0x2f4) returned 1 [0201.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0201.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0201.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.096] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.096] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0201.097] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x6040, lpOverlapped=0x0) returned 1 [0201.099] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x6050, lpOverlapped=0x0) returned 1 [0201.100] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.100] CloseHandle (hObject=0x2f4) returned 1 [0201.101] CloseHandle (hObject=0x2f8) returned 1 [0201.101] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0201.102] SetEvent (hEvent=0x29c) returned 1 [0201.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.103] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=136256) returned 1 [0201.103] CloseHandle (hObject=0x2f8) returned 1 [0201.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0201.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0201.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.103] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.103] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0201.104] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x21440, lpOverlapped=0x0) returned 1 [0201.107] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x21450, lpOverlapped=0x0) returned 1 [0201.110] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.111] CloseHandle (hObject=0x2f8) returned 1 [0201.111] CloseHandle (hObject=0x2f4) returned 1 [0201.111] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0201.113] SetEvent (hEvent=0x29c) returned 1 [0201.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.113] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=274496) returned 1 [0201.113] CloseHandle (hObject=0x2f4) returned 1 [0201.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0201.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0201.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.114] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.114] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0201.114] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x43040, lpOverlapped=0x0) returned 1 [0201.129] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x43050, lpOverlapped=0x0) returned 1 [0201.496] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.496] CloseHandle (hObject=0x2f4) returned 1 [0201.496] CloseHandle (hObject=0x2f8) returned 1 [0201.511] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0201.515] SetEvent (hEvent=0x29c) returned 1 [0201.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.516] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=619584) returned 1 [0201.516] CloseHandle (hObject=0x2f8) returned 1 [0201.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0201.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0201.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.516] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.516] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0201.517] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x97440, lpOverlapped=0x0) returned 1 [0201.529] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x97450, lpOverlapped=0x0) returned 1 [0201.744] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0201.744] CloseHandle (hObject=0x2f8) returned 1 [0201.744] CloseHandle (hObject=0x2f4) returned 1 [0201.744] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0201.751] SetEvent (hEvent=0x29c) returned 1 [0201.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.751] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=19008) returned 1 [0201.752] CloseHandle (hObject=0x2f4) returned 1 [0201.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0201.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0201.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.752] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.752] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0201.753] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4a40, lpOverlapped=0x0) returned 1 [0201.755] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4a50, lpOverlapped=0x0) returned 1 [0201.756] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.756] CloseHandle (hObject=0x2f4) returned 1 [0201.756] CloseHandle (hObject=0x2f8) returned 1 [0201.756] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0201.757] SetEvent (hEvent=0x29c) returned 1 [0201.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.758] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=63552) returned 1 [0201.758] CloseHandle (hObject=0x2f8) returned 1 [0201.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0201.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0201.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.758] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.758] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0201.761] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xf840, lpOverlapped=0x0) returned 1 [0201.763] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf850, lpOverlapped=0x0) returned 1 [0201.765] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.765] CloseHandle (hObject=0x2f8) returned 1 [0201.765] CloseHandle (hObject=0x2f4) returned 1 [0201.765] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0201.767] SetEvent (hEvent=0x29c) returned 1 [0201.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.767] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=21056) returned 1 [0201.767] CloseHandle (hObject=0x2f4) returned 1 [0201.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0201.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0201.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.768] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.768] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0201.768] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x5240, lpOverlapped=0x0) returned 1 [0201.770] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x5250, lpOverlapped=0x0) returned 1 [0201.771] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.771] CloseHandle (hObject=0x2f4) returned 1 [0201.771] CloseHandle (hObject=0x2f8) returned 1 [0201.772] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0201.773] SetEvent (hEvent=0x29c) returned 1 [0201.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.773] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=34368) returned 1 [0201.773] CloseHandle (hObject=0x2f8) returned 1 [0201.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0201.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0201.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0201.774] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.774] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0201.803] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x8640, lpOverlapped=0x0) returned 1 [0201.806] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x8650, lpOverlapped=0x0) returned 1 [0201.807] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0201.807] CloseHandle (hObject=0x2f8) returned 1 [0201.807] CloseHandle (hObject=0x2f4) returned 1 [0201.807] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0201.809] SetEvent (hEvent=0x29c) returned 1 [0201.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.809] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=15936) returned 1 [0201.809] CloseHandle (hObject=0x2f4) returned 1 [0201.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0201.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0201.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0201.810] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.810] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0201.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0201.810] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3e40, lpOverlapped=0x0) returned 1 [0202.089] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3e50, lpOverlapped=0x0) returned 1 [0202.090] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.090] CloseHandle (hObject=0x2f4) returned 1 [0202.090] CloseHandle (hObject=0x2f8) returned 1 [0202.090] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0202.092] SetEvent (hEvent=0x29c) returned 1 [0202.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.093] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=80448) returned 1 [0202.093] CloseHandle (hObject=0x2f8) returned 1 [0202.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0202.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0202.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.093] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.093] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.094] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x13a40, lpOverlapped=0x0) returned 1 [0202.096] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x13a50, lpOverlapped=0x0) returned 1 [0202.098] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.098] CloseHandle (hObject=0x2f8) returned 1 [0202.098] CloseHandle (hObject=0x2f4) returned 1 [0202.098] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0202.101] SetEvent (hEvent=0x29c) returned 1 [0202.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.101] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=69184) returned 1 [0202.101] CloseHandle (hObject=0x2f4) returned 1 [0202.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0202.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0202.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.102] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.102] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.102] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x10e40, lpOverlapped=0x0) returned 1 [0202.116] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x10e50, lpOverlapped=0x0) returned 1 [0202.118] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.127] CloseHandle (hObject=0x2f4) returned 1 [0202.127] CloseHandle (hObject=0x2f8) returned 1 [0202.127] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0202.129] SetEvent (hEvent=0x29c) returned 1 [0202.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.130] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=538176) returned 1 [0202.130] CloseHandle (hObject=0x2f8) returned 1 [0202.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0202.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0202.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.130] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.130] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.131] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x83640, lpOverlapped=0x0) returned 1 [0202.158] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x83650, lpOverlapped=0x0) returned 1 [0202.388] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0202.388] CloseHandle (hObject=0x2f8) returned 1 [0202.388] CloseHandle (hObject=0x2f4) returned 1 [0202.388] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0202.394] SetEvent (hEvent=0x29c) returned 1 [0202.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.394] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=29760) returned 1 [0202.394] CloseHandle (hObject=0x2f4) returned 1 [0202.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0202.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0202.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.395] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.395] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.396] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x7440, lpOverlapped=0x0) returned 1 [0202.398] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x7450, lpOverlapped=0x0) returned 1 [0202.399] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0202.399] CloseHandle (hObject=0x2f4) returned 1 [0202.399] CloseHandle (hObject=0x2f8) returned 1 [0202.399] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0202.401] SetEvent (hEvent=0x29c) returned 1 [0202.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.401] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=14400) returned 1 [0202.401] CloseHandle (hObject=0x2f8) returned 1 [0202.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0202.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0202.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.402] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.402] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.402] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3840, lpOverlapped=0x0) returned 1 [0202.404] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3850, lpOverlapped=0x0) returned 1 [0202.405] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.405] CloseHandle (hObject=0x2f8) returned 1 [0202.405] CloseHandle (hObject=0x2f4) returned 1 [0202.405] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0202.406] SetEvent (hEvent=0x29c) returned 1 [0202.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.407] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=15424) returned 1 [0202.407] CloseHandle (hObject=0x2f4) returned 1 [0202.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0202.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0202.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.407] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.407] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.408] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3c40, lpOverlapped=0x0) returned 1 [0202.410] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3c50, lpOverlapped=0x0) returned 1 [0202.411] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0202.411] CloseHandle (hObject=0x2f4) returned 1 [0202.411] CloseHandle (hObject=0x2f8) returned 1 [0202.411] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0202.412] SetEvent (hEvent=0x29c) returned 1 [0202.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.414] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=201792) returned 1 [0202.414] CloseHandle (hObject=0x2f8) returned 1 [0202.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0202.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0202.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.414] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.414] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.415] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x31440, lpOverlapped=0x0) returned 1 [0202.419] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x31450, lpOverlapped=0x0) returned 1 [0202.423] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.423] CloseHandle (hObject=0x2f8) returned 1 [0202.423] CloseHandle (hObject=0x2f4) returned 1 [0202.423] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0202.426] SetEvent (hEvent=0x29c) returned 1 [0202.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.426] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=26688) returned 1 [0202.426] CloseHandle (hObject=0x2f4) returned 1 [0202.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0202.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0202.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.427] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.427] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.427] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x6840, lpOverlapped=0x0) returned 1 [0202.604] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x6850, lpOverlapped=0x0) returned 1 [0202.605] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe2, lpOverlapped=0x0) returned 1 [0202.605] CloseHandle (hObject=0x2f4) returned 1 [0202.605] CloseHandle (hObject=0x2f8) returned 1 [0202.606] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0202.607] SetEvent (hEvent=0x29c) returned 1 [0202.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.609] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=15936) returned 1 [0202.609] CloseHandle (hObject=0x2f8) returned 1 [0202.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0202.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0202.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.610] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.610] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.611] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3e40, lpOverlapped=0x0) returned 1 [0202.612] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3e50, lpOverlapped=0x0) returned 1 [0202.613] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe2, lpOverlapped=0x0) returned 1 [0202.613] CloseHandle (hObject=0x2f8) returned 1 [0202.614] CloseHandle (hObject=0x2f4) returned 1 [0202.614] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0202.615] SetEvent (hEvent=0x29c) returned 1 [0202.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.615] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=174656) returned 1 [0202.615] CloseHandle (hObject=0x2f4) returned 1 [0202.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0202.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0202.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.616] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.616] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.616] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x2aa40, lpOverlapped=0x0) returned 1 [0202.621] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x2aa50, lpOverlapped=0x0) returned 1 [0202.625] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe2, lpOverlapped=0x0) returned 1 [0202.625] CloseHandle (hObject=0x2f4) returned 1 [0202.625] CloseHandle (hObject=0x2f8) returned 1 [0202.625] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0202.627] SetEvent (hEvent=0x29c) returned 1 [0202.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.628] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=296000) returned 1 [0202.628] CloseHandle (hObject=0x2f8) returned 1 [0202.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0202.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0202.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.628] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.628] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.629] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x48440, lpOverlapped=0x0) returned 1 [0202.636] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x48450, lpOverlapped=0x0) returned 1 [0202.641] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.642] CloseHandle (hObject=0x2f8) returned 1 [0202.642] CloseHandle (hObject=0x2f4) returned 1 [0202.642] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0202.645] SetEvent (hEvent=0x29c) returned 1 [0202.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.646] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=112192) returned 1 [0202.646] CloseHandle (hObject=0x2f4) returned 1 [0202.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0202.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0202.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.646] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.646] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.647] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x1b640, lpOverlapped=0x0) returned 1 [0202.891] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x1b650, lpOverlapped=0x0) returned 1 [0202.894] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.895] CloseHandle (hObject=0x2f4) returned 1 [0202.895] CloseHandle (hObject=0x2f8) returned 1 [0202.895] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0202.897] SetEvent (hEvent=0x29c) returned 1 [0202.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.897] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=20032) returned 1 [0202.897] CloseHandle (hObject=0x2f8) returned 1 [0202.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0202.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0202.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.898] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.898] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.899] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4e40, lpOverlapped=0x0) returned 1 [0202.900] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4e50, lpOverlapped=0x0) returned 1 [0202.902] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.902] CloseHandle (hObject=0x2f8) returned 1 [0202.902] CloseHandle (hObject=0x2f4) returned 1 [0202.902] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0202.903] SetEvent (hEvent=0x29c) returned 1 [0202.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.904] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=235584) returned 1 [0202.904] CloseHandle (hObject=0x2f4) returned 1 [0202.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0202.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0202.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0202.904] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.904] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0202.905] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x39840, lpOverlapped=0x0) returned 1 [0202.909] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x39850, lpOverlapped=0x0) returned 1 [0202.913] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0202.914] CloseHandle (hObject=0x2f4) returned 1 [0202.914] CloseHandle (hObject=0x2f8) returned 1 [0202.914] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0202.916] SetEvent (hEvent=0x29c) returned 1 [0202.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.916] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=185920) returned 1 [0202.917] CloseHandle (hObject=0x2f8) returned 1 [0202.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0202.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0202.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0202.917] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.917] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0202.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0202.918] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x2d640, lpOverlapped=0x0) returned 1 [0202.922] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x2d650, lpOverlapped=0x0) returned 1 [0203.032] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.032] CloseHandle (hObject=0x2f8) returned 1 [0203.032] CloseHandle (hObject=0x2f4) returned 1 [0203.032] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0203.035] SetEvent (hEvent=0x29c) returned 1 [0203.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.035] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16448) returned 1 [0203.035] CloseHandle (hObject=0x2f4) returned 1 [0203.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0203.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0203.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.036] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.036] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0203.042] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4040, lpOverlapped=0x0) returned 1 [0203.044] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4050, lpOverlapped=0x0) returned 1 [0203.045] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.045] CloseHandle (hObject=0x2f4) returned 1 [0203.045] CloseHandle (hObject=0x2f8) returned 1 [0203.045] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0203.046] SetEvent (hEvent=0x29c) returned 1 [0203.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0203.047] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16448) returned 1 [0203.047] CloseHandle (hObject=0x2f8) returned 1 [0203.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0203.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0203.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0203.047] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.047] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.048] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4040, lpOverlapped=0x0) returned 1 [0203.050] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4050, lpOverlapped=0x0) returned 1 [0203.051] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.051] CloseHandle (hObject=0x2f8) returned 1 [0203.051] CloseHandle (hObject=0x2f4) returned 1 [0203.052] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0203.053] SetEvent (hEvent=0x29c) returned 1 [0203.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.053] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16448) returned 1 [0203.053] CloseHandle (hObject=0x2f4) returned 1 [0203.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0203.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0203.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.054] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.054] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0203.054] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4040, lpOverlapped=0x0) returned 1 [0203.056] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4050, lpOverlapped=0x0) returned 1 [0203.057] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.057] CloseHandle (hObject=0x2f4) returned 1 [0203.057] CloseHandle (hObject=0x2f8) returned 1 [0203.057] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0203.059] SetEvent (hEvent=0x29c) returned 1 [0203.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0203.059] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=233536) returned 1 [0203.059] CloseHandle (hObject=0x2f8) returned 1 [0203.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0203.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0203.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0203.060] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.060] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.060] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x39040, lpOverlapped=0x0) returned 1 [0203.066] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x39050, lpOverlapped=0x0) returned 1 [0203.071] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.071] CloseHandle (hObject=0x2f8) returned 1 [0203.071] CloseHandle (hObject=0x2f4) returned 1 [0203.071] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0203.073] SetEvent (hEvent=0x29c) returned 1 [0203.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.074] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=36928) returned 1 [0203.074] CloseHandle (hObject=0x2f4) returned 1 [0203.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0203.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0203.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.074] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.074] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0203.075] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x9040, lpOverlapped=0x0) returned 1 [0203.231] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x9050, lpOverlapped=0x0) returned 1 [0203.234] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.234] CloseHandle (hObject=0x2f4) returned 1 [0203.234] CloseHandle (hObject=0x2f8) returned 1 [0203.235] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0203.236] SetEvent (hEvent=0x29c) returned 1 [0203.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0203.237] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=829264) returned 1 [0203.237] CloseHandle (hObject=0x2f8) returned 1 [0203.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0203.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0203.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0203.238] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.238] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.238] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xca750, lpOverlapped=0x0) returned 1 [0203.254] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xca760, lpOverlapped=0x0) returned 1 [0203.269] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.269] CloseHandle (hObject=0x2f8) returned 1 [0203.269] CloseHandle (hObject=0x2f4) returned 1 [0203.269] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0203.437] SetEvent (hEvent=0x29c) returned 1 [0203.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.490] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=963232) returned 1 [0203.490] CloseHandle (hObject=0x2f0) returned 1 [0203.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0203.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0203.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.490] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.490] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.491] ReadFile (in: hFile=0x2f0, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xeb2a0, lpOverlapped=0x0) returned 1 [0203.508] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xeb2b0, lpOverlapped=0x0) returned 1 [0203.526] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.526] CloseHandle (hObject=0x2f0) returned 1 [0203.526] CloseHandle (hObject=0x2f4) returned 1 [0203.526] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0203.619] SetEvent (hEvent=0x29c) returned 1 [0203.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.633] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=60480) returned 1 [0203.633] CloseHandle (hObject=0x2dc) returned 1 [0203.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0203.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0203.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.646] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.646] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.647] ReadFile (in: hFile=0x2dc, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xec40, lpOverlapped=0x0) returned 1 [0203.650] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xec50, lpOverlapped=0x0) returned 1 [0203.652] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe2, lpOverlapped=0x0) returned 1 [0203.652] CloseHandle (hObject=0x2dc) returned 1 [0203.652] CloseHandle (hObject=0x2f4) returned 1 [0203.652] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0203.654] SetEvent (hEvent=0x29c) returned 1 [0203.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.654] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=234560) returned 1 [0203.654] CloseHandle (hObject=0x2f4) returned 1 [0203.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0203.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0203.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.655] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.655] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0203.657] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x39440, lpOverlapped=0x0) returned 1 [0203.661] WriteFile (in: hFile=0x2dc, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x39450, lpOverlapped=0x0) returned 1 [0203.666] WriteFile (in: hFile=0x2dc, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.666] CloseHandle (hObject=0x2f4) returned 1 [0203.666] CloseHandle (hObject=0x2dc) returned 1 [0203.666] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0203.668] SetEvent (hEvent=0x29c) returned 1 [0203.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.669] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16448) returned 1 [0203.669] CloseHandle (hObject=0x2dc) returned 1 [0203.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0203.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0203.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.669] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.670] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.670] ReadFile (in: hFile=0x2dc, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4040, lpOverlapped=0x0) returned 1 [0203.672] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4050, lpOverlapped=0x0) returned 1 [0203.673] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.673] CloseHandle (hObject=0x2dc) returned 1 [0203.673] CloseHandle (hObject=0x2f4) returned 1 [0203.673] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0203.675] SetEvent (hEvent=0x29c) returned 1 [0203.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.675] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=57408) returned 1 [0203.675] CloseHandle (hObject=0x2f4) returned 1 [0203.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0203.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0203.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.675] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.676] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0203.676] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xe040, lpOverlapped=0x0) returned 1 [0203.846] WriteFile (in: hFile=0x2dc, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe050, lpOverlapped=0x0) returned 1 [0203.848] WriteFile (in: hFile=0x2dc, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0203.848] CloseHandle (hObject=0x2f4) returned 1 [0203.848] CloseHandle (hObject=0x2dc) returned 1 [0203.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0203.879] SetEvent (hEvent=0x29c) returned 1 [0203.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.898] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=130624) returned 1 [0203.898] CloseHandle (hObject=0x2dc) returned 1 [0203.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0203.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0203.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.899] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.899] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0203.914] ReadFile (in: hFile=0x2dc, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x1fe40, lpOverlapped=0x0) returned 1 [0203.929] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x1fe50, lpOverlapped=0x0) returned 1 [0203.932] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.932] CloseHandle (hObject=0x2dc) returned 1 [0203.932] CloseHandle (hObject=0x2e4) returned 1 [0203.932] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0203.934] SetEvent (hEvent=0x29c) returned 1 [0203.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.935] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=15424) returned 1 [0203.935] CloseHandle (hObject=0x2e4) returned 1 [0203.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0203.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0203.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.936] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.936] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0203.936] ReadFile (in: hFile=0x2e4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3c40, lpOverlapped=0x0) returned 1 [0203.946] WriteFile (in: hFile=0x2dc, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3c50, lpOverlapped=0x0) returned 1 [0203.948] WriteFile (in: hFile=0x2dc, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.948] CloseHandle (hObject=0x2e4) returned 1 [0203.948] CloseHandle (hObject=0x2dc) returned 1 [0203.948] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0203.949] SetEvent (hEvent=0x29c) returned 1 [0203.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.950] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16448) returned 1 [0203.950] CloseHandle (hObject=0x2dc) returned 1 [0203.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0203.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0203.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.951] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.951] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0203.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0203.951] ReadFile (in: hFile=0x2dc, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4040, lpOverlapped=0x0) returned 1 [0203.982] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4050, lpOverlapped=0x0) returned 1 [0203.983] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0203.983] CloseHandle (hObject=0x2dc) returned 1 [0203.983] CloseHandle (hObject=0x2e4) returned 1 [0203.983] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0203.985] SetEvent (hEvent=0x29c) returned 1 [0203.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.985] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=8809536) returned 1 [0203.985] CloseHandle (hObject=0x2e4) returned 1 [0203.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0203.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0203.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.990] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0203.990] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0203.991] ReadFile (in: hFile=0x2e4, lpBuffer=0x3936058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3936058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0203.994] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0203.994] ReadFile (in: hFile=0x2e4, lpBuffer=0x3976058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3976058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0204.108] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0204.108] ReadFile (in: hFile=0x2e4, lpBuffer=0x39b6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x39b6058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0204.121] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f830 | out: lpNewFilePointer=0x0) returned 1 [0204.131] WriteFile (in: hFile=0x2e4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xc0102, lpOverlapped=0x0) returned 1 [0204.150] SetEndOfFile (hFile=0x2e4) returned 1 [0204.150] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0204.150] WriteFile (in: hFile=0x2e4, lpBuffer=0x39f613a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f613a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0204.284] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0204.284] WriteFile (in: hFile=0x2e4, lpBuffer=0x39f613a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f613a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0204.313] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c8 | out: lpNewFilePointer=0x0) returned 1 [0204.313] WriteFile (in: hFile=0x2e4, lpBuffer=0x39f613a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x356f6d4, lpOverlapped=0x0 | out: lpBuffer=0x39f613a*, lpNumberOfBytesWritten=0x356f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0204.314] CloseHandle (hObject=0x2e4) returned 1 [0204.314] SetEvent (hEvent=0x29c) returned 1 [0204.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.542] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=70208) returned 1 [0204.542] CloseHandle (hObject=0x2f4) returned 1 [0204.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0204.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0204.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.543] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.543] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.543] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x11240, lpOverlapped=0x0) returned 1 [0204.585] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x11250, lpOverlapped=0x0) returned 1 [0204.587] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0204.587] CloseHandle (hObject=0x2f4) returned 1 [0204.587] CloseHandle (hObject=0x2f8) returned 1 [0204.587] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0204.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.589] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=255040) returned 1 [0204.589] CloseHandle (hObject=0x2f8) returned 1 [0204.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0204.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0204.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.589] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.590] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0204.836] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x3e440, lpOverlapped=0x0) returned 1 [0204.842] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x3e450, lpOverlapped=0x0) returned 1 [0204.847] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xe2, lpOverlapped=0x0) returned 1 [0204.847] CloseHandle (hObject=0x2f8) returned 1 [0204.847] CloseHandle (hObject=0x2f4) returned 1 [0204.847] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0204.850] SetEvent (hEvent=0x29c) returned 1 [0204.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.850] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=16448) returned 1 [0204.850] CloseHandle (hObject=0x2f4) returned 1 [0204.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0204.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0204.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.851] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.851] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.851] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x4040, lpOverlapped=0x0) returned 1 [0204.854] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x4050, lpOverlapped=0x0) returned 1 [0204.855] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0204.855] CloseHandle (hObject=0x2f4) returned 1 [0204.855] CloseHandle (hObject=0x2f8) returned 1 [0204.855] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0204.857] SetEvent (hEvent=0x29c) returned 1 [0204.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.857] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=79936) returned 1 [0204.857] CloseHandle (hObject=0x2f8) returned 1 [0204.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0204.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0204.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.858] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.858] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0204.858] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x13840, lpOverlapped=0x0) returned 1 [0204.861] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x13850, lpOverlapped=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0204.863] CloseHandle (hObject=0x2f8) returned 1 [0204.863] CloseHandle (hObject=0x2f4) returned 1 [0204.864] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1 [0204.865] SetEvent (hEvent=0x29c) returned 1 [0204.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.866] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=49216) returned 1 [0204.866] CloseHandle (hObject=0x2f4) returned 1 [0204.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0204.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0204.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.866] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.866] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0204.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.867] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0xc040, lpOverlapped=0x0) returned 1 [0204.869] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xc050, lpOverlapped=0x0) returned 1 [0204.871] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0204.871] CloseHandle (hObject=0x2f4) returned 1 [0204.871] CloseHandle (hObject=0x2f8) returned 1 [0204.965] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1 [0204.986] SetEvent (hEvent=0x29c) returned 1 [0204.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0205.012] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=192576) returned 1 [0205.012] CloseHandle (hObject=0x2f4) returned 1 [0205.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0205.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0205.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0205.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0205.233] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0205.233] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0205.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0205.234] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x2f040, lpOverlapped=0x0) returned 1 [0205.240] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x2f050, lpOverlapped=0x0) returned 1 [0205.244] WriteFile (in: hFile=0x2f8, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0xf2, lpOverlapped=0x0) returned 1 [0205.244] CloseHandle (hObject=0x2f4) returned 1 [0205.244] CloseHandle (hObject=0x2f8) returned 1 [0205.244] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 1 [0205.246] SetEvent (hEvent=0x29c) returned 1 [0205.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0205.247] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=1378) returned 1 [0205.247] CloseHandle (hObject=0x2f8) returned 1 [0205.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0205.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0205.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0205.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0205.247] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0205.248] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f838 | out: lpNewFilePointer=0x0) returned 1 [0205.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0205.248] ReadFile (in: hFile=0x2f8, lpBuffer=0x3936020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x356f844, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesRead=0x356f844*=0x562, lpOverlapped=0x0) returned 1 [0205.249] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x570, lpOverlapped=0x0) returned 1 [0205.250] WriteFile (in: hFile=0x2f4, lpBuffer=0x3936020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x356f828, lpOverlapped=0x0 | out: lpBuffer=0x3936020*, lpNumberOfBytesWritten=0x356f828*=0x102, lpOverlapped=0x0) returned 1 [0205.250] CloseHandle (hObject=0x2f8) returned 1 [0205.250] CloseHandle (hObject=0x2f4) returned 1 [0205.250] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0205.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0205.251] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x356f870 | out: lpFileSize=0x356f870*=3036922) returned 1 [0205.252] CloseHandle (hObject=0x2f4) returned 1 [0205.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0205.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0205.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0205.253] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0205.253] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0205.253] ReadFile (in: hFile=0x2f4, lpBuffer=0x3936058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3936058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0205.256] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0205.256] ReadFile (in: hFile=0x2f4, lpBuffer=0x3976058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3976058*, lpNumberOfBytesRead=0x356f6cc*=0x40000, lpOverlapped=0x0) returned 1 [0205.266] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x356f6c0 | out: lpNewFilePointer=0x0) returned 1 [0205.266] ReadFile (hFile=0x2f4, lpBuffer=0x39b6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x356f6cc, lpOverlapped=0x0) Thread: id = 112 os_tid = 0xc2c [0192.215] GetProcessHeap () returned 0xb40000 [0192.215] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3a50048 [0192.215] GetProcessHeap () returned 0xb40000 [0192.215] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3a60050 [0192.216] GetProcessHeap () returned 0xb40000 [0192.216] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb636a0 [0192.216] GetProcessHeap () returned 0xb40000 [0192.216] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x110102) returned 0x3b52020 [0192.219] GetProcessHeap () returned 0xb40000 [0192.219] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb4a9b8 [0192.219] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0192.219] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0192.219] Wow64DisableWow64FsRedirection (in: OldValue=0x36af95c | out: OldValue=0x36af95c*=0x0) returned 1 [0192.219] GetProcessHeap () returned 0xb40000 [0192.219] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a9b8 | out: hHeap=0xb40000) returned 1 [0192.219] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.516] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.517] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=0) returned 1 [0192.517] CloseHandle (hObject=0x2dc) returned 1 [0192.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.521] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=0) returned 1 [0192.521] CloseHandle (hObject=0x2dc) returned 1 [0192.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.521] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=77664) returned 1 [0192.521] CloseHandle (hObject=0x2dc) returned 1 [0192.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0192.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0192.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.522] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.523] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=95648) returned 1 [0192.523] CloseHandle (hObject=0x2dc) returned 1 [0192.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0192.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0192.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.523] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.523] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.523] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=99744) returned 1 [0192.524] CloseHandle (hObject=0x2dc) returned 1 [0192.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0192.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0192.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.524] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76632) returned 1 [0192.524] CloseHandle (hObject=0x2dc) returned 1 [0192.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0192.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0192.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.525] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45472) returned 1 [0192.525] CloseHandle (hObject=0x2dc) returned 1 [0192.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0192.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0192.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.526] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=75616) returned 1 [0192.526] CloseHandle (hObject=0x2dc) returned 1 [0192.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0192.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0192.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.527] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45472) returned 1 [0192.527] CloseHandle (hObject=0x2dc) returned 1 [0192.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0192.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0192.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.527] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=79200) returned 1 [0192.527] CloseHandle (hObject=0x2dc) returned 1 [0192.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0192.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0192.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.528] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45984) returned 1 [0192.528] CloseHandle (hObject=0x2dc) returned 1 [0192.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0192.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0192.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.529] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=80224) returned 1 [0192.529] CloseHandle (hObject=0x2dc) returned 1 [0192.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0192.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0192.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.530] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=46496) returned 1 [0192.530] CloseHandle (hObject=0x2dc) returned 1 [0192.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0192.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0192.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.530] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=74072) returned 1 [0192.530] CloseHandle (hObject=0x2dc) returned 1 [0192.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0192.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0192.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.531] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=74144) returned 1 [0192.531] CloseHandle (hObject=0x2dc) returned 1 [0192.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0192.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0192.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.532] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=44960) returned 1 [0192.532] CloseHandle (hObject=0x2dc) returned 1 [0192.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0192.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0192.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.533] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=77664) returned 1 [0192.533] CloseHandle (hObject=0x2dc) returned 1 [0192.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0192.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0192.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.534] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45984) returned 1 [0192.534] CloseHandle (hObject=0x2dc) returned 1 [0192.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0192.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0192.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.534] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.534] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.534] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=77664) returned 1 [0192.534] CloseHandle (hObject=0x2dc) returned 1 [0192.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0192.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0192.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.535] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=75104) returned 1 [0192.535] CloseHandle (hObject=0x2dc) returned 1 [0192.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0192.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0192.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.536] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76640) returned 1 [0192.536] CloseHandle (hObject=0x2dc) returned 1 [0192.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0192.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0192.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.536] ResetEvent (hEvent=0x2a0) returned 1 [0192.536] SetEvent (hEvent=0x2a4) returned 1 [0192.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0192.537] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45472) returned 1 [0192.537] CloseHandle (hObject=0x2dc) returned 1 [0192.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0192.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0192.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.537] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.839] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.839] ResetEvent (hEvent=0x2a0) returned 1 [0192.839] SetEvent (hEvent=0x2a4) returned 1 [0192.839] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.840] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3878410) returned 1 [0192.840] CloseHandle (hObject=0x2ec) returned 1 [0192.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0192.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0192.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0192.841] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.846] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.846] ResetEvent (hEvent=0x2a0) returned 1 [0192.846] SetEvent (hEvent=0x2a4) returned 1 [0192.847] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.848] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2373000) returned 1 [0192.848] CloseHandle (hObject=0x2ec) returned 1 [0192.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0192.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0192.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0192.848] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.850] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.850] ResetEvent (hEvent=0x2a0) returned 1 [0192.850] SetEvent (hEvent=0x2a4) returned 1 [0192.851] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.852] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=177414) returned 1 [0192.852] CloseHandle (hObject=0x2ec) returned 1 [0192.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0192.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0192.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.852] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.852] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.854] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.854] ResetEvent (hEvent=0x2a0) returned 1 [0192.854] SetEvent (hEvent=0x2a4) returned 1 [0192.855] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.855] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=145419) returned 1 [0192.855] CloseHandle (hObject=0x2ec) returned 1 [0192.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0192.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0192.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.856] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.856] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.857] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.858] ResetEvent (hEvent=0x2a0) returned 1 [0192.858] SetEvent (hEvent=0x2a4) returned 1 [0192.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.858] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=164347) returned 1 [0192.858] CloseHandle (hObject=0x2ec) returned 1 [0192.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0192.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0192.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.858] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.860] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.860] ResetEvent (hEvent=0x2a0) returned 1 [0192.860] SetEvent (hEvent=0x2a4) returned 1 [0192.860] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.861] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=156245) returned 1 [0192.861] CloseHandle (hObject=0x2ec) returned 1 [0192.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0192.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0192.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.861] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.861] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.863] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.863] ResetEvent (hEvent=0x2a0) returned 1 [0192.863] SetEvent (hEvent=0x2a4) returned 1 [0192.863] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.864] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=85862) returned 1 [0192.864] CloseHandle (hObject=0x2ec) returned 1 [0192.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0192.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0192.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.868] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.868] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.870] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.870] ResetEvent (hEvent=0x2a0) returned 1 [0192.870] SetEvent (hEvent=0x2a4) returned 1 [0192.870] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.871] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=49091) returned 1 [0192.871] CloseHandle (hObject=0x2ec) returned 1 [0192.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0192.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0192.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.871] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.871] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.873] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.874] ResetEvent (hEvent=0x2a0) returned 1 [0192.874] SetEvent (hEvent=0x2a4) returned 1 [0192.874] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.874] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=79192) returned 1 [0192.874] CloseHandle (hObject=0x2ec) returned 1 [0192.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0192.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0192.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.874] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.874] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.876] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.877] ResetEvent (hEvent=0x2a0) returned 1 [0192.877] SetEvent (hEvent=0x2a4) returned 1 [0192.877] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.877] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76640) returned 1 [0192.877] CloseHandle (hObject=0x2ec) returned 1 [0192.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0192.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0192.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.877] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.877] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.879] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.879] ResetEvent (hEvent=0x2a0) returned 1 [0192.880] SetEvent (hEvent=0x2a4) returned 1 [0192.880] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.880] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45976) returned 1 [0192.880] CloseHandle (hObject=0x2ec) returned 1 [0192.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0192.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0192.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.880] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.880] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.882] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.882] ResetEvent (hEvent=0x2a0) returned 1 [0192.882] SetEvent (hEvent=0x2a4) returned 1 [0192.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.883] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45472) returned 1 [0192.883] CloseHandle (hObject=0x2ec) returned 1 [0192.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0192.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0192.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.883] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.885] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.885] ResetEvent (hEvent=0x2a0) returned 1 [0192.885] SetEvent (hEvent=0x2a4) returned 1 [0192.886] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.886] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=42904) returned 1 [0192.886] CloseHandle (hObject=0x2ec) returned 1 [0192.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0192.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0192.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.886] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.886] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.888] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.888] ResetEvent (hEvent=0x2a0) returned 1 [0192.888] SetEvent (hEvent=0x2a4) returned 1 [0192.889] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.889] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=42912) returned 1 [0192.889] CloseHandle (hObject=0x2ec) returned 1 [0192.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0192.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0192.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.889] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.889] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.891] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.892] ResetEvent (hEvent=0x2a0) returned 1 [0192.892] SetEvent (hEvent=0x2a4) returned 1 [0192.892] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.892] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=75608) returned 1 [0192.892] CloseHandle (hObject=0x2ec) returned 1 [0192.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0192.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0192.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.892] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.893] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.894] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.895] ResetEvent (hEvent=0x2a0) returned 1 [0192.895] SetEvent (hEvent=0x2a4) returned 1 [0192.895] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.895] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=75616) returned 1 [0192.895] CloseHandle (hObject=0x2ec) returned 1 [0192.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0192.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0192.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.896] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.896] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.897] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.898] ResetEvent (hEvent=0x2a0) returned 1 [0192.898] SetEvent (hEvent=0x2a4) returned 1 [0192.898] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.898] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=78176) returned 1 [0192.898] CloseHandle (hObject=0x2ec) returned 1 [0192.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0192.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0192.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.899] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.899] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.900] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.901] ResetEvent (hEvent=0x2a0) returned 1 [0192.901] SetEvent (hEvent=0x2a4) returned 1 [0192.901] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.901] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=77656) returned 1 [0192.901] CloseHandle (hObject=0x2ec) returned 1 [0192.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0192.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0192.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.902] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.902] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.903] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.904] ResetEvent (hEvent=0x2a0) returned 1 [0192.904] SetEvent (hEvent=0x2a4) returned 1 [0192.904] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.904] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76640) returned 1 [0192.904] CloseHandle (hObject=0x2ec) returned 1 [0192.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0192.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0192.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.905] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.906] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.907] ResetEvent (hEvent=0x2a0) returned 1 [0192.907] SetEvent (hEvent=0x2a4) returned 1 [0192.907] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.907] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76640) returned 1 [0192.907] CloseHandle (hObject=0x2ec) returned 1 [0192.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0192.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0192.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.908] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.908] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.912] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.912] ResetEvent (hEvent=0x2a0) returned 1 [0192.913] SetEvent (hEvent=0x2a4) returned 1 [0192.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.913] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=74080) returned 1 [0192.913] CloseHandle (hObject=0x2ec) returned 1 [0192.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0192.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0192.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.913] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.915] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.916] ResetEvent (hEvent=0x2a0) returned 1 [0192.916] SetEvent (hEvent=0x2a4) returned 1 [0192.916] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.916] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=92576) returned 1 [0192.916] CloseHandle (hObject=0x2ec) returned 1 [0192.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0192.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0192.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.916] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.917] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.919] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.921] ResetEvent (hEvent=0x2a0) returned 1 [0192.921] SetEvent (hEvent=0x2a4) returned 1 [0192.921] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.921] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76128) returned 1 [0192.921] CloseHandle (hObject=0x2ec) returned 1 [0192.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0192.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0192.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.921] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.922] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.923] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.924] ResetEvent (hEvent=0x2a0) returned 1 [0192.924] SetEvent (hEvent=0x2a4) returned 1 [0192.924] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.924] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=44960) returned 1 [0192.924] CloseHandle (hObject=0x2ec) returned 1 [0192.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0192.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0192.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.925] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.925] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.927] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.928] ResetEvent (hEvent=0x2a0) returned 1 [0192.928] SetEvent (hEvent=0x2a4) returned 1 [0192.928] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.928] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76640) returned 1 [0192.928] CloseHandle (hObject=0x2ec) returned 1 [0192.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0192.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0192.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.928] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.928] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.930] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.930] ResetEvent (hEvent=0x2a0) returned 1 [0192.931] SetEvent (hEvent=0x2a4) returned 1 [0192.931] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.931] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=44888) returned 1 [0192.931] CloseHandle (hObject=0x2ec) returned 1 [0192.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0192.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0192.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.931] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.931] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.933] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.934] ResetEvent (hEvent=0x2a0) returned 1 [0192.934] SetEvent (hEvent=0x2a4) returned 1 [0192.934] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.934] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=76128) returned 1 [0192.934] CloseHandle (hObject=0x2ec) returned 1 [0192.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0192.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0192.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.935] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.935] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.936] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.937] ResetEvent (hEvent=0x2a0) returned 1 [0192.937] SetEvent (hEvent=0x2a4) returned 1 [0192.937] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.937] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=75096) returned 1 [0192.937] CloseHandle (hObject=0x2ec) returned 1 [0192.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0192.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0192.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.938] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.938] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.939] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.940] ResetEvent (hEvent=0x2a0) returned 1 [0192.940] SetEvent (hEvent=0x2a4) returned 1 [0192.940] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.940] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=77152) returned 1 [0192.940] CloseHandle (hObject=0x2ec) returned 1 [0192.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0192.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0192.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.941] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.941] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.943] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.943] ResetEvent (hEvent=0x2a0) returned 1 [0192.943] SetEvent (hEvent=0x2a4) returned 1 [0192.943] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.944] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=63840) returned 1 [0192.944] CloseHandle (hObject=0x2ec) returned 1 [0192.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0192.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0192.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.944] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.944] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.946] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.946] ResetEvent (hEvent=0x2a0) returned 1 [0192.946] SetEvent (hEvent=0x2a4) returned 1 [0192.946] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.947] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=63832) returned 1 [0192.947] CloseHandle (hObject=0x2ec) returned 1 [0192.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0192.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0192.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.947] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.947] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.949] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.949] ResetEvent (hEvent=0x2a0) returned 1 [0192.949] SetEvent (hEvent=0x2a4) returned 1 [0192.949] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0192.950] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=63840) returned 1 [0192.950] CloseHandle (hObject=0x2ec) returned 1 [0192.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0192.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0192.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.950] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.950] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.952] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.953] ResetEvent (hEvent=0x2a0) returned 1 [0192.953] SetEvent (hEvent=0x2a4) returned 1 [0192.953] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.953] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=395226) returned 1 [0192.953] CloseHandle (hObject=0x2b4) returned 1 [0192.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0192.953] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0192.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0192.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\bootmgr.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.954] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.954] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0192.954] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.956] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.959] ResetEvent (hEvent=0x2a0) returned 1 [0192.959] SetEvent (hEvent=0x2a4) returned 1 [0192.959] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0192.960] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=69632) returned 1 [0192.961] CloseHandle (hObject=0x2b8) returned 1 [0192.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0192.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0192.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0x20 [0192.962] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.964] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.965] ResetEvent (hEvent=0x2a0) returned 1 [0192.965] SetEvent (hEvent=0x2a4) returned 1 [0192.965] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.965] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.984] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) returned 0x0 [0192.986] ResetEvent (hEvent=0x2a0) returned 1 [0192.986] SetEvent (hEvent=0x2a4) returned 1 [0192.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0192.987] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=18624) returned 1 [0192.987] CloseHandle (hObject=0x2fc) returned 1 [0192.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0192.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0192.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0192.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0192.987] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0192.988] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0192.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0192.989] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x48c0, lpOverlapped=0x0) returned 1 [0193.271] WriteFile (in: hFile=0x300, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x48d0, lpOverlapped=0x0) returned 1 [0193.273] WriteFile (in: hFile=0x300, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0193.273] CloseHandle (hObject=0x2fc) returned 1 [0193.273] CloseHandle (hObject=0x300) returned 1 [0193.273] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0193.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.276] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=21184) returned 1 [0193.277] CloseHandle (hObject=0x2fc) returned 1 [0193.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0193.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0193.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.277] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.277] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0193.278] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x52c0, lpOverlapped=0x0) returned 1 [0193.286] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x52d0, lpOverlapped=0x0) returned 1 [0193.287] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.287] CloseHandle (hObject=0x2fc) returned 1 [0193.287] CloseHandle (hObject=0x2f0) returned 1 [0193.287] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0193.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0193.289] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=19136) returned 1 [0193.289] CloseHandle (hObject=0x2f0) returned 1 [0193.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0193.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0193.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0193.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0193.290] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4ac0, lpOverlapped=0x0) returned 1 [0193.298] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4ad0, lpOverlapped=0x0) returned 1 [0193.299] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.299] CloseHandle (hObject=0x2f0) returned 1 [0193.300] CloseHandle (hObject=0x2fc) returned 1 [0193.305] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0193.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.307] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=11616) returned 1 [0193.307] CloseHandle (hObject=0x2fc) returned 1 [0193.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0193.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0193.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.307] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.307] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0193.308] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x2d60, lpOverlapped=0x0) returned 1 [0193.316] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x2d70, lpOverlapped=0x0) returned 1 [0193.317] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.317] CloseHandle (hObject=0x2fc) returned 1 [0193.317] CloseHandle (hObject=0x2f0) returned 1 [0193.317] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0193.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0193.319] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=22720) returned 1 [0193.319] CloseHandle (hObject=0x2f0) returned 1 [0193.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0193.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0193.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0193.319] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.319] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0193.320] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x58c0, lpOverlapped=0x0) returned 1 [0193.328] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x58d0, lpOverlapped=0x0) returned 1 [0193.329] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.329] CloseHandle (hObject=0x2f0) returned 1 [0193.329] CloseHandle (hObject=0x2fc) returned 1 [0193.329] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0193.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.331] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=20672) returned 1 [0193.331] CloseHandle (hObject=0x2fc) returned 1 [0193.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0193.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0193.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.332] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.332] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0193.332] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x50c0, lpOverlapped=0x0) returned 1 [0193.578] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x50d0, lpOverlapped=0x0) returned 1 [0193.580] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.580] CloseHandle (hObject=0x2fc) returned 1 [0193.580] CloseHandle (hObject=0x2f0) returned 1 [0193.580] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0193.582] SetEvent (hEvent=0x29c) returned 1 [0193.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0193.938] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=19136) returned 1 [0193.938] CloseHandle (hObject=0x2f0) returned 1 [0193.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0193.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0193.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.967] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.967] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0193.970] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4ac0, lpOverlapped=0x0) returned 1 [0193.972] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4ad0, lpOverlapped=0x0) returned 1 [0193.973] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.973] CloseHandle (hObject=0x2fc) returned 1 [0193.973] CloseHandle (hObject=0x2e4) returned 1 [0193.973] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0193.975] SetEvent (hEvent=0x29c) returned 1 [0193.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0193.975] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=24768) returned 1 [0193.975] CloseHandle (hObject=0x2e4) returned 1 [0193.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0193.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0193.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.975] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0193.976] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.976] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0193.976] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x60c0, lpOverlapped=0x0) returned 1 [0193.979] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x60d0, lpOverlapped=0x0) returned 1 [0193.980] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0193.980] CloseHandle (hObject=0x2e4) returned 1 [0193.980] CloseHandle (hObject=0x2fc) returned 1 [0193.980] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0193.982] SetEvent (hEvent=0x29c) returned 1 [0193.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.982] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=24768) returned 1 [0193.982] CloseHandle (hObject=0x2fc) returned 1 [0193.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0193.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0193.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.983] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.983] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0193.984] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x60c0, lpOverlapped=0x0) returned 1 [0193.986] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x60d0, lpOverlapped=0x0) returned 1 [0193.987] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0193.987] CloseHandle (hObject=0x2fc) returned 1 [0193.987] CloseHandle (hObject=0x2e4) returned 1 [0193.987] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0193.989] SetEvent (hEvent=0x29c) returned 1 [0193.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0193.989] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=21184) returned 1 [0193.989] CloseHandle (hObject=0x2e4) returned 1 [0193.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0193.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0193.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0193.990] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.990] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2fc [0193.990] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x52c0, lpOverlapped=0x0) returned 1 [0193.992] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x52d0, lpOverlapped=0x0) returned 1 [0193.994] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0193.994] CloseHandle (hObject=0x2e4) returned 1 [0193.994] CloseHandle (hObject=0x2fc) returned 1 [0193.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0193.995] SetEvent (hEvent=0x29c) returned 1 [0193.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.996] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=19136) returned 1 [0193.996] CloseHandle (hObject=0x2fc) returned 1 [0193.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0193.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0193.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0193.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0193.996] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.996] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0193.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0193.997] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4ac0, lpOverlapped=0x0) returned 1 [0193.999] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4ad0, lpOverlapped=0x0) returned 1 [0194.000] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x122, lpOverlapped=0x0) returned 1 [0194.000] CloseHandle (hObject=0x2fc) returned 1 [0194.000] CloseHandle (hObject=0x2e4) returned 1 [0194.001] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0194.002] SetEvent (hEvent=0x29c) returned 1 [0194.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0194.002] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=162880) returned 1 [0194.002] CloseHandle (hObject=0x2e4) returned 1 [0194.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0194.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0194.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0194.003] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=656088) returned 1 [0194.003] CloseHandle (hObject=0x2e4) returned 1 [0194.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0194.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0194.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0194.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0194.004] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2054872) returned 1 [0194.004] CloseHandle (hObject=0x2e4) returned 1 [0194.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0194.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0194.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0194.005] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.005] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.006] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b52058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0194.246] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.246] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b92058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0194.252] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.252] ReadFile (in: hFile=0x2e4, lpBuffer=0x3bd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3bd2058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0194.263] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8c8 | out: lpNewFilePointer=0x0) returned 1 [0194.264] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xc0112, lpOverlapped=0x0) returned 1 [0194.286] SetEndOfFile (hFile=0x2e4) returned 1 [0194.286] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0194.286] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1214a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0194.289] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0194.289] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1214a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0194.541] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0194.541] WriteFile (in: hFile=0x2e4, lpBuffer=0x3c1214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1214a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0194.542] CloseHandle (hObject=0x2e4) returned 1 [0194.542] SetEvent (hEvent=0x29c) returned 1 [0194.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0194.544] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2285736) returned 1 [0194.544] CloseHandle (hObject=0x2fc) returned 1 [0194.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0194.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0194.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0194.546] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.547] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.547] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b52058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0194.551] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.551] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b92058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0194.556] ReadFile (in: hFile=0x2fc, lpBuffer=0x3bd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3bd2058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0194.578] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8c8 | out: lpNewFilePointer=0x0) returned 1 [0194.578] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xc0122, lpOverlapped=0x0) returned 1 [0195.063] SetEndOfFile (hFile=0x2fc) returned 1 [0195.064] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0195.064] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1215a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1215a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0195.065] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0195.065] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1215a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1215a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0195.067] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0195.067] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c1215a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1215a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0195.069] CloseHandle (hObject=0x2fc) returned 1 [0195.069] SetEvent (hEvent=0x29c) returned 1 [0195.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.070] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=567512) returned 1 [0195.070] CloseHandle (hObject=0x2fc) returned 1 [0195.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0195.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0195.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.070] SetEvent (hEvent=0x29c) returned 1 [0195.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.071] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1231576) returned 1 [0195.071] CloseHandle (hObject=0x2fc) returned 1 [0195.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0195.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0195.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.072] SetEvent (hEvent=0x29c) returned 1 [0195.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.073] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=947928) returned 1 [0195.073] CloseHandle (hObject=0x2f0) returned 1 [0195.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0195.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0195.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.193] SetEvent (hEvent=0x29c) returned 1 [0195.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.194] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1295576) returned 1 [0195.194] CloseHandle (hObject=0x2f0) returned 1 [0195.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0195.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0195.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.195] SetEvent (hEvent=0x29c) returned 1 [0195.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.453] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=512216) returned 1 [0195.453] CloseHandle (hObject=0x2f0) returned 1 [0195.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0195.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0195.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.454] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.454] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0195.455] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0195.551] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x7d0e0, lpOverlapped=0x0) returned 1 [0195.566] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0195.566] CloseHandle (hObject=0x2f0) returned 1 [0195.566] CloseHandle (hObject=0x2e4) returned 1 [0195.566] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0195.571] SetEvent (hEvent=0x29c) returned 1 [0195.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.572] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=820416) returned 1 [0195.572] CloseHandle (hObject=0x2e4) returned 1 [0195.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0195.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0195.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.573] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.573] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0195.573] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xc84c0, lpOverlapped=0x0) returned 1 [0195.677] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xc84d0, lpOverlapped=0x0) returned 1 [0195.693] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0195.693] CloseHandle (hObject=0x2e4) returned 1 [0195.693] CloseHandle (hObject=0x2f0) returned 1 [0195.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0195.701] SetEvent (hEvent=0x29c) returned 1 [0195.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.702] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=4136) returned 1 [0195.702] CloseHandle (hObject=0x2f0) returned 1 [0195.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0195.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0195.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.702] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0195.703] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x1028, lpOverlapped=0x0) returned 1 [0195.937] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x1030, lpOverlapped=0x0) returned 1 [0195.939] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0195.939] CloseHandle (hObject=0x2f0) returned 1 [0195.939] CloseHandle (hObject=0x2e4) returned 1 [0195.939] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0195.941] SetEvent (hEvent=0x29c) returned 1 [0195.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.941] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=902328) returned 1 [0195.941] CloseHandle (hObject=0x2e4) returned 1 [0195.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0195.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0195.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0195.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.942] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.942] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0195.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0195.942] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0195.958] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xdc4c0, lpOverlapped=0x0) returned 1 [0196.221] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0196.221] CloseHandle (hObject=0x2e4) returned 1 [0196.221] CloseHandle (hObject=0x2f0) returned 1 [0196.384] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0196.392] SetEvent (hEvent=0x29c) returned 1 [0196.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.393] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=358616) returned 1 [0196.393] CloseHandle (hObject=0x300) returned 1 [0196.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0196.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0196.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.394] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0196.394] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0196.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0196.394] ReadFile (in: hFile=0x300, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x578d8, lpOverlapped=0x0) returned 1 [0196.401] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x578e0, lpOverlapped=0x0) returned 1 [0196.408] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0196.408] CloseHandle (hObject=0x300) returned 1 [0196.408] CloseHandle (hObject=0x30c) returned 1 [0196.408] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0196.412] SetEvent (hEvent=0x29c) returned 1 [0196.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0196.412] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3144288) returned 1 [0196.412] CloseHandle (hObject=0x30c) returned 1 [0196.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0196.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0196.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0196.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0196.415] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=4677216) returned 1 [0196.415] CloseHandle (hObject=0x30c) returned 1 [0196.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0196.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0196.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0196.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0196.417] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3177152) returned 1 [0196.417] CloseHandle (hObject=0x30c) returned 1 [0196.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0196.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0196.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0196.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0196.419] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=9330784) returned 1 [0196.419] CloseHandle (hObject=0x30c) returned 1 [0196.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0196.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0196.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0196.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0196.421] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=61024) returned 1 [0196.422] CloseHandle (hObject=0x30c) returned 1 [0196.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0196.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0196.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0196.422] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0196.422] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0196.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x300 [0196.423] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xee60, lpOverlapped=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x300, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xee70, lpOverlapped=0x0) returned 1 [0196.746] WriteFile (in: hFile=0x300, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0196.746] CloseHandle (hObject=0x30c) returned 1 [0196.746] CloseHandle (hObject=0x300) returned 1 [0196.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0196.748] SetEvent (hEvent=0x29c) returned 1 [0196.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.748] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=996568) returned 1 [0196.749] CloseHandle (hObject=0x300) returned 1 [0196.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0196.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0196.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0196.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.749] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0196.749] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0196.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0196.750] ReadFile (in: hFile=0x300, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xf34d8, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf34e0, lpOverlapped=0x0) returned 1 [0197.019] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0197.020] CloseHandle (hObject=0x300) returned 1 [0197.020] CloseHandle (hObject=0x30c) returned 1 [0197.020] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0197.029] SetEvent (hEvent=0x29c) returned 1 [0197.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0197.030] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2776664) returned 1 [0197.030] CloseHandle (hObject=0x30c) returned 1 [0197.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0197.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0197.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0197.032] SetEvent (hEvent=0x29c) returned 1 [0197.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.033] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=4782) returned 1 [0197.033] CloseHandle (hObject=0x2ec) returned 1 [0197.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0197.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0197.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.033] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.033] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0197.034] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x12ae, lpOverlapped=0x0) returned 1 [0197.036] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x12b0, lpOverlapped=0x0) returned 1 [0197.037] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0197.037] CloseHandle (hObject=0x2ec) returned 1 [0197.037] CloseHandle (hObject=0x30c) returned 1 [0197.037] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0197.038] SetEvent (hEvent=0x29c) returned 1 [0197.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0197.039] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=4450) returned 1 [0197.039] CloseHandle (hObject=0x30c) returned 1 [0197.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0197.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0197.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0197.039] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.039] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2ec [0197.040] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x1162, lpOverlapped=0x0) returned 1 [0197.043] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x1170, lpOverlapped=0x0) returned 1 [0197.044] WriteFile (in: hFile=0x2ec, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0197.044] CloseHandle (hObject=0x30c) returned 1 [0197.045] CloseHandle (hObject=0x2ec) returned 1 [0197.045] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0197.046] SetEvent (hEvent=0x29c) returned 1 [0197.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.046] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1053784) returned 1 [0197.046] CloseHandle (hObject=0x2ec) returned 1 [0197.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0197.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0197.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.047] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=982720) returned 1 [0197.047] CloseHandle (hObject=0x2ec) returned 1 [0197.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0197.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0197.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.048] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.048] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0197.048] ReadFile (in: hFile=0x2ec, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xefec0, lpOverlapped=0x0) returned 1 [0197.221] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xefed0, lpOverlapped=0x0) returned 1 [0197.239] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0197.239] CloseHandle (hObject=0x2ec) returned 1 [0197.239] CloseHandle (hObject=0x30c) returned 1 [0197.239] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0197.630] SetEvent (hEvent=0x29c) returned 1 [0197.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.630] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=693) returned 1 [0197.630] CloseHandle (hObject=0x2e8) returned 1 [0197.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0197.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0197.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.632] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3333) returned 1 [0197.632] CloseHandle (hObject=0x2e8) returned 1 [0197.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0197.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0197.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.633] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=247) returned 1 [0197.633] CloseHandle (hObject=0x2e8) returned 1 [0197.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0197.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0197.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.634] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3524) returned 1 [0197.634] CloseHandle (hObject=0x2e8) returned 1 [0197.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0197.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0197.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.635] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3529) returned 1 [0197.635] CloseHandle (hObject=0x2e8) returned 1 [0197.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0197.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0197.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.636] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=738) returned 1 [0197.636] CloseHandle (hObject=0x2e8) returned 1 [0197.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0197.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0197.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.637] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=804) returned 1 [0197.638] CloseHandle (hObject=0x2e8) returned 1 [0197.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0197.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0197.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.639] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=488) returned 1 [0197.639] CloseHandle (hObject=0x2e8) returned 1 [0197.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0197.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0197.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.640] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=617) returned 1 [0197.640] CloseHandle (hObject=0x2e8) returned 1 [0197.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0197.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0197.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.641] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=16616) returned 1 [0197.641] CloseHandle (hObject=0x2e8) returned 1 [0197.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0197.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0197.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.642] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=15097) returned 1 [0197.642] CloseHandle (hObject=0x2e8) returned 1 [0197.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0197.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0197.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.643] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=9803) returned 1 [0197.643] CloseHandle (hObject=0x2e8) returned 1 [0197.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0197.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0197.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.644] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=11067) returned 1 [0197.644] CloseHandle (hObject=0x2e8) returned 1 [0197.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0197.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0197.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.645] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10947) returned 1 [0197.645] CloseHandle (hObject=0x2e8) returned 1 [0197.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0197.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0197.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.646] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=44506) returned 1 [0197.646] CloseHandle (hObject=0x2e8) returned 1 [0197.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0197.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0197.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.646] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=737) returned 1 [0197.647] CloseHandle (hObject=0x2e8) returned 1 [0197.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0197.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0197.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.647] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=221) returned 1 [0197.647] CloseHandle (hObject=0x2e8) returned 1 [0197.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0197.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0197.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.650] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=471) returned 1 [0197.650] CloseHandle (hObject=0x2e8) returned 1 [0197.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0197.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0197.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.651] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=215) returned 1 [0197.651] CloseHandle (hObject=0x2e8) returned 1 [0197.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0197.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0197.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.652] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1069) returned 1 [0197.652] CloseHandle (hObject=0x2e8) returned 1 [0197.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0197.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0197.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.653] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=213) returned 1 [0197.653] CloseHandle (hObject=0x2e8) returned 1 [0197.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0197.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0197.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.655] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1853) returned 1 [0197.655] CloseHandle (hObject=0x2e8) returned 1 [0197.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0197.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0197.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.656] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=219) returned 1 [0197.656] CloseHandle (hObject=0x2e8) returned 1 [0197.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0197.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0197.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.657] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=924) returned 1 [0197.657] CloseHandle (hObject=0x2e8) returned 1 [0197.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0197.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0197.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.679] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=215) returned 1 [0197.679] CloseHandle (hObject=0x2e8) returned 1 [0197.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0197.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0197.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.680] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=694) returned 1 [0197.680] CloseHandle (hObject=0x2e8) returned 1 [0197.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0197.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0197.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.681] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=805) returned 1 [0197.681] CloseHandle (hObject=0x2e8) returned 1 [0197.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0197.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0197.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.682] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3823) returned 1 [0197.682] CloseHandle (hObject=0x2e8) returned 1 [0197.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0197.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0197.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.683] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=591) returned 1 [0197.683] CloseHandle (hObject=0x2e8) returned 1 [0197.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0197.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0197.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.684] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=9728) returned 1 [0197.684] CloseHandle (hObject=0x2e8) returned 1 [0197.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0197.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0197.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.685] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.685] CloseHandle (hObject=0x2e8) returned 1 [0197.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0197.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0197.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.686] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.686] CloseHandle (hObject=0x2e8) returned 1 [0197.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0197.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0197.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.687] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=46624) returned 1 [0197.687] CloseHandle (hObject=0x2e8) returned 1 [0197.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0197.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0197.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.687] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=498624) returned 1 [0197.687] CloseHandle (hObject=0x2e8) returned 1 [0197.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0197.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0197.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.688] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1100592) returned 1 [0197.688] CloseHandle (hObject=0x2e8) returned 1 [0197.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0197.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0197.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.689] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2515696) returned 1 [0197.689] CloseHandle (hObject=0x2e8) returned 1 [0197.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0197.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0197.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.690] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3380096) returned 1 [0197.690] CloseHandle (hObject=0x2e8) returned 1 [0197.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0197.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0197.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.691] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=361472) returned 1 [0197.691] CloseHandle (hObject=0x2e8) returned 1 [0197.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0197.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0197.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0197.692] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2018304) returned 1 [0197.692] CloseHandle (hObject=0x2e8) returned 1 [0197.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0197.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0197.919] SetEvent (hEvent=0x29c) returned 1 [0197.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.920] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2720) returned 1 [0197.920] CloseHandle (hObject=0x2f8) returned 1 [0197.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0197.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0197.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.921] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10752) returned 1 [0197.921] CloseHandle (hObject=0x2f8) returned 1 [0197.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0197.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0197.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.921] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=7680) returned 1 [0197.922] CloseHandle (hObject=0x2f8) returned 1 [0197.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0197.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0197.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.922] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=7680) returned 1 [0197.922] CloseHandle (hObject=0x2f8) returned 1 [0197.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0197.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0197.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.923] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=763) returned 1 [0197.923] CloseHandle (hObject=0x2f8) returned 1 [0197.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0197.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0197.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.924] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.924] CloseHandle (hObject=0x2f8) returned 1 [0197.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0197.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0197.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.925] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.925] CloseHandle (hObject=0x2f8) returned 1 [0197.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0197.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0197.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.926] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1700352) returned 1 [0197.927] CloseHandle (hObject=0x2f8) returned 1 [0197.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0197.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0197.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.927] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=503808) returned 1 [0197.927] CloseHandle (hObject=0x2f8) returned 1 [0197.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0197.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0197.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.928] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1540608) returned 1 [0197.928] CloseHandle (hObject=0x2f8) returned 1 [0197.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0197.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0197.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.929] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=6368768) returned 1 [0197.929] CloseHandle (hObject=0x2f8) returned 1 [0197.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0197.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0197.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.930] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=51200) returned 1 [0197.930] CloseHandle (hObject=0x2f8) returned 1 [0197.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0197.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0197.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.931] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1075712) returned 1 [0197.931] CloseHandle (hObject=0x2f8) returned 1 [0197.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0197.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0197.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.932] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.932] CloseHandle (hObject=0x2f8) returned 1 [0197.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0197.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0197.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.933] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.933] CloseHandle (hObject=0x2f8) returned 1 [0197.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0197.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0197.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.934] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.934] CloseHandle (hObject=0x2f8) returned 1 [0197.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0197.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0197.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.935] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10752) returned 1 [0197.935] CloseHandle (hObject=0x2f8) returned 1 [0197.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0197.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0197.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.936] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10752) returned 1 [0197.936] CloseHandle (hObject=0x2f8) returned 1 [0197.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0197.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0197.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.936] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10752) returned 1 [0197.936] CloseHandle (hObject=0x2f8) returned 1 [0197.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0197.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0197.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.937] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=177664) returned 1 [0197.937] CloseHandle (hObject=0x2f8) returned 1 [0197.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0197.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0197.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.938] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.938] CloseHandle (hObject=0x2f8) returned 1 [0197.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0197.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0197.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.939] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=733696) returned 1 [0197.939] CloseHandle (hObject=0x2f8) returned 1 [0197.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0197.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0197.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.940] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10752) returned 1 [0197.940] CloseHandle (hObject=0x2f8) returned 1 [0197.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0197.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0197.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.941] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.941] CloseHandle (hObject=0x2f8) returned 1 [0197.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0197.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0197.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.942] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=9728) returned 1 [0197.942] CloseHandle (hObject=0x2f8) returned 1 [0197.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0197.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0197.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.942] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.942] CloseHandle (hObject=0x2f8) returned 1 [0197.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0197.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0197.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.943] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=41984) returned 1 [0197.943] CloseHandle (hObject=0x2f8) returned 1 [0197.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0197.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0197.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.944] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=4101632) returned 1 [0197.944] CloseHandle (hObject=0x2f8) returned 1 [0197.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0197.944] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0 [0197.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0197.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.945] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=391040) returned 1 [0197.945] CloseHandle (hObject=0x2f8) returned 1 [0197.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0197.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0197.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.946] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=9728) returned 1 [0197.946] CloseHandle (hObject=0x2f8) returned 1 [0197.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0197.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0197.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.948] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1086464) returned 1 [0197.948] CloseHandle (hObject=0x2f8) returned 1 [0197.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0197.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0197.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.949] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=22016) returned 1 [0197.949] CloseHandle (hObject=0x2f8) returned 1 [0197.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0197.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0197.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.950] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1053184) returned 1 [0197.950] CloseHandle (hObject=0x2f8) returned 1 [0197.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0197.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0197.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.950] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=647584) returned 1 [0197.951] CloseHandle (hObject=0x2f8) returned 1 [0197.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0197.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0197.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.951] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=96768) returned 1 [0197.951] CloseHandle (hObject=0x2f8) returned 1 [0197.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0197.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0197.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.952] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.952] CloseHandle (hObject=0x2f8) returned 1 [0197.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0197.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0197.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.953] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0197.953] CloseHandle (hObject=0x2f8) returned 1 [0197.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0197.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0197.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.954] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=7168) returned 1 [0197.954] CloseHandle (hObject=0x2f8) returned 1 [0197.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0197.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0197.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.955] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=7168) returned 1 [0197.955] CloseHandle (hObject=0x2f8) returned 1 [0197.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0197.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0197.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.956] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=30720) returned 1 [0197.956] CloseHandle (hObject=0x2f8) returned 1 [0197.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0197.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0197.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.957] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=370176) returned 1 [0197.957] CloseHandle (hObject=0x2f8) returned 1 [0197.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0197.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0197.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.958] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=363728) returned 1 [0197.958] CloseHandle (hObject=0x2f8) returned 1 [0197.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0197.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0197.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0197.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0197.958] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.958] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0197.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0197.960] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x58cd0, lpOverlapped=0x0) returned 1 [0198.285] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x58ce0, lpOverlapped=0x0) returned 1 [0198.293] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0198.293] CloseHandle (hObject=0x2f8) returned 1 [0198.294] CloseHandle (hObject=0x308) returned 1 [0198.294] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0198.298] SetEvent (hEvent=0x29c) returned 1 [0198.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.299] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=590523) returned 1 [0198.299] CloseHandle (hObject=0x308) returned 1 [0198.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0198.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0198.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.299] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.299] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0198.300] ReadFile (in: hFile=0x308, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x902bb, lpOverlapped=0x0) returned 1 [0198.313] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x902c0, lpOverlapped=0x0) returned 1 [0198.497] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0198.497] CloseHandle (hObject=0x308) returned 1 [0198.497] CloseHandle (hObject=0x2f8) returned 1 [0198.497] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0198.503] SetEvent (hEvent=0x29c) returned 1 [0198.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.504] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=244296) returned 1 [0198.504] CloseHandle (hObject=0x2f8) returned 1 [0198.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0198.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0198.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.505] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.505] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0198.505] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x3ba48, lpOverlapped=0x0) returned 1 [0198.510] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x3ba50, lpOverlapped=0x0) returned 1 [0198.514] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xe2, lpOverlapped=0x0) returned 1 [0198.514] CloseHandle (hObject=0x2f8) returned 1 [0198.514] CloseHandle (hObject=0x308) returned 1 [0198.515] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0198.517] SetEvent (hEvent=0x29c) returned 1 [0198.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.518] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=255) returned 1 [0198.518] CloseHandle (hObject=0x308) returned 1 [0198.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0198.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0198.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.520] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1074) returned 1 [0198.520] CloseHandle (hObject=0x308) returned 1 [0198.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0198.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0198.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.521] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=645) returned 1 [0198.521] CloseHandle (hObject=0x308) returned 1 [0198.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0198.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0198.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0198.522] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.522] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x2f8 [0198.523] ReadFile (in: hFile=0x308, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x285, lpOverlapped=0x0) returned 1 [0198.524] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x290, lpOverlapped=0x0) returned 1 [0198.525] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0198.525] CloseHandle (hObject=0x308) returned 1 [0198.525] CloseHandle (hObject=0x2f8) returned 1 [0198.525] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0198.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.527] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=231) returned 1 [0198.527] CloseHandle (hObject=0x2f8) returned 1 [0198.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0198.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0198.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.529] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=23871) returned 1 [0198.529] CloseHandle (hObject=0x2f8) returned 1 [0198.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0198.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0198.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.530] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=237) returned 1 [0198.530] CloseHandle (hObject=0x2f8) returned 1 [0198.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0198.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0198.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.532] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=6406) returned 1 [0198.532] CloseHandle (hObject=0x2f8) returned 1 [0198.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0198.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0198.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.533] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=235) returned 1 [0198.533] CloseHandle (hObject=0x2f8) returned 1 [0198.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0198.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0198.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.534] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=4222) returned 1 [0198.534] CloseHandle (hObject=0x2f8) returned 1 [0198.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0198.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0198.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.535] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=237) returned 1 [0198.535] CloseHandle (hObject=0x2f8) returned 1 [0198.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0198.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0198.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.536] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=6381) returned 1 [0198.536] CloseHandle (hObject=0x2f8) returned 1 [0198.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0198.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0198.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.536] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=232) returned 1 [0198.536] CloseHandle (hObject=0x2f8) returned 1 [0198.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0198.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0198.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.537] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=5115) returned 1 [0198.537] CloseHandle (hObject=0x2f8) returned 1 [0198.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0198.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0198.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.538] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=233) returned 1 [0198.538] CloseHandle (hObject=0x2f8) returned 1 [0198.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0198.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0198.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.539] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1920) returned 1 [0198.539] CloseHandle (hObject=0x2f8) returned 1 [0198.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0198.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0198.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.737] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=237) returned 1 [0198.737] CloseHandle (hObject=0x2f8) returned 1 [0198.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0198.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0198.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.737] SetEvent (hEvent=0x29c) returned 1 [0198.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.738] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=855376) returned 1 [0198.738] CloseHandle (hObject=0x2f8) returned 1 [0198.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0198.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0198.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0198.739] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.739] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0198.741] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xd0d50, lpOverlapped=0x0) returned 1 [0198.759] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xd0d60, lpOverlapped=0x0) returned 1 [0198.982] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0198.982] CloseHandle (hObject=0x2f8) returned 1 [0198.983] CloseHandle (hObject=0x2e4) returned 1 [0198.983] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0198.991] SetEvent (hEvent=0x29c) returned 1 [0198.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0198.992] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=367216) returned 1 [0198.992] CloseHandle (hObject=0x2e4) returned 1 [0198.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0198.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0198.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0198.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0198.992] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.992] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0198.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0198.993] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x59a70, lpOverlapped=0x0) returned 1 [0199.001] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x59a80, lpOverlapped=0x0) returned 1 [0199.008] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0199.008] CloseHandle (hObject=0x2e4) returned 1 [0199.008] CloseHandle (hObject=0x2f8) returned 1 [0199.008] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0199.013] SetEvent (hEvent=0x29c) returned 1 [0199.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0199.013] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=48872) returned 1 [0199.013] CloseHandle (hObject=0x2f8) returned 1 [0199.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0199.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0199.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0199.014] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.014] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0199.014] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xbee8, lpOverlapped=0x0) returned 1 [0199.017] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xbef0, lpOverlapped=0x0) returned 1 [0199.214] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0199.214] CloseHandle (hObject=0x2f8) returned 1 [0199.214] CloseHandle (hObject=0x2e4) returned 1 [0199.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0199.216] SetEvent (hEvent=0x29c) returned 1 [0199.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.217] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1233920) returned 1 [0199.217] CloseHandle (hObject=0x2e4) returned 1 [0199.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0199.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0199.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.218] SetEvent (hEvent=0x29c) returned 1 [0199.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.218] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=50688) returned 1 [0199.218] CloseHandle (hObject=0x2e4) returned 1 [0199.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0199.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0199.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.219] SetEvent (hEvent=0x29c) returned 1 [0199.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.219] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=53760) returned 1 [0199.219] CloseHandle (hObject=0x2e4) returned 1 [0199.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0199.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0199.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.220] SetEvent (hEvent=0x29c) returned 1 [0199.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.220] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=69632) returned 1 [0199.220] CloseHandle (hObject=0x2e4) returned 1 [0199.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0199.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0199.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.221] SetEvent (hEvent=0x29c) returned 1 [0199.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.221] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=70656) returned 1 [0199.221] CloseHandle (hObject=0x2e4) returned 1 [0199.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0199.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0199.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.222] SetEvent (hEvent=0x29c) returned 1 [0199.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.222] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=71168) returned 1 [0199.222] CloseHandle (hObject=0x2e4) returned 1 [0199.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0199.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0199.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.223] SetEvent (hEvent=0x29c) returned 1 [0199.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.223] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=70656) returned 1 [0199.223] CloseHandle (hObject=0x2e4) returned 1 [0199.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0199.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0199.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.224] SetEvent (hEvent=0x29c) returned 1 [0199.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.224] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=70656) returned 1 [0199.224] CloseHandle (hObject=0x2e4) returned 1 [0199.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0199.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0199.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.225] SetEvent (hEvent=0x29c) returned 1 [0199.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.225] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=364032) returned 1 [0199.226] CloseHandle (hObject=0x2e4) returned 1 [0199.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0199.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0199.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.226] SetEvent (hEvent=0x29c) returned 1 [0199.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.226] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=13824) returned 1 [0199.227] CloseHandle (hObject=0x2e4) returned 1 [0199.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0199.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0199.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.227] SetEvent (hEvent=0x29c) returned 1 [0199.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.228] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=45568) returned 1 [0199.228] CloseHandle (hObject=0x2e4) returned 1 [0199.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0199.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0199.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.228] SetEvent (hEvent=0x29c) returned 1 [0199.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.229] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=35840) returned 1 [0199.229] CloseHandle (hObject=0x2e4) returned 1 [0199.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0199.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0199.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.229] SetEvent (hEvent=0x29c) returned 1 [0199.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.230] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=404992) returned 1 [0199.230] CloseHandle (hObject=0x2e4) returned 1 [0199.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0199.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0199.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.230] SetEvent (hEvent=0x29c) returned 1 [0199.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.231] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=24576) returned 1 [0199.231] CloseHandle (hObject=0x2e4) returned 1 [0199.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0199.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0199.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.231] SetEvent (hEvent=0x29c) returned 1 [0199.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.232] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=91136) returned 1 [0199.232] CloseHandle (hObject=0x2e4) returned 1 [0199.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0199.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0199.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.232] SetEvent (hEvent=0x29c) returned 1 [0199.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.233] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=32768) returned 1 [0199.233] CloseHandle (hObject=0x2e4) returned 1 [0199.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0199.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0199.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.233] SetEvent (hEvent=0x29c) returned 1 [0199.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.234] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=94208) returned 1 [0199.234] CloseHandle (hObject=0x2e4) returned 1 [0199.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0199.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0199.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.235] SetEvent (hEvent=0x29c) returned 1 [0199.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.236] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=630) returned 1 [0199.236] CloseHandle (hObject=0x2e4) returned 1 [0199.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0199.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0199.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.236] SetEvent (hEvent=0x29c) returned 1 [0199.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.237] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=623) returned 1 [0199.237] CloseHandle (hObject=0x2e4) returned 1 [0199.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0199.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0199.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.237] SetEvent (hEvent=0x29c) returned 1 [0199.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.238] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=10240) returned 1 [0199.238] CloseHandle (hObject=0x2e4) returned 1 [0199.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0199.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0199.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.238] SetEvent (hEvent=0x29c) returned 1 [0199.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.239] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=6144) returned 1 [0199.239] CloseHandle (hObject=0x2e4) returned 1 [0199.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0199.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0199.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.239] SetEvent (hEvent=0x29c) returned 1 [0199.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.240] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=14336) returned 1 [0199.240] CloseHandle (hObject=0x2e4) returned 1 [0199.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0199.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0199.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.240] SetEvent (hEvent=0x29c) returned 1 [0199.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.241] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=7680) returned 1 [0199.241] CloseHandle (hObject=0x2e4) returned 1 [0199.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0199.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0199.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.241] SetEvent (hEvent=0x29c) returned 1 [0199.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.242] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=6144) returned 1 [0199.242] CloseHandle (hObject=0x2e4) returned 1 [0199.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0199.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0199.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.243] SetEvent (hEvent=0x29c) returned 1 [0199.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.243] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=695296) returned 1 [0199.243] CloseHandle (hObject=0x2e4) returned 1 [0199.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0199.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0199.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.244] SetEvent (hEvent=0x29c) returned 1 [0199.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.244] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2560) returned 1 [0199.244] CloseHandle (hObject=0x2e4) returned 1 [0199.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0199.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0199.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.245] SetEvent (hEvent=0x29c) returned 1 [0199.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.245] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=242688) returned 1 [0199.245] CloseHandle (hObject=0x2e4) returned 1 [0199.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0199.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0199.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.246] SetEvent (hEvent=0x29c) returned 1 [0199.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.246] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2560) returned 1 [0199.246] CloseHandle (hObject=0x2e4) returned 1 [0199.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0199.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0199.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.247] SetEvent (hEvent=0x29c) returned 1 [0199.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.247] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=279552) returned 1 [0199.247] CloseHandle (hObject=0x2e4) returned 1 [0199.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0199.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0199.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.248] SetEvent (hEvent=0x29c) returned 1 [0199.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.248] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2560) returned 1 [0199.248] CloseHandle (hObject=0x2e4) returned 1 [0199.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0199.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0199.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.249] SetEvent (hEvent=0x29c) returned 1 [0199.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0199.249] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=2560) returned 1 [0199.249] CloseHandle (hObject=0x2e4) returned 1 [0199.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0199.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0199.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.250] SetEvent (hEvent=0x29c) returned 1 [0199.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.389] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=356352) returned 1 [0199.389] CloseHandle (hObject=0x304) returned 1 [0199.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0199.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0199.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.390] SetEvent (hEvent=0x29c) returned 1 [0199.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.518] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=48128) returned 1 [0199.518] CloseHandle (hObject=0x304) returned 1 [0199.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0199.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0199.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.518] SetEvent (hEvent=0x29c) returned 1 [0199.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.519] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=54272) returned 1 [0199.519] CloseHandle (hObject=0x304) returned 1 [0199.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0199.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0199.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.519] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=512000) returned 1 [0199.519] CloseHandle (hObject=0x304) returned 1 [0199.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0199.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0199.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.520] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=501760) returned 1 [0199.520] CloseHandle (hObject=0x304) returned 1 [0199.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0199.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0199.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.521] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=224256) returned 1 [0199.521] CloseHandle (hObject=0x304) returned 1 [0199.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0199.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0199.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.522] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=407552) returned 1 [0199.522] CloseHandle (hObject=0x304) returned 1 [0199.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0199.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0199.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.523] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=824128) returned 1 [0199.523] CloseHandle (hObject=0x304) returned 1 [0199.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0199.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0199.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.523] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=5430) returned 1 [0199.523] CloseHandle (hObject=0x304) returned 1 [0199.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0199.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0199.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.524] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=452) returned 1 [0199.524] CloseHandle (hObject=0x304) returned 1 [0199.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0199.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0199.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.525] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.525] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0199.525] ReadFile (in: hFile=0x304, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x1c4, lpOverlapped=0x0) returned 1 [0199.527] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x1d0, lpOverlapped=0x0) returned 1 [0199.528] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0199.529] CloseHandle (hObject=0x304) returned 1 [0199.529] CloseHandle (hObject=0x308) returned 1 [0199.529] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0199.530] SetEvent (hEvent=0x29c) returned 1 [0199.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.531] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=49688) returned 1 [0199.531] CloseHandle (hObject=0x308) returned 1 [0199.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0199.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0199.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.532] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=80384) returned 1 [0199.532] CloseHandle (hObject=0x308) returned 1 [0199.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe")) returned 0x20 [0199.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe")) returned 0x20 [0199.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\brook_den.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0199.532] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.533] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\brook_den.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0199.533] ReadFile (in: hFile=0x308, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x13a00, lpOverlapped=0x0) returned 1 [0199.535] WriteFile (in: hFile=0x304, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x13a10, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x13a10, lpOverlapped=0x0) returned 1 [0199.537] WriteFile (in: hFile=0x304, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0199.537] CloseHandle (hObject=0x308) returned 1 [0199.538] CloseHandle (hObject=0x304) returned 1 [0199.538] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\brook_den.exe" (normalized: "c:\\program files\\java\\brook_den.exe")) returned 1 [0199.539] SetEvent (hEvent=0x29c) returned 1 [0199.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.540] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1516608) returned 1 [0199.540] CloseHandle (hObject=0x304) returned 1 [0199.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0199.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0199.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0199.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0199.540] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.540] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0199.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0199.541] ReadFile (in: hFile=0x304, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x110100, lpOverlapped=0x0) returned 1 [0199.933] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x110100, lpOverlapped=0x0) returned 1 [0200.161] ReadFile (in: hFile=0x304, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x62340, lpOverlapped=0x0) returned 1 [0200.166] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x62350, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x62350, lpOverlapped=0x0) returned 1 [0200.172] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xe2, lpOverlapped=0x0) returned 1 [0200.172] CloseHandle (hObject=0x304) returned 1 [0200.172] CloseHandle (hObject=0x308) returned 1 [0200.172] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0200.177] SetEvent (hEvent=0x29c) returned 1 [0200.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0200.684] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1156672) returned 1 [0200.728] CloseHandle (hObject=0x304) returned 1 [0200.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0200.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0200.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0200.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0200.728] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0200.728] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0200.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0200.729] ReadFile (in: hFile=0x304, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x110100, lpOverlapped=0x0) returned 1 [0200.763] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x110100, lpOverlapped=0x0) returned 1 [0201.143] ReadFile (in: hFile=0x304, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xa540, lpOverlapped=0x0) returned 1 [0201.143] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xa550, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xa550, lpOverlapped=0x0) returned 1 [0201.145] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0201.145] CloseHandle (hObject=0x304) returned 1 [0201.145] CloseHandle (hObject=0x308) returned 1 [0201.145] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0201.148] SetEvent (hEvent=0x29c) returned 1 [0201.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0201.148] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=186944) returned 1 [0201.148] CloseHandle (hObject=0x308) returned 1 [0201.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0201.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0201.149] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0201.149] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.149] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0201.150] ReadFile (in: hFile=0x308, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x2da40, lpOverlapped=0x0) returned 1 [0201.154] WriteFile (in: hFile=0x304, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x2da50, lpOverlapped=0x0) returned 1 [0201.158] WriteFile (in: hFile=0x304, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.158] CloseHandle (hObject=0x308) returned 1 [0201.158] CloseHandle (hObject=0x304) returned 1 [0201.158] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0201.160] SetEvent (hEvent=0x29c) returned 1 [0201.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0201.161] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=265792) returned 1 [0201.161] CloseHandle (hObject=0x304) returned 1 [0201.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0201.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0201.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0201.161] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.161] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0201.162] ReadFile (in: hFile=0x304, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x40e40, lpOverlapped=0x0) returned 1 [0201.167] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x40e50, lpOverlapped=0x0) returned 1 [0201.172] WriteFile (in: hFile=0x308, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.172] CloseHandle (hObject=0x304) returned 1 [0201.173] CloseHandle (hObject=0x308) returned 1 [0201.173] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0201.176] SetEvent (hEvent=0x29c) returned 1 [0201.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0201.177] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=455744) returned 1 [0201.177] CloseHandle (hObject=0x308) returned 1 [0201.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0201.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0201.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0201.519] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.540] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0201.541] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x6f440, lpOverlapped=0x0) returned 1 [0201.550] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x6f450, lpOverlapped=0x0) returned 1 [0201.558] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.558] CloseHandle (hObject=0x2dc) returned 1 [0201.559] CloseHandle (hObject=0x30c) returned 1 [0201.559] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0201.563] SetEvent (hEvent=0x29c) returned 1 [0201.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0201.566] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=158272) returned 1 [0201.566] CloseHandle (hObject=0x30c) returned 1 [0201.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0201.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0201.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0201.567] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.567] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0201.568] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x26a40, lpOverlapped=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x26a50, lpOverlapped=0x0) returned 1 [0201.575] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.575] CloseHandle (hObject=0x30c) returned 1 [0201.575] CloseHandle (hObject=0x2dc) returned 1 [0201.575] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0201.577] SetEvent (hEvent=0x29c) returned 1 [0201.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0201.578] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=123456) returned 1 [0201.578] CloseHandle (hObject=0x2dc) returned 1 [0201.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0201.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0201.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0201.578] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.578] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0201.579] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x1e240, lpOverlapped=0x0) returned 1 [0201.812] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x1e250, lpOverlapped=0x0) returned 1 [0201.815] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.815] CloseHandle (hObject=0x2dc) returned 1 [0201.815] CloseHandle (hObject=0x30c) returned 1 [0201.815] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0201.817] SetEvent (hEvent=0x29c) returned 1 [0201.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0201.817] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=159808) returned 1 [0201.817] CloseHandle (hObject=0x30c) returned 1 [0201.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0201.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0201.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0201.818] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.818] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0201.818] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x27040, lpOverlapped=0x0) returned 1 [0201.822] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x27050, lpOverlapped=0x0) returned 1 [0201.825] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.825] CloseHandle (hObject=0x30c) returned 1 [0201.825] CloseHandle (hObject=0x2dc) returned 1 [0201.825] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0201.827] SetEvent (hEvent=0x29c) returned 1 [0201.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0201.828] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=206912) returned 1 [0201.828] CloseHandle (hObject=0x2dc) returned 1 [0201.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0201.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0201.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0201.828] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.828] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0201.830] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x32840, lpOverlapped=0x0) returned 1 [0201.834] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x32850, lpOverlapped=0x0) returned 1 [0201.839] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0201.839] CloseHandle (hObject=0x2dc) returned 1 [0201.839] CloseHandle (hObject=0x30c) returned 1 [0201.839] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0201.841] SetEvent (hEvent=0x29c) returned 1 [0201.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0201.842] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=142400) returned 1 [0201.842] CloseHandle (hObject=0x30c) returned 1 [0201.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0201.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0201.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0201.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0201.842] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.842] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0201.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0201.843] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x22c40, lpOverlapped=0x0) returned 1 [0201.847] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x22c50, lpOverlapped=0x0) returned 1 [0201.850] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0201.850] CloseHandle (hObject=0x30c) returned 1 [0201.850] CloseHandle (hObject=0x2dc) returned 1 [0201.850] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0201.852] SetEvent (hEvent=0x29c) returned 1 [0201.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.104] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=187392) returned 1 [0202.104] CloseHandle (hObject=0x2dc) returned 1 [0202.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0202.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0202.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.104] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.104] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0202.105] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x2dc00, lpOverlapped=0x0) returned 1 [0202.139] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x2dc10, lpOverlapped=0x0) returned 1 [0202.143] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.143] CloseHandle (hObject=0x2dc) returned 1 [0202.143] CloseHandle (hObject=0x2f0) returned 1 [0202.143] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0202.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.147] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=128064) returned 1 [0202.147] CloseHandle (hObject=0x2f0) returned 1 [0202.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0202.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0202.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.148] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.148] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0202.148] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x1f440, lpOverlapped=0x0) returned 1 [0202.170] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x1f450, lpOverlapped=0x0) returned 1 [0202.173] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.173] CloseHandle (hObject=0x2f0) returned 1 [0202.173] CloseHandle (hObject=0x2dc) returned 1 [0202.173] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0202.175] SetEvent (hEvent=0x29c) returned 1 [0202.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.176] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=206912) returned 1 [0202.176] CloseHandle (hObject=0x2dc) returned 1 [0202.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0202.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0202.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.176] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.176] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0202.177] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x32840, lpOverlapped=0x0) returned 1 [0202.195] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x32850, lpOverlapped=0x0) returned 1 [0202.200] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.200] CloseHandle (hObject=0x2dc) returned 1 [0202.200] CloseHandle (hObject=0x2f0) returned 1 [0202.200] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0202.202] SetEvent (hEvent=0x29c) returned 1 [0202.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.203] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=319552) returned 1 [0202.203] CloseHandle (hObject=0x2f0) returned 1 [0202.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0202.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0202.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.203] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.203] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0202.204] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4e040, lpOverlapped=0x0) returned 1 [0202.451] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4e050, lpOverlapped=0x0) returned 1 [0202.457] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.457] CloseHandle (hObject=0x2f0) returned 1 [0202.457] CloseHandle (hObject=0x2dc) returned 1 [0202.457] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0202.461] SetEvent (hEvent=0x29c) returned 1 [0202.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.462] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=139840) returned 1 [0202.462] CloseHandle (hObject=0x2dc) returned 1 [0202.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0202.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0202.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.463] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.463] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0202.463] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x22240, lpOverlapped=0x0) returned 1 [0202.466] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x22250, lpOverlapped=0x0) returned 1 [0202.469] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.470] CloseHandle (hObject=0x2dc) returned 1 [0202.470] CloseHandle (hObject=0x2f0) returned 1 [0202.470] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0202.472] SetEvent (hEvent=0x29c) returned 1 [0202.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.472] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=41503296) returned 1 [0202.472] CloseHandle (hObject=0x2f0) returned 1 [0202.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0202.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0202.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.473] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0202.473] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0202.473] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b52058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0202.480] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0202.480] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b92058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0202.486] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0202.486] ReadFile (in: hFile=0x2f0, lpBuffer=0x3bd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3bd2058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0202.663] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8c8 | out: lpNewFilePointer=0x0) returned 1 [0202.663] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xc0112, lpOverlapped=0x0) returned 1 [0202.683] SetEndOfFile (hFile=0x2f0) returned 1 [0202.684] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0202.684] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1214a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0202.686] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0202.686] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1214a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0202.687] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0202.687] WriteFile (in: hFile=0x2f0, lpBuffer=0x3c1214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1214a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0202.926] CloseHandle (hObject=0x2f0) returned 1 [0202.926] SetEvent (hEvent=0x29c) returned 1 [0202.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.926] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=18496) returned 1 [0202.926] CloseHandle (hObject=0x2f0) returned 1 [0202.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0202.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0202.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.927] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.927] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0202.927] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4840, lpOverlapped=0x0) returned 1 [0202.929] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4850, lpOverlapped=0x0) returned 1 [0202.930] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.930] CloseHandle (hObject=0x2f0) returned 1 [0202.930] CloseHandle (hObject=0x2dc) returned 1 [0202.931] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0202.932] SetEvent (hEvent=0x29c) returned 1 [0202.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.933] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=35392) returned 1 [0202.933] CloseHandle (hObject=0x2dc) returned 1 [0202.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0202.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0202.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.933] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.934] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0202.934] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x8a40, lpOverlapped=0x0) returned 1 [0202.936] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x8a50, lpOverlapped=0x0) returned 1 [0202.938] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.938] CloseHandle (hObject=0x2dc) returned 1 [0202.938] CloseHandle (hObject=0x2f0) returned 1 [0202.938] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0202.939] SetEvent (hEvent=0x29c) returned 1 [0202.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.940] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=31296) returned 1 [0202.940] CloseHandle (hObject=0x2f0) returned 1 [0202.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0202.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0202.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.940] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.940] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0202.941] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x7a40, lpOverlapped=0x0) returned 1 [0202.943] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x7a50, lpOverlapped=0x0) returned 1 [0202.944] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.944] CloseHandle (hObject=0x2f0) returned 1 [0202.944] CloseHandle (hObject=0x2dc) returned 1 [0202.944] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0202.946] SetEvent (hEvent=0x29c) returned 1 [0202.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.946] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=220736) returned 1 [0202.946] CloseHandle (hObject=0x2dc) returned 1 [0202.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0202.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0202.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0202.947] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.947] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0202.947] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x35e40, lpOverlapped=0x0) returned 1 [0202.952] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x35e50, lpOverlapped=0x0) returned 1 [0202.956] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0202.956] CloseHandle (hObject=0x2dc) returned 1 [0202.956] CloseHandle (hObject=0x2f0) returned 1 [0202.957] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0202.959] SetEvent (hEvent=0x29c) returned 1 [0202.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.959] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=16448) returned 1 [0202.959] CloseHandle (hObject=0x2f0) returned 1 [0202.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0202.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0202.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0202.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.960] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.960] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0202.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0202.960] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4040, lpOverlapped=0x0) returned 1 [0203.043] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4050, lpOverlapped=0x0) returned 1 [0203.063] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.076] CloseHandle (hObject=0x2f0) returned 1 [0203.076] CloseHandle (hObject=0x2dc) returned 1 [0203.076] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0203.078] SetEvent (hEvent=0x29c) returned 1 [0203.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.078] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=653888) returned 1 [0203.078] CloseHandle (hObject=0x2dc) returned 1 [0203.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0203.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0203.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0203.079] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.079] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0203.079] ReadFile (in: hFile=0x2dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x9fa40, lpOverlapped=0x0) returned 1 [0203.090] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x9fa50, lpOverlapped=0x0) returned 1 [0203.103] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.103] CloseHandle (hObject=0x2dc) returned 1 [0203.103] CloseHandle (hObject=0x2f0) returned 1 [0203.103] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0203.109] SetEvent (hEvent=0x29c) returned 1 [0203.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.109] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=660128) returned 1 [0203.110] CloseHandle (hObject=0x2f0) returned 1 [0203.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0203.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0203.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.110] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.110] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2dc [0203.111] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xa12a0, lpOverlapped=0x0) returned 1 [0203.280] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xa12b0, lpOverlapped=0x0) returned 1 [0203.293] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.293] CloseHandle (hObject=0x2f0) returned 1 [0203.293] CloseHandle (hObject=0x2dc) returned 1 [0203.546] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0203.615] SetEvent (hEvent=0x29c) returned 1 [0203.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.616] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=96832) returned 1 [0203.616] CloseHandle (hObject=0x30c) returned 1 [0203.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0203.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0203.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.617] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.617] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0203.617] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x17a40, lpOverlapped=0x0) returned 1 [0203.620] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x17a50, lpOverlapped=0x0) returned 1 [0203.623] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xe2, lpOverlapped=0x0) returned 1 [0203.623] CloseHandle (hObject=0x30c) returned 1 [0203.623] CloseHandle (hObject=0x2e4) returned 1 [0203.623] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0203.625] SetEvent (hEvent=0x29c) returned 1 [0203.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.625] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=19008) returned 1 [0203.625] CloseHandle (hObject=0x2e4) returned 1 [0203.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0203.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0203.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.626] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.626] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0203.626] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4a40, lpOverlapped=0x0) returned 1 [0203.628] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4a50, lpOverlapped=0x0) returned 1 [0203.630] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xe2, lpOverlapped=0x0) returned 1 [0203.630] CloseHandle (hObject=0x2e4) returned 1 [0203.630] CloseHandle (hObject=0x30c) returned 1 [0203.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0203.631] SetEvent (hEvent=0x29c) returned 1 [0203.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.631] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=16448) returned 1 [0203.631] CloseHandle (hObject=0x30c) returned 1 [0203.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0203.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0203.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.632] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.632] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0203.632] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4040, lpOverlapped=0x0) returned 1 [0203.634] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4050, lpOverlapped=0x0) returned 1 [0203.635] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.635] CloseHandle (hObject=0x30c) returned 1 [0203.636] CloseHandle (hObject=0x2e4) returned 1 [0203.636] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0203.637] SetEvent (hEvent=0x29c) returned 1 [0203.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.637] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=16448) returned 1 [0203.637] CloseHandle (hObject=0x2e4) returned 1 [0203.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0203.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0203.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0203.638] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.638] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0203.638] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4040, lpOverlapped=0x0) returned 1 [0203.640] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4050, lpOverlapped=0x0) returned 1 [0203.641] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.641] CloseHandle (hObject=0x2e4) returned 1 [0203.642] CloseHandle (hObject=0x30c) returned 1 [0203.642] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0203.643] SetEvent (hEvent=0x29c) returned 1 [0203.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.643] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=829264) returned 1 [0203.643] CloseHandle (hObject=0x30c) returned 1 [0203.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0203.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0203.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.644] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.644] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0203.644] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xca750, lpOverlapped=0x0) returned 1 [0203.829] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xca760, lpOverlapped=0x0) returned 1 [0203.844] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.844] CloseHandle (hObject=0x30c) returned 1 [0203.844] CloseHandle (hObject=0x2e4) returned 1 [0203.844] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0203.896] SetEvent (hEvent=0x29c) returned 1 [0203.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.900] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=97856) returned 1 [0203.900] CloseHandle (hObject=0x2f4) returned 1 [0203.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0203.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0203.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.901] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.901] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0203.926] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x17e40, lpOverlapped=0x0) returned 1 [0203.939] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x17e50, lpOverlapped=0x0) returned 1 [0203.941] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.941] CloseHandle (hObject=0x2f4) returned 1 [0203.941] CloseHandle (hObject=0x30c) returned 1 [0203.942] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0203.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.944] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=15936) returned 1 [0203.944] CloseHandle (hObject=0x30c) returned 1 [0203.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0203.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0203.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0203.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0203.944] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.944] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0203.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0203.945] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x3e40, lpOverlapped=0x0) returned 1 [0203.953] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x3e50, lpOverlapped=0x0) returned 1 [0203.954] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0203.954] CloseHandle (hObject=0x30c) returned 1 [0203.955] CloseHandle (hObject=0x2f4) returned 1 [0203.955] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0203.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.956] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=18677760) returned 1 [0203.956] CloseHandle (hObject=0x2f4) returned 1 [0203.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0203.956] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0203.957] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 1 [0203.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0203.958] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0203.958] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0203.958] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b52058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b52058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0203.960] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0203.960] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b92058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3b92058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0203.966] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x36af758 | out: lpNewFilePointer=0x0) returned 1 [0203.966] ReadFile (in: hFile=0x2f4, lpBuffer=0x3bd2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x36af764, lpOverlapped=0x0 | out: lpBuffer=0x3bd2058*, lpNumberOfBytesRead=0x36af764*=0x40000, lpOverlapped=0x0) returned 1 [0203.977] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8c8 | out: lpNewFilePointer=0x0) returned 1 [0203.977] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xc0102, lpOverlapped=0x0) returned 1 [0204.083] SetEndOfFile (hFile=0x2f4) returned 1 [0204.083] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0204.083] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1213a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1213a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0204.085] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0204.085] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1213a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1213a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0204.088] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af760 | out: lpNewFilePointer=0x0) returned 1 [0204.088] WriteFile (in: hFile=0x2f4, lpBuffer=0x3c1213a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x36af76c, lpOverlapped=0x0 | out: lpBuffer=0x3c1213a*, lpNumberOfBytesWritten=0x36af76c*=0x40000, lpOverlapped=0x0) returned 1 [0204.090] CloseHandle (hObject=0x2f4) returned 1 [0204.090] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-2869].[robinhood@countermail.com].eject", dwFileAttributes=0x21) returned 1 [0204.090] SetEvent (hEvent=0x29c) returned 1 [0204.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.091] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=1423) returned 1 [0204.091] CloseHandle (hObject=0x2f4) returned 1 [0204.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0204.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0204.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.091] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.092] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.092] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x58f, lpOverlapped=0x0) returned 1 [0204.093] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x590, lpOverlapped=0x0) returned 1 [0204.094] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0204.094] CloseHandle (hObject=0x2f4) returned 1 [0204.094] CloseHandle (hObject=0x2f8) returned 1 [0204.094] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0204.095] SetEvent (hEvent=0x29c) returned 1 [0204.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.096] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=16448) returned 1 [0204.096] CloseHandle (hObject=0x2f8) returned 1 [0204.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0204.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0204.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.096] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.097] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0204.097] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x4040, lpOverlapped=0x0) returned 1 [0204.100] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x4050, lpOverlapped=0x0) returned 1 [0204.101] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0204.101] CloseHandle (hObject=0x2f8) returned 1 [0204.101] CloseHandle (hObject=0x2f4) returned 1 [0204.101] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0204.103] SetEvent (hEvent=0x29c) returned 1 [0204.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.103] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=204864) returned 1 [0204.103] CloseHandle (hObject=0x2f4) returned 1 [0204.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0204.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0204.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0204.104] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.104] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.104] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x32040, lpOverlapped=0x0) returned 1 [0204.273] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x32050, lpOverlapped=0x0) returned 1 [0204.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0204.278] CloseHandle (hObject=0x2f4) returned 1 [0204.278] CloseHandle (hObject=0x2f8) returned 1 [0204.278] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0204.281] SetEvent (hEvent=0x29c) returned 1 [0204.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.281] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=571968) returned 1 [0204.282] CloseHandle (hObject=0x2f8) returned 1 [0204.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0204.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0204.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.282] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.282] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0204.283] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x8ba40, lpOverlapped=0x0) returned 1 [0204.293] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x8ba50, lpOverlapped=0x0) returned 1 [0204.304] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xe2, lpOverlapped=0x0) returned 1 [0204.304] CloseHandle (hObject=0x2f8) returned 1 [0204.304] CloseHandle (hObject=0x2f4) returned 1 [0204.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1 [0204.493] SetEvent (hEvent=0x29c) returned 1 [0204.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0204.540] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=135744) returned 1 [0204.540] CloseHandle (hObject=0x30c) returned 1 [0204.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0204.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0204.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0204.540] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.540] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2e4 [0204.541] ReadFile (in: hFile=0x30c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x21240, lpOverlapped=0x0) returned 1 [0204.571] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x21250, lpOverlapped=0x0) returned 1 [0204.574] WriteFile (in: hFile=0x2e4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0204.574] CloseHandle (hObject=0x30c) returned 1 [0204.574] CloseHandle (hObject=0x2e4) returned 1 [0204.574] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0204.578] SetEvent (hEvent=0x29c) returned 1 [0204.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0204.578] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=31808) returned 1 [0204.578] CloseHandle (hObject=0x2e4) returned 1 [0204.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0204.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0204.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0204.579] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.579] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0204.583] ReadFile (in: hFile=0x2e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x7c40, lpOverlapped=0x0) returned 1 [0204.595] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x7c50, lpOverlapped=0x0) returned 1 [0204.596] WriteFile (in: hFile=0x30c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0204.596] CloseHandle (hObject=0x2e4) returned 1 [0204.596] CloseHandle (hObject=0x30c) returned 1 [0204.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1 [0204.860] SetEvent (hEvent=0x29c) returned 1 [0204.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.871] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=197184) returned 1 [0204.871] CloseHandle (hObject=0x2f0) returned 1 [0204.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0204.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0204.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.872] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.872] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.964] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x30240, lpOverlapped=0x0) returned 1 [0204.969] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x30250, lpOverlapped=0x0) returned 1 [0204.973] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0204.973] CloseHandle (hObject=0x2f0) returned 1 [0204.973] CloseHandle (hObject=0x2f8) returned 1 [0204.974] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0204.976] SetEvent (hEvent=0x29c) returned 1 [0204.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.977] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=24128) returned 1 [0204.977] CloseHandle (hObject=0x2f8) returned 1 [0204.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0204.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0204.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.977] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.977] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0204.978] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x5e40, lpOverlapped=0x0) returned 1 [0204.980] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x5e50, lpOverlapped=0x0) returned 1 [0204.981] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x102, lpOverlapped=0x0) returned 1 [0204.982] CloseHandle (hObject=0x2f8) returned 1 [0204.982] CloseHandle (hObject=0x2f0) returned 1 [0204.982] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0204.983] SetEvent (hEvent=0x29c) returned 1 [0204.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.984] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=110144) returned 1 [0204.984] CloseHandle (hObject=0x2f0) returned 1 [0204.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0204.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0204.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.984] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.984] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0204.985] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x1ae40, lpOverlapped=0x0) returned 1 [0204.988] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1ae50, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x1ae50, lpOverlapped=0x0) returned 1 [0204.990] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0204.990] CloseHandle (hObject=0x2f0) returned 1 [0204.991] CloseHandle (hObject=0x2f8) returned 1 [0204.991] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 1 [0204.992] SetEvent (hEvent=0x29c) returned 1 [0204.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.993] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=77888) returned 1 [0204.993] CloseHandle (hObject=0x2f8) returned 1 [0204.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0204.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0204.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0204.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0204.993] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.993] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0204.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0204.994] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x13040, lpOverlapped=0x0) returned 1 [0204.997] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x13050, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x13050, lpOverlapped=0x0) returned 1 [0204.999] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xe2, lpOverlapped=0x0) returned 1 [0204.999] CloseHandle (hObject=0x2f8) returned 1 [0204.999] CloseHandle (hObject=0x2f0) returned 1 [0204.999] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 1 [0205.000] SetEvent (hEvent=0x29c) returned 1 [0205.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0205.001] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=3244) returned 1 [0205.001] CloseHandle (hObject=0x2f0) returned 1 [0205.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0205.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0205.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0205.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0205.001] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0205.001] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0205.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f8 [0205.002] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0xcac, lpOverlapped=0x0) returned 1 [0205.003] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xcb0, lpOverlapped=0x0) returned 1 [0205.003] WriteFile (in: hFile=0x2f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xf2, lpOverlapped=0x0) returned 1 [0205.004] CloseHandle (hObject=0x2f0) returned 1 [0205.004] CloseHandle (hObject=0x2f8) returned 1 [0205.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0205.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0205.005] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=149) returned 1 [0205.005] CloseHandle (hObject=0x2f8) returned 1 [0205.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0205.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0205.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0205.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0205.006] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0205.006] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0 | out: lpNewFilePointer=0x0) returned 1 [0205.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id[b4197730-2869].[robinhood@countermail.com].eject"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f0 [0205.006] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b52020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36af8dc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x36af8dc*=0x95, lpOverlapped=0x0) returned 1 [0205.007] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0xa0, lpOverlapped=0x0) returned 1 [0205.008] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x36af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x36af8c0*=0x112, lpOverlapped=0x0) returned 1 [0205.008] CloseHandle (hObject=0x2f8) returned 1 [0205.008] CloseHandle (hObject=0x2f0) returned 1 [0205.008] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0205.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0205.010] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x36af908 | out: lpFileSize=0x36af908*=634) returned 1 [0205.010] CloseHandle (hObject=0x2f0) returned 1 [0205.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0205.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0205.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[B4197730-2869].[robinhood@countermail.com].eject" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[b4197730-2869].[robinhood@countermail.com].eject")) returned 0xffffffff [0205.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0205.230] SetFilePointerEx (hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af8d0) Thread: id = 113 os_tid = 0xc84 [0192.283] GetProcessHeap () returned 0xb40000 [0192.283] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3a70938 [0192.283] GetProcessHeap () returned 0xb40000 [0192.283] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3a80940 [0192.283] GetProcessHeap () returned 0xb40000 [0192.284] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb636d0 [0192.284] GetProcessHeap () returned 0xb40000 [0192.284] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x110102) returned 0x3c76020 [0192.286] GetProcessHeap () returned 0xb40000 [0192.286] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb4a9b8 [0192.286] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0192.286] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0192.287] Wow64DisableWow64FsRedirection (in: OldValue=0x37efedc | out: OldValue=0x37efedc*=0x0) returned 1 [0192.287] GetProcessHeap () returned 0xb40000 [0192.287] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a9b8 | out: hHeap=0xb40000) returned 1 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.287] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.288] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.289] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.290] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.291] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.292] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.293] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.294] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.295] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.296] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.297] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.298] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.299] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.300] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.301] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.302] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.303] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.304] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.305] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.306] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.307] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 114 os_tid = 0x5d0 [0192.315] GetProcessHeap () returned 0xb40000 [0192.315] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3a91630 [0192.316] GetProcessHeap () returned 0xb40000 [0192.316] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x10000) returned 0x3aa1638 [0192.316] GetProcessHeap () returned 0xb40000 [0192.316] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x28) returned 0xb63730 [0192.316] GetProcessHeap () returned 0xb40000 [0192.316] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x110102) returned 0x3d99020 [0192.319] GetProcessHeap () returned 0xb40000 [0192.319] RtlAllocateHeap (HeapHandle=0xb40000, Flags=0x0, Size=0x50) returned 0xb4a9b8 [0192.319] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76420000 [0192.319] GetProcAddress (hModule=0x76420000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76436b30 [0192.319] Wow64DisableWow64FsRedirection (in: OldValue=0x392fb14 | out: OldValue=0x392fb14*=0x0) returned 1 [0192.319] GetProcessHeap () returned 0xb40000 [0192.319] HeapFree (in: hHeap=0xb40000, dwFlags=0x0, lpMem=0xb4a9b8 | out: hHeap=0xb40000) returned 1 [0192.319] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.320] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.321] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.322] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.323] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.324] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.325] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.326] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.327] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.328] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.329] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.330] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.331] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.332] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.333] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.334] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.335] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.336] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.337] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.338] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.339] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.340] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0192.340] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 132 os_tid = 0x858 Process: id = "14" image_name = "cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" page_root = "0x71f000" os_pid = "0xfa4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xd68" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0xfa8 [0191.996] GetProcessHeap () returned 0x13e0000 [0191.996] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x30) returned 0x13f34c8 [0191.996] GetProcessHeap () returned 0x13e0000 [0191.996] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x3310) returned 0x1400498 [0192.000] GetProcessHeap () returned 0x13e0000 [0192.000] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x300) returned 0x13fe0f8 [0192.001] GetProcessHeap () returned 0x13e0000 [0192.001] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x10) returned 0x13ff4e8 [0192.001] GetTickCount () returned 0x1145eab [0192.001] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0xfaf7e0, cchData=32 | out: lpLCData="\x03") returned 16 [0192.002] GetProcessHeap () returned 0x13e0000 [0192.002] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x10) returned 0x13ff620 [0192.002] GetProcessHeap () returned 0x13e0000 [0192.002] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20a) returned 0x13f39a8 [0192.002] GetProcessHeap () returned 0x13e0000 [0192.002] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20a) returned 0x13fe8e0 [0192.002] GetProcessHeap () returned 0x13e0000 [0192.002] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20a) returned 0x13feaf8 [0192.002] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13feaf8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersadministratorappdataroamingmicrosoftwindowsstart menuprogramsstartupsystem.exe")) returned 0xa2 [0192.002] GetProcessHeap () returned 0x13e0000 [0192.002] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13feaf8 | out: hHeap=0x13e0000) returned 1 [0192.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\oit.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\oit.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f39a8 | out: hHeap=0x13e0000) returned 1 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13fe8e0 | out: hHeap=0x13e0000) returned 1 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13ff620 | out: hHeap=0x13e0000) returned 1 [0192.003] GetVersion () returned 0x23f00206 [0192.003] GetCurrentProcess () returned 0xffffffff [0192.003] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xfaf774 | out: TokenHandle=0xfaf774*=0x1fc) returned 1 [0192.003] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x14, TokenInformation=0xfaf76c, TokenInformationLength=0x4, ReturnLength=0xfaf770 | out: TokenInformation=0xfaf76c, ReturnLength=0xfaf770) returned 1 [0192.003] CloseHandle (hObject=0x1fc) returned 1 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20) returned 0x13eb2f0 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20a) returned 0x13f39a8 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20a) returned 0x13fe8e0 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f39a8 | out: hHeap=0x13e0000) returned 1 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13fe8e0 | out: hHeap=0x13e0000) returned 1 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20) returned 0x13eb368 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x8, Size=0x1e) returned 0x13eb390 [0192.003] GetProcessHeap () returned 0x13e0000 [0192.003] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x1e) returned 0x13fea50 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x90) returned 0x13f1b00 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f1b00 | out: hHeap=0x13e0000) returned 1 [0192.004] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13eb390, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13fea50 | out: hHeap=0x13e0000) returned 1 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13eb368 | out: hHeap=0x13e0000) returned 1 [0192.004] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf72c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf72c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13eb390 | out: hHeap=0x13e0000) returned 1 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x30) returned 0x13f3768 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x8, Size=0x2a) returned 0x13f36c0 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlReAllocateHeap (Heap=0x13e0000, Flags=0x0, Ptr=0x13f36c0, Size=0x52) returned 0x13ee718 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f3768 | out: hHeap=0x13e0000) returned 1 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13ee718 | out: hHeap=0x13e0000) returned 1 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x1c) returned 0x13eb368 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x1c) returned 0x13eb390 [0192.004] GetProcessHeap () returned 0x13e0000 [0192.004] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x20) returned 0x13feb40 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x8, Size=0x1e) returned 0x13fed70 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x1e) returned 0x13fec30 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x90) returned 0x13f1b00 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f1b00 | out: hHeap=0x13e0000) returned 1 [0192.005] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x13fed70, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13fec30 | out: hHeap=0x13e0000) returned 1 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13feb40 | out: hHeap=0x13e0000) returned 1 [0192.005] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xfaf714, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xfaf714*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13fed70 | out: hHeap=0x13e0000) returned 1 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x0, Size=0x40) returned 0x13f2a98 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] RtlAllocateHeap (HeapHandle=0x13e0000, Flags=0x8, Size=0x3a) returned 0x13f2b70 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] RtlReAllocateHeap (Heap=0x13e0000, Flags=0x0, Ptr=0x13f2b70, Size=0x72) returned 0x13f1bf0 [0192.005] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x1fc [0192.005] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0192.005] CloseHandle (hObject=0x1fc) returned 1 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f2a98 | out: hHeap=0x13e0000) returned 1 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.005] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f1bf0 | out: hHeap=0x13e0000) returned 1 [0192.005] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13eb368 | out: hHeap=0x13e0000) returned 1 [0192.006] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13eb390 | out: hHeap=0x13e0000) returned 1 [0192.006] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13eb2f0 | out: hHeap=0x13e0000) returned 1 [0192.006] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13ff4e8 | out: hHeap=0x13e0000) returned 1 [0192.006] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13fe0f8 | out: hHeap=0x13e0000) returned 1 [0192.006] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x1400498 | out: hHeap=0x13e0000) returned 1 [0192.006] GetProcessHeap () returned 0x13e0000 [0192.006] HeapFree (in: hHeap=0x13e0000, dwFlags=0x0, lpMem=0x13f34c8 | out: hHeap=0x13e0000) returned 1 [0192.006] ExitProcess (uExitCode=0x0) Thread: id = 97 os_tid = 0xfb0 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3645d000" os_pid = "0xfd0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xf98" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 105 os_tid = 0xfd4 [0196.022] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6ec2e0000 [0196.022] __set_app_type (_Type=0x1) [0196.022] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6ec2f6d00) returned 0x0 [0196.022] __getmainargs (in: _Argc=0x7ff6ec319200, _Argv=0x7ff6ec319208, _Env=0x7ff6ec319210, _DoWildCard=0, _StartInfo=0x7ff6ec31921c | out: _Argc=0x7ff6ec319200, _Argv=0x7ff6ec319208, _Env=0x7ff6ec319210) returned 0 [0196.022] _onexit (_Func=0x7ff6ec2f7fd0) returned 0x7ff6ec2f7fd0 [0196.022] _onexit (_Func=0x7ff6ec2f7fe0) returned 0x7ff6ec2f7fe0 [0196.022] _onexit (_Func=0x7ff6ec2f7ff0) returned 0x7ff6ec2f7ff0 [0196.022] _onexit (_Func=0x7ff6ec2f8000) returned 0x7ff6ec2f8000 [0196.023] _onexit (_Func=0x7ff6ec2f8010) returned 0x7ff6ec2f8010 [0196.023] _onexit (_Func=0x7ff6ec2f8020) returned 0x7ff6ec2f8020 [0196.023] GetCurrentThreadId () returned 0xfd4 [0196.023] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfd4) returned 0x70 [0196.024] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff360a0000 [0196.024] GetProcAddress (hModule=0x7fff360a0000, lpProcName="SetThreadUILanguage") returned 0x7fff360ba990 [0196.024] SetThreadUILanguage (LangId=0x0) returned 0x409 [0196.396] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0196.424] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c350ffe98 | out: phkResult=0x1c350ffe98*=0x0) returned 0x2 [0196.424] VirtualQuery (in: lpAddress=0x1c350ffe84, lpBuffer=0x1c350ffe00, dwLength=0x30 | out: lpBuffer=0x1c350ffe00*(BaseAddress=0x1c350ff000, AllocationBase=0x1c35000000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.424] VirtualQuery (in: lpAddress=0x1c35000000, lpBuffer=0x1c350ffe00, dwLength=0x30 | out: lpBuffer=0x1c350ffe00*(BaseAddress=0x1c35000000, AllocationBase=0x1c35000000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.424] VirtualQuery (in: lpAddress=0x1c35001000, lpBuffer=0x1c350ffe00, dwLength=0x30 | out: lpBuffer=0x1c350ffe00*(BaseAddress=0x1c35001000, AllocationBase=0x1c35000000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.424] VirtualQuery (in: lpAddress=0x1c35004000, lpBuffer=0x1c350ffe00, dwLength=0x30 | out: lpBuffer=0x1c350ffe00*(BaseAddress=0x1c35004000, AllocationBase=0x1c35000000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.424] VirtualQuery (in: lpAddress=0x1c35100000, lpBuffer=0x1c350ffe00, dwLength=0x30 | out: lpBuffer=0x1c350ffe00*(BaseAddress=0x1c35100000, AllocationBase=0x1c35100000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.424] GetConsoleOutputCP () returned 0x1b5 [0196.964] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6ec31fbb0 | out: lpCPInfo=0x7ff6ec31fbb0) returned 1 [0196.965] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6ec308150, Add=1) returned 1 [0196.974] _get_osfhandle (_FileHandle=1) returned 0x228 [0196.974] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6ec31fc04 | out: lpMode=0x7ff6ec31fc04) returned 0 [0196.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0196.974] GetConsoleMode (in: hConsoleHandle=0x21c, lpMode=0x7ff6ec31fc00 | out: lpMode=0x7ff6ec31fc00) returned 0 [0196.974] _get_osfhandle (_FileHandle=1) returned 0x228 [0196.974] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0 [0196.974] _get_osfhandle (_FileHandle=1) returned 0x228 [0196.974] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6ec31fc08 | out: lpMode=0x7ff6ec31fc08) returned 0 [0197.008] _get_osfhandle (_FileHandle=0) returned 0x21c [0197.009] GetConsoleMode (in: hConsoleHandle=0x21c, lpMode=0x7ff6ec31fc0c | out: lpMode=0x7ff6ec31fc0c) returned 0 [0197.009] GetEnvironmentStringsW () returned 0x15f62025a10* [0197.009] GetProcessHeap () returned 0x15f62020000 [0197.009] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xa7c) returned 0x15f620264a0 [0197.009] FreeEnvironmentStringsA (penv="A") returned 1 [0197.009] GetProcessHeap () returned 0x15f62020000 [0197.009] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x8) returned 0x15f62026f30 [0197.009] GetEnvironmentStringsW () returned 0x15f62025a10* [0197.009] GetProcessHeap () returned 0x15f62020000 [0197.009] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xa7c) returned 0x15f62026f50 [0197.009] FreeEnvironmentStringsA (penv="A") returned 1 [0197.009] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1c350fed48 | out: phkResult=0x1c350fed48*=0x7c) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x0, lpData=0x1c350fed60*=0x4, lpcbData=0x1c350fed44*=0x1000) returned 0x2 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x1, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x0, lpData=0x1c350fed60*=0x1, lpcbData=0x1c350fed44*=0x1000) returned 0x2 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x0, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x40, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x40, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x0, lpData=0x1c350fed60*=0x40, lpcbData=0x1c350fed44*=0x1000) returned 0x2 [0197.010] RegCloseKey (hKey=0x7c) returned 0x0 [0197.010] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1c350fed48 | out: phkResult=0x1c350fed48*=0x7c) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x0, lpData=0x1c350fed60*=0x40, lpcbData=0x1c350fed44*=0x1000) returned 0x2 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x1, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x0, lpData=0x1c350fed60*=0x1, lpcbData=0x1c350fed44*=0x1000) returned 0x2 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x0, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x9, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x4, lpData=0x1c350fed60*=0x9, lpcbData=0x1c350fed44*=0x4) returned 0x0 [0197.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1c350fed40, lpData=0x1c350fed60, lpcbData=0x1c350fed44*=0x1000 | out: lpType=0x1c350fed40*=0x0, lpData=0x1c350fed60*=0x9, lpcbData=0x1c350fed44*=0x1000) returned 0x2 [0197.010] RegCloseKey (hKey=0x7c) returned 0x0 [0197.010] time (in: timer=0x0 | out: timer=0x0) returned 0x5f09cfd0 [0197.010] srand (_Seed=0x5f09cfd0) [0197.010] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0197.010] malloc (_Size=0x4000) returned 0x15f622954f0 [0197.011] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0197.011] malloc (_Size=0xffce) returned 0x15f622a0080 [0197.011] ??_V@YAXPEAX@Z () returned 0x15f622a0080 [0197.012] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15f622a0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0197.012] malloc (_Size=0xffce) returned 0x15f622b0060 [0197.012] ??_V@YAXPEAX@Z () returned 0x15f622b0060 [0197.013] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x15f622b0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0197.013] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0197.013] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0197.013] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0197.013] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0197.013] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0197.013] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0197.014] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0197.014] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0197.014] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0197.014] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0197.014] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0197.014] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0197.014] GetProcessHeap () returned 0x15f62020000 [0197.014] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f620264a0) returned 1 [0197.014] GetEnvironmentStringsW () returned 0x15f62025a10* [0197.014] GetProcessHeap () returned 0x15f62020000 [0197.014] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xa94) returned 0x15f62027a10 [0197.014] FreeEnvironmentStringsA (penv="A") returned 1 [0197.014] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0197.014] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0197.014] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0197.014] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0197.015] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0197.015] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0197.015] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0197.015] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0197.015] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0197.015] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0197.015] malloc (_Size=0xffce) returned 0x15f622c0040 [0197.015] ??_V@YAXPEAX@Z () returned 0x15f622c0040 [0197.016] GetProcessHeap () returned 0x15f62020000 [0197.016] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x38) returned 0x15f620284b0 [0197.016] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15f622c0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0197.016] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x15f622c0040, lpFilePart=0x1c350ff8c0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x1c350ff8c0*="system32") returned 0x13 [0197.016] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0197.016] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x1c350ff5f0 | out: lpFindFileData=0x1c350ff5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x15f620284f0 [0197.017] FindClose (in: hFindFile=0x15f620284f0 | out: hFindFile=0x15f620284f0) returned 1 [0197.017] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1c350ff5f0 | out: lpFindFileData=0x1c350ff5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc0b701ad, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xc0b701ad, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x15f620284f0 [0197.017] FindClose (in: hFindFile=0x15f620284f0 | out: hFindFile=0x15f620284f0) returned 1 [0197.017] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0197.017] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0197.017] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0197.017] GetProcessHeap () returned 0x15f62020000 [0197.017] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62027a10) returned 1 [0197.017] GetEnvironmentStringsW () returned 0x15f620284f0* [0197.017] GetProcessHeap () returned 0x15f62020000 [0197.017] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xac4) returned 0x15f62025a10 [0197.017] FreeEnvironmentStringsA (penv="=") returned 1 [0197.017] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15f622a0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0197.017] GetProcessHeap () returned 0x15f62020000 [0197.017] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f620284b0) returned 1 [0197.017] ??_V@YAXPEAX@Z () returned 0x1 [0197.017] ??_V@YAXPEAX@Z () returned 0x1 [0197.017] GetProcessHeap () returned 0x15f62020000 [0197.017] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x4016) returned 0x15f62027a10 [0197.018] GetProcessHeap () returned 0x15f62020000 [0197.018] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62027a10) returned 1 [0197.018] GetConsoleOutputCP () returned 0x1b5 [0197.407] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6ec31fbb0 | out: lpCPInfo=0x7ff6ec31fbb0) returned 1 [0197.407] GetUserDefaultLCID () returned 0x409 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6ec31bb78, cchData=8 | out: lpLCData=":") returned 2 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1c350ffc80, cchData=128 | out: lpLCData="0") returned 2 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1c350ffc80, cchData=128 | out: lpLCData="0") returned 2 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1c350ffc80, cchData=128 | out: lpLCData="1") returned 2 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6ec31bb68, cchData=8 | out: lpLCData="/") returned 2 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6ec31bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6ec31bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6ec31ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6ec31ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6ec31ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6ec31b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6ec31b980, cchData=32 | out: lpLCData="Sun") returned 4 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6ec31bb58, cchData=8 | out: lpLCData=".") returned 2 [0197.407] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6ec31bb40, cchData=8 | out: lpLCData=",") returned 2 [0197.407] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0197.409] GetProcessHeap () returned 0x15f62020000 [0197.409] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x0, Size=0x20c) returned 0x15f62026550 [0197.409] GetConsoleTitleW (in: lpConsoleTitle=0x15f62026550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0197.902] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.902] GetFileType (hFile=0x228) returned 0x3 [0197.902] ApiSetQueryApiSetPresence () returned 0x0 [0197.902] ResolveDelayLoadedAPI () returned 0x7fff2c0cd990 [0197.906] BrandingFormatString () returned 0x15f62026a40 [0197.913] GetVersion () returned 0x3ad7000a [0197.913] _vsnwprintf (in: _Buffer=0x1c350ffde0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1c350ffd78 | out: _Buffer="10.0.15063") returned 10 [0197.913] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.913] GetFileType (hFile=0x228) returned 0x3 [0197.913] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6ec327f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0197.914] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6ec327f60, nSize=0x2000, Arguments=0x1c350ffd80 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0197.914] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0197.914] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1c350ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ffcd8*=0x26, lpOverlapped=0x0) returned 1 [0197.914] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1c350ffda8 | out: _Buffer="\r\n") returned 2 [0197.914] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.914] GetFileType (hFile=0x228) returned 0x3 [0197.914] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0197.914] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1c350ffd78, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ffd78*=0x2, lpOverlapped=0x0) returned 1 [0197.915] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1c350ffda8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0197.915] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.915] GetFileType (hFile=0x228) returned 0x3 [0197.915] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.915] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0197.915] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x1c350ffd78, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ffd78*=0x34, lpOverlapped=0x0) returned 1 [0197.915] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1c350ffda8 | out: _Buffer="\r\n") returned 2 [0197.915] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.915] GetFileType (hFile=0x228) returned 0x3 [0197.915] _get_osfhandle (_FileHandle=1) returned 0x228 [0197.915] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0197.915] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1c350ffd78, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ffd78*=0x2, lpOverlapped=0x0) returned 1 [0197.915] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff360a0000 [0197.916] GetProcAddress (hModule=0x7fff360a0000, lpProcName="CopyFileExW") returned 0x7fff360be830 [0197.916] GetProcAddress (hModule=0x7fff360a0000, lpProcName="IsDebuggerPresent") returned 0x7fff360be300 [0197.916] GetProcAddress (hModule=0x7fff360a0000, lpProcName="SetConsoleInputExeNameW") returned 0x7fff338d0a40 [0197.916] ??_V@YAXPEAX@Z () returned 0x1 [0197.916] _get_osfhandle (_FileHandle=0) returned 0x21c [0197.916] GetFileType (hFile=0x21c) returned 0x3 [0197.916] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0197.916] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1c350ffbe8 | out: TokenHandle=0x1c350ffbe8*=0x0) returned 0xc000007c [0197.916] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1c350ffbe8 | out: TokenHandle=0x1c350ffbe8*=0x98) returned 0x0 [0197.916] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x1c350ffb98, TokenInformationLength=0x4, ReturnLength=0x1c350ffba0 | out: TokenInformation=0x1c350ffb98, ReturnLength=0x1c350ffba0) returned 0x0 [0197.916] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x1c350ffba0, TokenInformationLength=0x4, ReturnLength=0x1c350ffb98 | out: TokenInformation=0x1c350ffba0, ReturnLength=0x1c350ffb98) returned 0x0 [0197.916] NtClose (Handle=0x98) returned 0x0 [0197.916] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1c350ffbb0, nSize=0x0, Arguments=0x1c350ffbb8 | out: lpBuffer="枠戂ş") returned 0xf [0197.916] GetProcessHeap () returned 0x15f62020000 [0197.916] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x218) returned 0x15f62028bb0 [0197.917] GetConsoleTitleW (in: lpConsoleTitle=0x1c350ffc00, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0198.492] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0198.493] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0198.969] GetProcessHeap () returned 0x15f62020000 [0198.969] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62028bb0) returned 1 [0198.969] LocalFree (hMem=0x15f620267a0) returned 0x0 [0198.970] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1c350ffa28 | out: _Buffer="\r\n") returned 2 [0198.970] _get_osfhandle (_FileHandle=1) returned 0x228 [0198.970] GetFileType (hFile=0x228) returned 0x3 [0198.970] _get_osfhandle (_FileHandle=1) returned 0x228 [0198.970] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.970] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1c350ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ff9f8*=0x2, lpOverlapped=0x0) returned 1 [0198.970] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0198.970] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x15f622a0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0198.970] malloc (_Size=0x107ce) returned 0x15f622b0060 [0198.971] _vsnwprintf (in: _Buffer=0x15f622b0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x1c350ffa38 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0198.971] _vsnwprintf (in: _Buffer=0x15f622b0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x1c350ffa38 | out: _Buffer=">") returned 1 [0198.971] _get_osfhandle (_FileHandle=1) returned 0x228 [0198.971] GetFileType (hFile=0x228) returned 0x3 [0198.971] _get_osfhandle (_FileHandle=1) returned 0x228 [0198.971] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0198.971] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1c350ffa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ffa28*=0x14, lpOverlapped=0x0) returned 1 [0198.971] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.971] GetFileType (hFile=0x21c) returned 0x3 [0198.971] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.971] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.971] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0198.972] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.972] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.972] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.972] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.972] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.972] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.972] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.972] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.972] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.972] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.972] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.972] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.972] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.972] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.972] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0198.972] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.972] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.973] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.973] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.973] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.973] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.973] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.973] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.973] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.973] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.973] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.973] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.973] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.973] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.973] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.973] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.973] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.973] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.973] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.973] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.973] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.974] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.974] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.974] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.974] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.974] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.974] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.974] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.974] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.974] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.974] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.974] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.974] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.974] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.974] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.974] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.974] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0198.974] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.974] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.974] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.975] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.975] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.975] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.975] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.975] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.975] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.975] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.975] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.975] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.975] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.975] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.975] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.975] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.976] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.976] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.976] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.976] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.976] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.976] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0198.976] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.976] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.977] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0198.977] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.977] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.977] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.977] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.977] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.977] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.977] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.977] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.977] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.977] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.977] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.977] ReadFile (in: hFile=0x21c, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1c350ffd88, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x1c350ffd88*=0x1, lpOverlapped=0x0) returned 1 [0198.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0198.978] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.978] GetFileType (hFile=0x21c) returned 0x3 [0198.978] _get_osfhandle (_FileHandle=0) returned 0x21c [0198.978] SetFilePointer (in: hFile=0x21c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.978] _get_osfhandle (_FileHandle=1) returned 0x228 [0198.978] GetFileType (hFile=0x228) returned 0x3 [0198.978] _get_osfhandle (_FileHandle=1) returned 0x228 [0198.978] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0198.978] WriteFile (in: hFile=0x228, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1c350ffd28, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x1c350ffd28*=0x24, lpOverlapped=0x0) returned 1 [0198.978] GetProcessHeap () returned 0x15f62020000 [0198.978] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x4012) returned 0x15f62028bb0 [0198.979] GetProcessHeap () returned 0x15f62020000 [0198.979] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62028bb0) returned 1 [0198.979] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0198.980] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0198.980] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0198.980] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0198.980] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0198.980] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0198.980] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0198.980] GetProcessHeap () returned 0x15f62020000 [0198.980] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xb0) returned 0x15f620267a0 [0198.980] GetProcessHeap () returned 0x15f62020000 [0198.980] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x22) returned 0x15f62026a40 [0198.980] GetProcessHeap () returned 0x15f62020000 [0198.980] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x48) returned 0x15f62026a70 [0198.981] GetConsoleOutputCP () returned 0x1b5 [0199.384] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6ec31fbb0 | out: lpCPInfo=0x7ff6ec31fbb0) returned 1 [0199.385] SetThreadUILanguage (LangId=0x0) returned 0x409 [0199.992] GetConsoleTitleW (in: lpConsoleTitle=0x1c350ffb70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0200.405] malloc (_Size=0xffce) returned 0x15f622c0840 [0200.405] ??_V@YAXPEAX@Z () returned 0x15f622c0840 [0200.405] malloc (_Size=0xffce) returned 0x15f622d0820 [0200.406] ??_V@YAXPEAX@Z () returned 0x15f622d0820 [0200.407] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0200.407] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0200.407] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0200.407] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0200.407] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0200.407] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0200.407] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0200.407] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0200.407] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0200.407] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0200.407] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0200.407] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0200.407] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0200.407] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0200.407] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0200.407] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0200.407] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0200.407] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0200.407] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0200.407] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0200.407] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0200.407] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0200.407] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0200.407] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0200.407] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0200.407] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0200.407] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0200.407] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0200.407] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0200.407] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0200.407] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0200.407] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0200.408] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0200.408] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0200.408] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0200.408] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0200.408] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0200.408] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0200.408] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0200.408] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0200.408] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0200.408] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0200.408] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0200.408] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0200.408] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0200.408] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0200.408] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0200.408] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0200.408] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0200.408] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0200.408] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0200.408] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0200.408] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0200.408] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0200.408] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0200.408] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0200.408] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0200.408] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0200.408] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0200.408] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0200.408] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0200.408] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0200.408] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0200.408] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0200.408] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0200.408] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0200.408] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0200.409] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0200.409] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0200.409] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0200.409] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0200.409] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0200.409] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0200.409] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0200.409] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0200.409] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0200.409] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0200.409] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0200.409] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0200.409] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0200.409] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0200.409] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0200.409] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0200.409] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0200.409] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0200.409] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0200.409] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0200.409] ??_V@YAXPEAX@Z () returned 0x1 [0200.409] GetProcessHeap () returned 0x15f62020000 [0200.409] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xffde) returned 0x15f62028bb0 [0200.410] GetProcessHeap () returned 0x15f62020000 [0200.410] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x5a) returned 0x15f62026dc0 [0200.410] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0200.410] malloc (_Size=0xffce) returned 0x15f622d0820 [0200.410] ??_V@YAXPEAX@Z () returned 0x15f622d0820 [0200.411] GetProcessHeap () returned 0x15f62020000 [0200.411] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x1ffac) returned 0x15f62038ba0 [0200.413] SetErrorMode (uMode=0x0) returned 0x0 [0200.413] SetErrorMode (uMode=0x1) returned 0x0 [0200.413] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x15f62038bb0, lpFilePart=0x1c350ff3f0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x1c350ff3f0*="system32") returned 0x13 [0200.413] SetErrorMode (uMode=0x0) returned 0x1 [0200.413] GetProcessHeap () returned 0x15f62020000 [0200.413] RtlReAllocateHeap (Heap=0x15f62020000, Flags=0x0, Ptr=0x15f62038ba0, Size=0x4a) returned 0x15f62038ba0 [0200.413] GetProcessHeap () returned 0x15f62020000 [0200.413] RtlSizeHeap (HeapHandle=0x15f62020000, Flags=0x0, MemoryPointer=0x15f62038ba0) returned 0x4a [0200.413] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0200.413] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0200.413] GetProcessHeap () returned 0x15f62020000 [0200.413] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x1b4) returned 0x15f62038c00 [0200.413] GetProcessHeap () returned 0x15f62020000 [0200.413] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x358) returned 0x15f62038dc0 [0200.418] GetProcessHeap () returned 0x15f62020000 [0200.418] RtlReAllocateHeap (Heap=0x15f62020000, Flags=0x0, Ptr=0x15f62038dc0, Size=0x1b6) returned 0x15f62038dc0 [0200.418] GetProcessHeap () returned 0x15f62020000 [0200.418] RtlSizeHeap (HeapHandle=0x15f62020000, Flags=0x0, MemoryPointer=0x15f62038dc0) returned 0x1b6 [0200.418] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0200.418] GetProcessHeap () returned 0x15f62020000 [0200.418] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xe8) returned 0x15f62026e30 [0200.418] GetProcessHeap () returned 0x15f62020000 [0200.418] RtlReAllocateHeap (Heap=0x15f62020000, Flags=0x0, Ptr=0x15f62026e30, Size=0x7e) returned 0x15f62026e30 [0200.418] GetProcessHeap () returned 0x15f62020000 [0200.418] RtlSizeHeap (HeapHandle=0x15f62020000, Flags=0x0, MemoryPointer=0x15f62026e30) returned 0x7e [0200.419] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0200.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1c350ff160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1c350ff160) returned 0x15f62026ec0 [0200.420] GetProcessHeap () returned 0x15f62020000 [0200.420] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x0, Size=0x28) returned 0x15f62038f90 [0200.420] FindClose (in: hFindFile=0x15f62026ec0 | out: hFindFile=0x15f62026ec0) returned 1 [0200.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1c350ff160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1c350ff160) returned 0xffffffffffffffff [0200.420] GetLastError () returned 0x2 [0200.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1c350ff160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1c350ff160) returned 0x15f62026ec0 [0200.420] GetProcessHeap () returned 0x15f62020000 [0200.420] RtlReAllocateHeap (Heap=0x15f62020000, Flags=0x0, Ptr=0x15f62038f90, Size=0x8) returned 0x15f62038f90 [0200.420] FindClose (in: hFindFile=0x15f62026ec0 | out: hFindFile=0x15f62026ec0) returned 1 [0200.420] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0200.420] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0200.420] ??_V@YAXPEAX@Z () returned 0x1 [0200.420] GetConsoleTitleW (in: lpConsoleTitle=0x1c350ff6e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0201.213] GetProcessHeap () returned 0x15f62020000 [0201.213] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x21c) returned 0x15f62038fc0 [0201.213] GetConsoleTitleW (in: lpConsoleTitle=0x15f62038fd0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0201.917] GetProcessHeap () returned 0x15f62020000 [0201.917] RtlReAllocateHeap (Heap=0x15f62020000, Flags=0x0, Ptr=0x15f62038fc0, Size=0xc2) returned 0x15f62038fc0 [0201.917] GetProcessHeap () returned 0x15f62020000 [0201.917] RtlSizeHeap (HeapHandle=0x15f62020000, Flags=0x0, MemoryPointer=0x15f62038fc0) returned 0xc2 [0201.917] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0202.338] GetProcessHeap () returned 0x15f62020000 [0202.338] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62038fc0) returned 1 [0202.338] InitializeProcThreadAttributeList (in: lpAttributeList=0x1c350ff600, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1c350ff4f0 | out: lpAttributeList=0x1c350ff600, lpSize=0x1c350ff4f0) returned 1 [0202.338] UpdateProcThreadAttribute (in: lpAttributeList=0x1c350ff600, dwFlags=0x0, Attribute=0x60001, lpValue=0x1c350ff4dc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1c350ff600, lpPreviousValue=0x0) returned 1 [0202.338] GetStartupInfoW (in: lpStartupInfo=0x1c350ff590 | out: lpStartupInfo=0x1c350ff590*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x21c, hStdOutput=0x228, hStdError=0x228)) [0202.338] GetProcessHeap () returned 0x15f62020000 [0202.338] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x20) returned 0x15f62026ec0 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0202.338] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0202.339] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0202.339] GetProcessHeap () returned 0x15f62020000 [0202.339] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62026ec0) returned 1 [0202.339] GetProcessHeap () returned 0x15f62020000 [0202.339] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0x12) returned 0x15f62026ec0 [0202.339] _get_osfhandle (_FileHandle=1) returned 0x228 [0202.339] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0 [0202.339] _get_osfhandle (_FileHandle=0) returned 0x21c [0202.339] SetConsoleMode (hConsoleHandle=0x21c, dwMode=0x0) returned 0 [0202.340] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x1c350ff520*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1c350ff4f8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1c350ff4f8*(hProcess=0x9c, hThread=0x98, dwProcessId=0x998, dwThreadId=0x96c)) returned 1 [0202.359] CloseHandle (hObject=0x98) returned 1 [0202.359] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0202.359] GetProcessHeap () returned 0x15f62020000 [0202.359] RtlFreeHeap (HeapHandle=0x15f62020000, Flags=0x0, BaseAddress=0x15f62025a10) returned 1 [0202.359] GetEnvironmentStringsW () returned 0x15f62025a10* [0202.359] GetProcessHeap () returned 0x15f62020000 [0202.360] RtlAllocateHeap (HeapHandle=0x15f62020000, Flags=0x8, Size=0xac4) returned 0x15f620393d0 [0202.360] FreeEnvironmentStringsA (penv="=") returned 1 [0202.360] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff371f0000 [0202.360] GetProcAddress (hModule=0x7fff371f0000, lpProcName="NtQueryInformationProcess") returned 0x7fff372956b0 [0202.360] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x1c350fe9f8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1c350fe9f8, ReturnLength=0x0) returned 0x0 [0202.360] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0xda4e3f3000, lpBuffer=0x1c350fea30, nSize=0x7a0, lpNumberOfBytesRead=0x1c350fe9f0 | out: lpBuffer=0x1c350fea30*, lpNumberOfBytesRead=0x1c350fe9f0*=0x7a0) returned 1 [0202.360] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 124 os_tid = 0x4c4 Process: id = "16" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6ce63000" os_pid = "0xfd8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xf98" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0xfdc [0195.647] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6ec2e0000 [0195.647] __set_app_type (_Type=0x1) [0195.647] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6ec2f6d00) returned 0x0 [0195.647] __getmainargs (in: _Argc=0x7ff6ec319200, _Argv=0x7ff6ec319208, _Env=0x7ff6ec319210, _DoWildCard=0, _StartInfo=0x7ff6ec31921c | out: _Argc=0x7ff6ec319200, _Argv=0x7ff6ec319208, _Env=0x7ff6ec319210) returned 0 [0195.647] _onexit (_Func=0x7ff6ec2f7fd0) returned 0x7ff6ec2f7fd0 [0195.647] _onexit (_Func=0x7ff6ec2f7fe0) returned 0x7ff6ec2f7fe0 [0195.647] _onexit (_Func=0x7ff6ec2f7ff0) returned 0x7ff6ec2f7ff0 [0195.648] _onexit (_Func=0x7ff6ec2f8000) returned 0x7ff6ec2f8000 [0195.648] _onexit (_Func=0x7ff6ec2f8010) returned 0x7ff6ec2f8010 [0195.648] _onexit (_Func=0x7ff6ec2f8020) returned 0x7ff6ec2f8020 [0195.649] GetCurrentThreadId () returned 0xfdc [0195.649] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfdc) returned 0x70 [0195.649] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff360a0000 [0195.649] GetProcAddress (hModule=0x7fff360a0000, lpProcName="SetThreadUILanguage") returned 0x7fff360ba990 [0195.649] SetThreadUILanguage (LangId=0x0) returned 0x409 [0196.215] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0196.215] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5979d0fac8 | out: phkResult=0x5979d0fac8*=0x0) returned 0x2 [0196.215] VirtualQuery (in: lpAddress=0x5979d0fab4, lpBuffer=0x5979d0fa30, dwLength=0x30 | out: lpBuffer=0x5979d0fa30*(BaseAddress=0x5979d0f000, AllocationBase=0x5979c10000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.215] VirtualQuery (in: lpAddress=0x5979c10000, lpBuffer=0x5979d0fa30, dwLength=0x30 | out: lpBuffer=0x5979d0fa30*(BaseAddress=0x5979c10000, AllocationBase=0x5979c10000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.216] VirtualQuery (in: lpAddress=0x5979c11000, lpBuffer=0x5979d0fa30, dwLength=0x30 | out: lpBuffer=0x5979d0fa30*(BaseAddress=0x5979c11000, AllocationBase=0x5979c10000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.216] VirtualQuery (in: lpAddress=0x5979c14000, lpBuffer=0x5979d0fa30, dwLength=0x30 | out: lpBuffer=0x5979d0fa30*(BaseAddress=0x5979c14000, AllocationBase=0x5979c10000, AllocationProtect=0x4, __alignment1=0xffffb205, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.216] VirtualQuery (in: lpAddress=0x5979d10000, lpBuffer=0x5979d0fa30, dwLength=0x30 | out: lpBuffer=0x5979d0fa30*(BaseAddress=0x5979d10000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb205, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0196.216] GetConsoleOutputCP () returned 0x1b5 [0196.691] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6ec31fbb0 | out: lpCPInfo=0x7ff6ec31fbb0) returned 1 [0196.691] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6ec308150, Add=1) returned 1 [0196.692] _get_osfhandle (_FileHandle=1) returned 0x24c [0196.692] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff6ec31fc04 | out: lpMode=0x7ff6ec31fc04) returned 0 [0196.692] _get_osfhandle (_FileHandle=0) returned 0x238 [0196.692] GetConsoleMode (in: hConsoleHandle=0x238, lpMode=0x7ff6ec31fc00 | out: lpMode=0x7ff6ec31fc00) returned 0 [0196.692] _get_osfhandle (_FileHandle=1) returned 0x24c [0196.692] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0 [0196.692] _get_osfhandle (_FileHandle=1) returned 0x24c [0196.692] GetConsoleMode (in: hConsoleHandle=0x24c, lpMode=0x7ff6ec31fc08 | out: lpMode=0x7ff6ec31fc08) returned 0 [0196.692] _get_osfhandle (_FileHandle=0) returned 0x238 [0196.692] GetConsoleMode (in: hConsoleHandle=0x238, lpMode=0x7ff6ec31fc0c | out: lpMode=0x7ff6ec31fc0c) returned 0 [0196.692] GetEnvironmentStringsW () returned 0x17ac54b5a10* [0196.692] GetProcessHeap () returned 0x17ac54b0000 [0196.693] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xa7c) returned 0x17ac54b64a0 [0196.693] FreeEnvironmentStringsA (penv="A") returned 1 [0196.693] GetProcessHeap () returned 0x17ac54b0000 [0196.693] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x8) returned 0x17ac54b6f30 [0196.693] GetEnvironmentStringsW () returned 0x17ac54b5a10* [0196.693] GetProcessHeap () returned 0x17ac54b0000 [0196.693] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xa7c) returned 0x17ac54b6f50 [0196.693] FreeEnvironmentStringsA (penv="A") returned 1 [0196.693] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5979d0e978 | out: phkResult=0x5979d0e978*=0x7c) returned 0x0 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x0, lpData=0x5979d0e990*=0x4, lpcbData=0x5979d0e974*=0x1000) returned 0x2 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x1, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x0, lpData=0x5979d0e990*=0x1, lpcbData=0x5979d0e974*=0x1000) returned 0x2 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x0, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x40, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x40, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.693] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x0, lpData=0x5979d0e990*=0x40, lpcbData=0x5979d0e974*=0x1000) returned 0x2 [0196.693] RegCloseKey (hKey=0x7c) returned 0x0 [0196.694] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5979d0e978 | out: phkResult=0x5979d0e978*=0x7c) returned 0x0 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x0, lpData=0x5979d0e990*=0x40, lpcbData=0x5979d0e974*=0x1000) returned 0x2 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x1, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x0, lpData=0x5979d0e990*=0x1, lpcbData=0x5979d0e974*=0x1000) returned 0x2 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x0, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x9, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x4, lpData=0x5979d0e990*=0x9, lpcbData=0x5979d0e974*=0x4) returned 0x0 [0196.694] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5979d0e970, lpData=0x5979d0e990, lpcbData=0x5979d0e974*=0x1000 | out: lpType=0x5979d0e970*=0x0, lpData=0x5979d0e990*=0x9, lpcbData=0x5979d0e974*=0x1000) returned 0x2 [0196.694] RegCloseKey (hKey=0x7c) returned 0x0 [0196.694] time (in: timer=0x0 | out: timer=0x0) returned 0x5f09cfd0 [0196.694] srand (_Seed=0x5f09cfd0) [0196.694] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0196.694] malloc (_Size=0x4000) returned 0x17ac57954f0 [0196.694] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0196.695] malloc (_Size=0xffce) returned 0x17ac5680080 [0196.695] ??_V@YAXPEAX@Z () returned 0x17ac5680080 [0196.695] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17ac5680080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0196.696] malloc (_Size=0xffce) returned 0x17ac5690060 [0196.696] ??_V@YAXPEAX@Z () returned 0x17ac5690060 [0196.696] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17ac5690060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0196.697] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0196.697] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0196.697] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0196.697] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0196.697] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0196.697] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0196.697] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0196.697] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0196.697] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0196.697] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0196.697] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0196.697] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0196.697] GetProcessHeap () returned 0x17ac54b0000 [0196.697] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b64a0) returned 1 [0196.697] GetEnvironmentStringsW () returned 0x17ac54b5a10* [0196.698] GetProcessHeap () returned 0x17ac54b0000 [0196.698] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xa94) returned 0x17ac54b7a10 [0196.698] FreeEnvironmentStringsA (penv="A") returned 1 [0196.698] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0196.698] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0196.698] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0196.698] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0196.698] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0196.698] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0196.698] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0196.698] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0196.698] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0196.698] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0196.698] malloc (_Size=0xffce) returned 0x17ac56a0040 [0196.698] ??_V@YAXPEAX@Z () returned 0x17ac56a0040 [0196.699] GetProcessHeap () returned 0x17ac54b0000 [0196.699] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x38) returned 0x17ac54b84b0 [0196.699] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17ac56a0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0196.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x17ac56a0040, lpFilePart=0x5979d0f4f0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x5979d0f4f0*="system32") returned 0x13 [0196.700] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0196.700] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x5979d0f220 | out: lpFindFileData=0x5979d0f220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x17ac54b84f0 [0196.700] FindClose (in: hFindFile=0x17ac54b84f0 | out: hFindFile=0x17ac54b84f0) returned 1 [0196.700] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x5979d0f220 | out: lpFindFileData=0x5979d0f220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc0b701ad, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xc0b701ad, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x17ac54b84f0 [0196.700] FindClose (in: hFindFile=0x17ac54b84f0 | out: hFindFile=0x17ac54b84f0) returned 1 [0196.700] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0196.700] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0196.700] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0196.700] GetProcessHeap () returned 0x17ac54b0000 [0196.700] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b7a10) returned 1 [0196.701] GetEnvironmentStringsW () returned 0x17ac54b84f0* [0196.701] GetProcessHeap () returned 0x17ac54b0000 [0196.701] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xac4) returned 0x17ac54b5a10 [0196.701] FreeEnvironmentStringsA (penv="=") returned 1 [0196.701] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17ac5680080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0196.701] GetProcessHeap () returned 0x17ac54b0000 [0196.701] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b84b0) returned 1 [0196.701] ??_V@YAXPEAX@Z () returned 0x1 [0196.701] ??_V@YAXPEAX@Z () returned 0x1 [0196.701] GetProcessHeap () returned 0x17ac54b0000 [0196.701] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x4016) returned 0x17ac54b7a10 [0196.701] GetProcessHeap () returned 0x17ac54b0000 [0196.701] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b7a10) returned 1 [0196.701] GetConsoleOutputCP () returned 0x1b5 [0197.168] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6ec31fbb0 | out: lpCPInfo=0x7ff6ec31fbb0) returned 1 [0197.168] GetUserDefaultLCID () returned 0x409 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6ec31bb78, cchData=8 | out: lpLCData=":") returned 2 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x5979d0f8b0, cchData=128 | out: lpLCData="0") returned 2 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x5979d0f8b0, cchData=128 | out: lpLCData="0") returned 2 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x5979d0f8b0, cchData=128 | out: lpLCData="1") returned 2 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6ec31bb68, cchData=8 | out: lpLCData="/") returned 2 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6ec31bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6ec31bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6ec31ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6ec31ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6ec31ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6ec31b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6ec31b980, cchData=32 | out: lpLCData="Sun") returned 4 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6ec31bb58, cchData=8 | out: lpLCData=".") returned 2 [0197.169] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6ec31bb40, cchData=8 | out: lpLCData=",") returned 2 [0197.169] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0197.171] GetProcessHeap () returned 0x17ac54b0000 [0197.171] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x0, Size=0x20c) returned 0x17ac54b6550 [0197.171] GetConsoleTitleW (in: lpConsoleTitle=0x17ac54b6550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0197.603] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.603] GetFileType (hFile=0x24c) returned 0x3 [0197.604] ApiSetQueryApiSetPresence () returned 0x0 [0197.604] ResolveDelayLoadedAPI () returned 0x7fff2c0cd990 [0197.613] BrandingFormatString () returned 0x17ac54b6a40 [0197.621] GetVersion () returned 0x3ad7000a [0197.621] _vsnwprintf (in: _Buffer=0x5979d0fa10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x5979d0f9a8 | out: _Buffer="10.0.15063") returned 10 [0197.621] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.621] GetFileType (hFile=0x24c) returned 0x3 [0197.621] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6ec327f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0197.622] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6ec327f60, nSize=0x2000, Arguments=0x5979d0f9b0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0197.622] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x5979d0f908, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f908*=0x26, lpOverlapped=0x0) returned 1 [0197.622] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5979d0f9d8 | out: _Buffer="\r\n") returned 2 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] GetFileType (hFile=0x24c) returned 0x3 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0197.622] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5979d0f9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f9a8*=0x2, lpOverlapped=0x0) returned 1 [0197.622] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x5979d0f9d8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] GetFileType (hFile=0x24c) returned 0x3 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0197.622] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x5979d0f9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f9a8*=0x34, lpOverlapped=0x0) returned 1 [0197.622] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5979d0f9d8 | out: _Buffer="\r\n") returned 2 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] GetFileType (hFile=0x24c) returned 0x3 [0197.622] _get_osfhandle (_FileHandle=1) returned 0x24c [0197.622] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0197.622] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5979d0f9a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f9a8*=0x2, lpOverlapped=0x0) returned 1 [0197.623] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff360a0000 [0197.623] GetProcAddress (hModule=0x7fff360a0000, lpProcName="CopyFileExW") returned 0x7fff360be830 [0197.623] GetProcAddress (hModule=0x7fff360a0000, lpProcName="IsDebuggerPresent") returned 0x7fff360be300 [0197.623] GetProcAddress (hModule=0x7fff360a0000, lpProcName="SetConsoleInputExeNameW") returned 0x7fff338d0a40 [0197.623] ??_V@YAXPEAX@Z () returned 0x1 [0197.624] _get_osfhandle (_FileHandle=0) returned 0x238 [0197.624] GetFileType (hFile=0x238) returned 0x3 [0197.624] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0197.624] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x5979d0f818 | out: TokenHandle=0x5979d0f818*=0x0) returned 0xc000007c [0197.624] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x5979d0f818 | out: TokenHandle=0x5979d0f818*=0x98) returned 0x0 [0197.624] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x5979d0f7c8, TokenInformationLength=0x4, ReturnLength=0x5979d0f7d0 | out: TokenInformation=0x5979d0f7c8, ReturnLength=0x5979d0f7d0) returned 0x0 [0197.624] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x5979d0f7d0, TokenInformationLength=0x4, ReturnLength=0x5979d0f7c8 | out: TokenInformation=0x5979d0f7d0, ReturnLength=0x5979d0f7c8) returned 0x0 [0197.624] NtClose (Handle=0x98) returned 0x0 [0197.624] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x5979d0f7e0, nSize=0x0, Arguments=0x5979d0f7e8 | out: lpBuffer="枠앋ź") returned 0xf [0197.625] GetProcessHeap () returned 0x17ac54b0000 [0197.625] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x218) returned 0x17ac54b8bb0 [0197.625] GetConsoleTitleW (in: lpConsoleTitle=0x5979d0f830, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0198.254] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0198.254] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0198.712] GetProcessHeap () returned 0x17ac54b0000 [0198.712] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b8bb0) returned 1 [0198.712] LocalFree (hMem=0x17ac54b67a0) returned 0x0 [0198.714] _vsnwprintf (in: _Buffer=0x7ff6ec327f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x5979d0f658 | out: _Buffer="\r\n") returned 2 [0198.714] _get_osfhandle (_FileHandle=1) returned 0x24c [0198.714] GetFileType (hFile=0x24c) returned 0x3 [0198.714] _get_osfhandle (_FileHandle=1) returned 0x24c [0198.714] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.714] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x5979d0f628, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f628*=0x2, lpOverlapped=0x0) returned 1 [0198.714] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0198.714] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x17ac5680080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0198.714] malloc (_Size=0x107ce) returned 0x17ac5690060 [0198.715] _vsnwprintf (in: _Buffer=0x17ac5690060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x5979d0f668 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0198.715] _vsnwprintf (in: _Buffer=0x17ac5690086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x5979d0f668 | out: _Buffer=">") returned 1 [0198.715] _get_osfhandle (_FileHandle=1) returned 0x24c [0198.715] GetFileType (hFile=0x24c) returned 0x3 [0198.715] _get_osfhandle (_FileHandle=1) returned 0x24c [0198.715] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0198.715] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x5979d0f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f658*=0x14, lpOverlapped=0x0) returned 1 [0198.715] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.715] GetFileType (hFile=0x238) returned 0x3 [0198.715] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.715] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.715] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.716] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.716] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.716] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.716] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.716] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.716] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.716] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.716] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.716] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.716] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.716] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.716] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.716] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.716] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.716] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.716] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.716] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0198.716] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.716] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.716] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.716] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.716] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.716] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.717] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.717] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.717] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.717] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.717] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.717] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.717] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0198.717] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.717] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.717] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.717] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.717] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.717] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.717] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.717] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.717] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.717] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.717] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.718] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.718] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.718] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.718] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.718] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.718] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0198.718] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.718] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.718] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.718] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.718] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.718] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.718] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.718] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.718] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.718] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.718] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.718] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.718] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.718] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.718] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.718] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.718] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.718] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.719] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.719] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.719] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.719] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.719] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.719] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.719] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.719] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.719] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.719] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.719] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.719] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.719] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0198.719] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.719] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.719] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0198.719] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.719] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.719] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.720] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.720] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.720] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.720] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.720] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.720] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.720] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.720] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.720] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.720] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.720] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.720] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.720] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.720] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.720] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0198.720] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.720] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.720] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.720] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.721] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.721] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.721] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.721] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.721] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.721] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.721] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.721] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.721] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.721] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.721] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.721] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.721] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.722] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.722] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.722] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.722] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.722] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.722] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.722] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.722] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.722] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.722] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.722] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.722] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.722] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.722] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.722] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.722] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.722] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.722] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.723] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.723] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.723] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.723] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.723] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.723] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.723] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.723] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.723] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.723] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.723] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.723] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.723] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.723] ReadFile (in: hFile=0x238, lpBuffer=0x7ff6ec319970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5979d0f9b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesRead=0x5979d0f9b8*=0x1, lpOverlapped=0x0) returned 1 [0198.723] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=1, lpWideCharStr=0x7ff6ec323c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0198.724] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.724] GetFileType (hFile=0x238) returned 0x3 [0198.724] _get_osfhandle (_FileHandle=0) returned 0x238 [0198.724] SetFilePointer (in: hFile=0x238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.724] _get_osfhandle (_FileHandle=1) returned 0x24c [0198.724] GetFileType (hFile=0x24c) returned 0x3 [0198.724] _get_osfhandle (_FileHandle=1) returned 0x24c [0198.724] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff6ec319970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0198.724] WriteFile (in: hFile=0x24c, lpBuffer=0x7ff6ec319970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x5979d0f958, lpOverlapped=0x0 | out: lpBuffer=0x7ff6ec319970*, lpNumberOfBytesWritten=0x5979d0f958*=0x2f, lpOverlapped=0x0) returned 1 [0198.724] GetProcessHeap () returned 0x17ac54b0000 [0198.724] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x4012) returned 0x17ac54b8bb0 [0198.725] GetProcessHeap () returned 0x17ac54b0000 [0198.725] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b8bb0) returned 1 [0198.725] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0198.725] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0198.725] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0198.726] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0198.726] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0198.726] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0198.726] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0198.726] GetProcessHeap () returned 0x17ac54b0000 [0198.726] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xb0) returned 0x17ac54b67a0 [0198.726] GetProcessHeap () returned 0x17ac54b0000 [0198.726] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x1c) returned 0x17ac54b6a40 [0198.726] GetProcessHeap () returned 0x17ac54b0000 [0198.726] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x64) returned 0x17ac54b6dc0 [0198.727] GetConsoleOutputCP () returned 0x1b5 [0199.212] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6ec31fbb0 | out: lpCPInfo=0x7ff6ec31fbb0) returned 1 [0199.212] SetThreadUILanguage (LangId=0x0) returned 0x409 [0199.589] GetConsoleTitleW (in: lpConsoleTitle=0x5979d0f7a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0200.212] malloc (_Size=0xffce) returned 0x17ac56a0840 [0200.212] ??_V@YAXPEAX@Z () returned 0x17ac56a0840 [0200.213] malloc (_Size=0xffce) returned 0x17ac56b0820 [0200.213] ??_V@YAXPEAX@Z () returned 0x17ac56b0820 [0200.214] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0200.214] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0200.214] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0200.214] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0200.214] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0200.214] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0200.214] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0200.214] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0200.214] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0200.214] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0200.214] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0200.214] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0200.214] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0200.214] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0200.214] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0200.214] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0200.214] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0200.214] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0200.214] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0200.214] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0200.214] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0200.214] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0200.214] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0200.214] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0200.215] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0200.215] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0200.215] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0200.215] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0200.215] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0200.215] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0200.215] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0200.215] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0200.215] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0200.215] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0200.215] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0200.215] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0200.215] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0200.215] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0200.215] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0200.215] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0200.215] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0200.215] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0200.215] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0200.215] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0200.215] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0200.215] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0200.215] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0200.215] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0200.215] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0200.215] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0200.215] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0200.215] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0200.215] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0200.215] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0200.215] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0200.215] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0200.215] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0200.215] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0200.216] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0200.216] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0200.216] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0200.216] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0200.216] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0200.216] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0200.216] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0200.216] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0200.216] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0200.216] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0200.216] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0200.216] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0200.216] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0200.216] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0200.216] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0200.216] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0200.216] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0200.216] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0200.216] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0200.216] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0200.216] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0200.216] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0200.216] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0200.216] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0200.216] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0200.216] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0200.216] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0200.216] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0200.216] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0200.217] ??_V@YAXPEAX@Z () returned 0x1 [0200.217] GetProcessHeap () returned 0x17ac54b0000 [0200.217] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xffde) returned 0x17ac54b8bb0 [0200.217] GetProcessHeap () returned 0x17ac54b0000 [0200.217] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x70) returned 0x17ac54b6e30 [0200.217] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0200.217] malloc (_Size=0xffce) returned 0x17ac56b0820 [0200.218] ??_V@YAXPEAX@Z () returned 0x17ac56b0820 [0200.218] GetProcessHeap () returned 0x17ac54b0000 [0200.218] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x1ffac) returned 0x17ac54c8ba0 [0200.220] SetErrorMode (uMode=0x0) returned 0x0 [0200.220] SetErrorMode (uMode=0x1) returned 0x0 [0200.220] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x17ac54c8bb0, lpFilePart=0x5979d0f020 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x5979d0f020*="system32") returned 0x13 [0200.220] SetErrorMode (uMode=0x0) returned 0x1 [0200.220] GetProcessHeap () returned 0x17ac54b0000 [0200.220] RtlReAllocateHeap (Heap=0x17ac54b0000, Flags=0x0, Ptr=0x17ac54c8ba0, Size=0x44) returned 0x17ac54c8ba0 [0200.220] GetProcessHeap () returned 0x17ac54b0000 [0200.220] RtlSizeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, MemoryPointer=0x17ac54c8ba0) returned 0x44 [0200.220] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0200.220] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0200.220] GetProcessHeap () returned 0x17ac54b0000 [0200.220] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x1b4) returned 0x17ac54c8c00 [0200.220] GetProcessHeap () returned 0x17ac54b0000 [0200.220] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x358) returned 0x17ac54c8dc0 [0200.229] GetProcessHeap () returned 0x17ac54b0000 [0200.229] RtlReAllocateHeap (Heap=0x17ac54b0000, Flags=0x0, Ptr=0x17ac54c8dc0, Size=0x1b6) returned 0x17ac54c8dc0 [0200.229] GetProcessHeap () returned 0x17ac54b0000 [0200.230] RtlSizeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, MemoryPointer=0x17ac54c8dc0) returned 0x1b6 [0200.230] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6ec31bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0200.230] GetProcessHeap () returned 0x17ac54b0000 [0200.230] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xe8) returned 0x17ac54c8f90 [0200.231] GetProcessHeap () returned 0x17ac54b0000 [0200.231] RtlReAllocateHeap (Heap=0x17ac54b0000, Flags=0x0, Ptr=0x17ac54c8f90, Size=0x7e) returned 0x17ac54c8f90 [0200.231] GetProcessHeap () returned 0x17ac54b0000 [0200.232] RtlSizeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, MemoryPointer=0x17ac54c8f90) returned 0x7e [0200.232] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0200.232] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x5979d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5979d0ed90) returned 0x17ac54b6eb0 [0200.233] GetProcessHeap () returned 0x17ac54b0000 [0200.233] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x0, Size=0x28) returned 0x17ac54b6a70 [0200.233] FindClose (in: hFindFile=0x17ac54b6eb0 | out: hFindFile=0x17ac54b6eb0) returned 1 [0200.233] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x5979d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5979d0ed90) returned 0xffffffffffffffff [0200.233] GetLastError () returned 0x2 [0200.233] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x5979d0ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5979d0ed90) returned 0x17ac54b6eb0 [0200.233] GetProcessHeap () returned 0x17ac54b0000 [0200.233] RtlReAllocateHeap (Heap=0x17ac54b0000, Flags=0x0, Ptr=0x17ac54b6a70, Size=0x8) returned 0x17ac54b6a70 [0200.233] FindClose (in: hFindFile=0x17ac54b6eb0 | out: hFindFile=0x17ac54b6eb0) returned 1 [0200.233] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0200.233] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0200.233] ??_V@YAXPEAX@Z () returned 0x1 [0200.233] GetConsoleTitleW (in: lpConsoleTitle=0x5979d0f310, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0200.884] GetProcessHeap () returned 0x17ac54b0000 [0200.884] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x21c) returned 0x17ac54c9020 [0200.884] GetConsoleTitleW (in: lpConsoleTitle=0x17ac54c9030, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0201.609] GetProcessHeap () returned 0x17ac54b0000 [0201.609] RtlReAllocateHeap (Heap=0x17ac54b0000, Flags=0x0, Ptr=0x17ac54c9020, Size=0xd8) returned 0x17ac54c9020 [0201.609] GetProcessHeap () returned 0x17ac54b0000 [0201.609] RtlSizeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, MemoryPointer=0x17ac54c9020) returned 0xd8 [0201.609] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0202.106] GetProcessHeap () returned 0x17ac54b0000 [0202.106] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54c9020) returned 1 [0202.106] InitializeProcThreadAttributeList (in: lpAttributeList=0x5979d0f230, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x5979d0f120 | out: lpAttributeList=0x5979d0f230, lpSize=0x5979d0f120) returned 1 [0202.106] UpdateProcThreadAttribute (in: lpAttributeList=0x5979d0f230, dwFlags=0x0, Attribute=0x60001, lpValue=0x5979d0f10c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x5979d0f230, lpPreviousValue=0x0) returned 1 [0202.106] GetStartupInfoW (in: lpStartupInfo=0x5979d0f1c0 | out: lpStartupInfo=0x5979d0f1c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x238, hStdOutput=0x24c, hStdError=0x24c)) [0202.106] GetProcessHeap () returned 0x17ac54b0000 [0202.106] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x20) returned 0x17ac54b6eb0 [0202.106] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0202.107] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0202.108] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0202.108] GetProcessHeap () returned 0x17ac54b0000 [0202.108] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b6eb0) returned 1 [0202.108] GetProcessHeap () returned 0x17ac54b0000 [0202.108] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0x12) returned 0x17ac54b6aa0 [0202.108] _get_osfhandle (_FileHandle=1) returned 0x24c [0202.108] SetConsoleMode (hConsoleHandle=0x24c, dwMode=0x0) returned 0 [0202.108] _get_osfhandle (_FileHandle=0) returned 0x238 [0202.108] SetConsoleMode (hConsoleHandle=0x238, dwMode=0x0) returned 0 [0202.108] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x5979d0f150*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x5979d0f128 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x5979d0f128*(hProcess=0x9c, hThread=0x98, dwProcessId=0xcb0, dwThreadId=0x920)) returned 1 [0202.191] CloseHandle (hObject=0x98) returned 1 [0202.191] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0202.191] GetProcessHeap () returned 0x17ac54b0000 [0202.191] RtlFreeHeap (HeapHandle=0x17ac54b0000, Flags=0x0, BaseAddress=0x17ac54b5a10) returned 1 [0202.191] GetEnvironmentStringsW () returned 0x17ac54b5a10* [0202.191] GetProcessHeap () returned 0x17ac54b0000 [0202.191] RtlAllocateHeap (HeapHandle=0x17ac54b0000, Flags=0x8, Size=0xac4) returned 0x17ac54c93d0 [0202.191] FreeEnvironmentStringsA (penv="=") returned 1 [0202.192] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff371f0000 [0202.192] GetProcAddress (hModule=0x7fff371f0000, lpProcName="NtQueryInformationProcess") returned 0x7fff372956b0 [0202.192] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x5979d0e628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x5979d0e628, ReturnLength=0x0) returned 0x0 [0202.192] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x8bcf935000, lpBuffer=0x5979d0e660, nSize=0x7a0, lpNumberOfBytesRead=0x5979d0e620 | out: lpBuffer=0x5979d0e660*, lpNumberOfBytesRead=0x5979d0e620*=0x7a0) returned 1 [0202.206] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 123 os_tid = 0x4a8 Process: id = "17" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6d325000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xfd0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 109 os_tid = 0xff8 Thread: id = 116 os_tid = 0xc9c Thread: id = 118 os_tid = 0x64c Thread: id = 121 os_tid = 0x62c Thread: id = 122 os_tid = 0x630 Thread: id = 130 os_tid = 0x960 Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6cc97000" os_pid = "0xffc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xfd8" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0xc4c Thread: id = 115 os_tid = 0x37c Thread: id = 117 os_tid = 0x644 Thread: id = 119 os_tid = 0x8e8 Thread: id = 120 os_tid = 0x638 Thread: id = 131 os_tid = 0x8b4 Process: id = "19" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x6819e000" os_pid = "0xcb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xfd8" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 125 os_tid = 0x920 [0203.381] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6ca190000 [0203.381] __set_app_type (_Type=0x1) [0203.381] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6ca19a1c0) returned 0x0 [0203.381] __wgetmainargs (in: _Argc=0x7ff6ca1a7668, _Argv=0x7ff6ca1a7670, _Env=0x7ff6ca1a7678, _DoWildCard=0, _StartInfo=0x7ff6ca1a7684 | out: _Argc=0x7ff6ca1a7668, _Argv=0x7ff6ca1a7670, _Env=0x7ff6ca1a7678) returned 0 [0203.382] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0203.382] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6ca190000 [0203.382] _vsnwprintf (in: _Buffer=0x7ff6ca1a9b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x8bcf7a72e8 | out: _Buffer="netsh>") returned 6 [0203.382] GetProcessHeap () returned 0x236c52e0000 [0203.382] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee600 [0203.382] GetProcessHeap () returned 0x236c52e0000 [0203.382] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eec20 [0203.382] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee6a0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee5e0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee9c0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee9e0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee7c0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eec00 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeaa0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee880 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee7e0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee780 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeb00 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eec40 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eea60 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee8a0 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee800 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee620 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee640 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee820 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeb40 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee920 [0203.383] GetProcessHeap () returned 0x236c52e0000 [0203.383] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee560 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeb80 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeba0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeae0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee8c0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeb20 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee660 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee520 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee720 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeb60 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee680 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee4e0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee500 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eebc0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee8e0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee7a0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eebe0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee840 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee6c0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee6e0 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.384] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee900 [0203.384] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee700 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee4c0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee860 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee940 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee540 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eeac0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee580 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee960 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee740 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eea00 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee5a0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee980 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee760 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eea40 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee9a0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eea20 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eea80 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52ee5c0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f03d0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efdf0 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.385] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0370 [0203.385] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efdb0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0390 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efed0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0150 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f01f0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0230 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0090 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f00b0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f00d0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f03f0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f02b0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0070 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efd70 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0350 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0310 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efd90 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0210 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0250 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efdd0 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eff70 [0203.386] GetProcessHeap () returned 0x236c52e0000 [0203.386] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0290 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0050 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0330 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0270 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0130 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f02d0 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eff10 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f00f0 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f02f0 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0110 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eff30 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f03b0 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efe10 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0410 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0430 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efe30 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.387] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0450 [0203.387] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0470 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efcf0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efe50 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f01b0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efd30 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0170 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efd10 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efe70 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efe90 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efd50 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efeb0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eff90 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52effb0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efef0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52eff50 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52effd0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52efff0 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0010 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0030 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.388] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0190 [0203.388] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f01d0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0a60 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0ae0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0b40 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f06a0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f05a0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f08e0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0660 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0860 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0b80 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0900 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f08c0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0bc0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0a00 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0820 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0be0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0520 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f06c0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f07c0 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0560 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.389] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0720 [0203.389] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f05c0 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0740 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0ba0 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0b60 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0c00 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f07e0 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0c20 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0780 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f05e0 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0a20 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0760 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0a40 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0920 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0540 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0700 [0203.390] GetProcessHeap () returned 0x236c52e0000 [0203.390] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0620 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f06e0 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0880 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0a80 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f07a0 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0aa0 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0600 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0940 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0c40 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0580 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0c60 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0ac0 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f08a0 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0800 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0c80 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0840 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0500 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0640 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0960 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0680 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0980 [0203.391] GetProcessHeap () returned 0x236c52e0000 [0203.391] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0b00 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f09a0 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0b20 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f09c0 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f09e0 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1050 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0d90 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0d50 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1450 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1310 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0dd0 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1210 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0f90 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0fb0 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0e10 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1270 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f11b0 [0203.392] GetProcessHeap () returned 0x236c52e0000 [0203.392] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f11d0 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0f30 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1330 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1370 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0d70 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1010 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1290 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1250 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1350 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0eb0 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0e30 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0ff0 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1390 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f0fd0 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1470 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c52f1030 [0203.393] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0203.393] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.393] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x28) returned 0x236c52e87c0 [0203.393] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x2) returned 0x236c52edb00 [0203.394] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x14) returned 0x236c52f1070 [0203.394] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0203.394] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x0) returned 1 [0203.394] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x58) returned 0x236c52e56b0 [0203.394] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x0) returned 1 [0203.394] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0xb0) returned 0x236c52e5030 [0203.394] GetProcessHeap () returned 0x236c52e0000 [0203.394] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e56b0) returned 1 [0203.394] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7fff33660000 [0203.397] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x8bcf7a7298 | out: phkResult=0x8bcf7a7298*=0xb4) returned 0x0 [0203.397] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x8bcf7a72d0, lpcbMaxValueNameLen=0x8bcf7a72e0, lpcbMaxValueLen=0x8bcf7a72d8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x8bcf7a72d0*=0x14, lpcbMaxValueNameLen=0x8bcf7a72e0, lpcbMaxValueLen=0x8bcf7a72d8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0203.397] GetProcessHeap () returned 0x236c52e0000 [0203.397] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x8, Size=0x16) returned 0x236c52f0e50 [0203.397] GetProcessHeap () returned 0x236c52e0000 [0203.397] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x8, Size=0x23) returned 0x236c52e8730 [0203.397] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="2", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0203.397] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0203.397] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0203.397] GetProcessHeap () returned 0x236c52e0000 [0203.397] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x50) returned 0x236c52f1a00 [0203.397] GetProcessHeap () returned 0x236c52e0000 [0203.397] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x4) returned 0x236c52edba0 [0203.397] GetProcessHeap () returned 0x236c52e0000 [0203.397] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x14) returned 0x236c52f0d10 [0203.397] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0203.397] GetProcessHeap () returned 0x236c52e0000 [0203.397] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e87c0) returned 1 [0203.397] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff2ad10000 [0203.481] GetProcAddress (hModule=0x7fff2ad10000, lpProcName="InitHelperDll") returned 0x7fff2ad11310 [0203.481] InitHelperDll () returned 0x0 [0203.484] RegisterHelper () returned 0x0 [0203.484] GetProcessHeap () returned 0x236c52e0000 [0203.484] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x108) returned 0x236c52e42e0 [0203.484] GetProcessHeap () returned 0x236c52e0000 [0203.484] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e5030) returned 1 [0203.708] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="4", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0203.709] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0203.709] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0203.709] GetProcessHeap () returned 0x236c52e0000 [0203.709] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x78) returned 0x236c52e5030 [0203.709] GetProcessHeap () returned 0x236c52e0000 [0203.709] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x4) returned 0x236c52edb10 [0203.709] GetProcessHeap () returned 0x236c52e0000 [0203.709] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x1a) returned 0x236c52e86d0 [0203.709] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0203.709] GetProcessHeap () returned 0x236c52e0000 [0203.709] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52f1a00) returned 1 [0203.709] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff1ce80000 [0204.352] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7fff36720000 [0204.353] GetVersion () returned 0x3ad7000a [0204.353] SetErrorMode (uMode=0x0) returned 0x0 [0204.353] SetErrorMode (uMode=0x8001) returned 0x0 [0204.353] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x236c5302c00 [0204.354] LocalFree (hMem=0x236c5302c00) returned 0x0 [0204.354] GetVersion () returned 0x3ad7000a [0204.355] GlobalLock (hMem=0x236c6bd0008) returned 0x236c5302c00 [0204.356] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x236c5302e20 [0204.356] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x236c52f9640 [0204.356] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x236c52f1130 [0204.356] malloc (_Size=0x100) returned 0x236c55b6de0 [0204.357] __dllonexit () returned 0x7fff1cc41200 [0204.357] __dllonexit () returned 0x7fff1cc411f0 [0204.357] __dllonexit () returned 0x7fff1cc41240 [0204.357] __dllonexit () returned 0x7fff1cc412a0 [0204.357] __dllonexit () returned 0x7fff1cc41390 [0204.357] __dllonexit () returned 0x7fff1cc413a0 [0204.357] __dllonexit () returned 0x7fff1cc41420 [0204.357] __dllonexit () returned 0x7fff1cc414c0 [0204.357] __dllonexit () returned 0x7fff1cc412c0 [0204.358] __dllonexit () returned 0x7fff1cc659c0 [0204.358] __dllonexit () returned 0x7fff1cc412e0 [0204.358] __dllonexit () returned 0x7fff1cc41470 [0204.358] __dllonexit () returned 0x7fff1cc41490 [0204.358] __dllonexit () returned 0x7fff1cc414e0 [0204.358] __dllonexit () returned 0x7fff1cc41500 [0204.358] __dllonexit () returned 0x7fff1cc41520 [0204.358] __dllonexit () returned 0x7fff1cc41550 [0204.358] __dllonexit () returned 0x7fff1cc41610 [0204.358] __dllonexit () returned 0x7fff1cc41050 [0204.358] __dllonexit () returned 0x7fff1cc41070 [0204.358] __dllonexit () returned 0x7fff1cc41030 [0204.361] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc153 [0204.361] __dllonexit () returned 0x7fff1cc659a0 [0204.361] __dllonexit () returned 0x7fff1cc65980 [0204.362] __dllonexit () returned 0x7fff1cc659b0 [0204.362] __dllonexit () returned 0x7fff1cc65990 [0204.362] GetVersion () returned 0x3ad7000a [0204.362] GetVersion () returned 0x3ad7000a [0204.362] GetVersion () returned 0x3ad7000a [0204.362] __dllonexit () returned 0x7fff1cc528e0 [0204.362] __dllonexit () returned 0x7fff1cc52910 [0204.362] __dllonexit () returned 0x7fff1cc41300 [0204.362] __dllonexit () returned 0x7fff1cc413b0 [0204.362] __dllonexit () returned 0x7fff1cc413d0 [0204.362] __dllonexit () returned 0x7fff1cc526e0 [0204.363] GetVersion () returned 0x3ad7000a [0204.363] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0204.363] GetSystemMetrics (nIndex=11) returned 32 [0204.363] GetSystemMetrics (nIndex=12) returned 32 [0204.363] GetSystemMetrics (nIndex=2) returned 17 [0204.363] GetSystemMetrics (nIndex=3) returned 17 [0204.363] GetDC (hWnd=0x0) returned 0x60101a5 [0204.363] GetDeviceCaps (hdc=0x60101a5, index=88) returned 96 [0204.363] GetDeviceCaps (hdc=0x60101a5, index=90) returned 96 [0204.363] ReleaseDC (hWnd=0x0, hDC=0x60101a5) returned 1 [0204.363] GetSysColor (nIndex=15) returned 0xf0f0f0 [0204.363] GetSysColor (nIndex=16) returned 0xa0a0a0 [0204.363] GetSysColor (nIndex=20) returned 0xffffff [0204.363] GetSysColor (nIndex=18) returned 0x0 [0204.363] GetSysColor (nIndex=6) returned 0x646464 [0204.363] GetSysColorBrush (nIndex=15) returned 0x100072 [0204.363] GetSysColorBrush (nIndex=6) returned 0x10007a [0204.363] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0204.364] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0204.364] __dllonexit () returned 0x7fff1cc41450 [0204.364] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc152 [0204.364] __dllonexit () returned 0x7fff1cc526c0 [0204.364] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0204.364] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0204.364] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0204.364] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0204.364] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0204.364] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0204.364] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0204.364] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0204.364] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0204.364] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0204.364] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc07a [0204.364] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc083 [0204.364] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc152 [0204.365] __dllonexit () returned 0x7fff1cc659d0 [0204.365] __dllonexit () returned 0x7fff1cc659f0 [0204.365] __dllonexit () returned 0x7fff1cc65a00 [0204.365] __dllonexit () returned 0x7fff1cc65a10 [0204.365] __dllonexit () returned 0x7fff1cc65a20 [0204.365] GetCursorPos (in: lpPoint=0x7fff1cd85ae8 | out: lpPoint=0x7fff1cd85ae8*(x=255, y=92)) returned 1 [0204.366] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x236c5301fa0 [0204.366] LocalReAlloc (hMem=0x236c52f1130, uBytes=0x18, uFlags=0x2) returned 0x236c52fd000 [0204.366] GetCurrentThread () returned 0xfffffffffffffffe [0204.366] GetCurrentThreadId () returned 0x920 [0204.366] __dllonexit () returned 0x7fff1cc41620 [0204.366] SetErrorMode (uMode=0x0) returned 0x8001 [0204.366] SetErrorMode (uMode=0x8001) returned 0x0 [0204.366] GetModuleFileNameW (in: hModule=0x7fff1cc40000, lpFilename=0x8bcf7a6270, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0204.366] wcscpy_s (in: _Destination=0x8bcf7a6480, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0204.367] FindResourceW (hModule=0x7fff1cc40000, lpName=0xe01, lpType=0x6) returned 0x236c5280bb0 [0204.369] LoadStringW (in: hInstance=0x7fff1cc40000, uID=0xe000, lpBuffer=0x8bcf7a6690, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0204.370] wcscpy_s (in: _Destination=0x8bcf7a62a4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0204.370] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0204.419] malloc (_Size=0x80) returned 0x236c55b6e00 [0204.419] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x236c5303170 [0204.419] GetSystemDirectoryA (in: lpBuffer=0x8bcf7a6910, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0204.419] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0204.419] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0204.419] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0204.419] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0204.422] GetProcAddress (hModule=0x7fff1ce80000, lpProcName="InitHelperDll") returned 0x7fff1ce95850 [0204.422] InitHelperDll () returned 0x0 [0204.424] RegisterHelper () returned 0x0 [0204.424] GetProcessHeap () returned 0x236c52e0000 [0204.424] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x160) returned 0x236c52fac30 [0204.424] GetProcessHeap () returned 0x236c52e0000 [0204.424] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e42e0) returned 1 [0204.424] RegisterHelper () returned 0x0 [0204.424] GetProcessHeap () returned 0x236c52e0000 [0204.424] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x1b8) returned 0x236c52fada0 [0204.424] GetProcessHeap () returned 0x236c52e0000 [0204.424] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fac30) returned 1 [0204.426] RegisterHelper () returned 0x0 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x210) returned 0x236c52fd020 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fada0) returned 1 [0204.426] RegisterHelper () returned 0x0 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x268) returned 0x236c52fac30 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fd020) returned 1 [0204.426] RegisterHelper () returned 0x0 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x2c0) returned 0x236c52fd020 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fac30) returned 1 [0204.426] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="authfwcfg", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0204.426] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0204.426] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0xa0) returned 0x236c52e2830 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x14) returned 0x236c52f1150 [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x1c) returned 0x236c52f9a30 [0204.426] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0204.426] GetProcessHeap () returned 0x236c52e0000 [0204.426] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e5030) returned 1 [0204.426] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff1cbc0000 [0204.527] GetProcAddress (hModule=0x7fff1cbc0000, lpProcName="InitHelperDll") returned 0x7fff1cbc1430 [0204.527] InitHelperDll () returned 0x0 [0204.566] RegisterHelper () returned 0x0 [0204.566] GetProcessHeap () returned 0x236c52e0000 [0204.566] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x318) returned 0x236c52fac30 [0204.566] GetProcessHeap () returned 0x236c52e0000 [0204.566] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fd020) returned 1 [0204.566] RegisterHelper () returned 0x0 [0204.566] GetProcessHeap () returned 0x236c52e0000 [0204.566] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x370) returned 0x236c52fd020 [0204.566] GetProcessHeap () returned 0x236c52e0000 [0204.566] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fac30) returned 1 [0204.567] RegisterHelper () returned 0x0 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x3c8) returned 0x236c5305a90 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52fd020) returned 1 [0204.567] RegisterHelper () returned 0x0 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x420) returned 0x236c5305e60 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c5305a90) returned 1 [0204.567] RegisterHelper () returned 0x0 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x478) returned 0x236c5306290 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c5305e60) returned 1 [0204.567] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="dhcpclient", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0204.567] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0204.567] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0xc8) returned 0x236c52f8400 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x16) returned 0x236c5305530 [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x22) returned 0x236c52f9580 [0204.567] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0204.567] GetProcessHeap () returned 0x236c52e0000 [0204.567] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e2830) returned 1 [0204.567] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff2acc0000 [0204.608] GetProcAddress (hModule=0x7fff2acc0000, lpProcName="InitHelperDll") returned 0x7fff2acc1610 [0204.608] InitHelperDll () returned 0x0 [0204.608] RegisterHelper () returned 0x0 [0204.608] GetProcessHeap () returned 0x236c52e0000 [0204.608] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x4d0) returned 0x236c5305a90 [0204.608] GetProcessHeap () returned 0x236c52e0000 [0204.608] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c5306290) returned 1 [0204.608] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="dot3cfg", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0204.608] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0204.608] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0204.608] GetProcessHeap () returned 0x236c52e0000 [0204.608] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0xf0) returned 0x236c52e42e0 [0204.608] GetProcessHeap () returned 0x236c52e0000 [0204.608] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c5305990 [0204.608] GetProcessHeap () returned 0x236c52e0000 [0204.608] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x18) returned 0x236c5305750 [0204.608] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0204.608] GetProcessHeap () returned 0x236c52e0000 [0204.608] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52f8400) returned 1 [0204.608] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff2ac70000 [0204.724] GetProcAddress (hModule=0x7fff2ac70000, lpProcName="InitHelperDll") returned 0x7fff2ac71100 [0204.724] InitHelperDll () returned 0x0 [0204.724] RegisterHelper () returned 0x0 [0204.724] GetProcessHeap () returned 0x236c52e0000 [0204.724] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x528) returned 0x236c53077e0 [0204.724] GetProcessHeap () returned 0x236c52e0000 [0204.724] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c5305a90) returned 1 [0204.724] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="fwcfg", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0204.724] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0204.724] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0204.724] GetProcessHeap () returned 0x236c52e0000 [0204.724] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x118) returned 0x236c5307d10 [0204.724] GetProcessHeap () returned 0x236c52e0000 [0204.724] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0xc) returned 0x236c5305490 [0204.724] GetProcessHeap () returned 0x236c52e0000 [0204.724] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x14) returned 0x236c5305730 [0204.724] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0204.724] GetProcessHeap () returned 0x236c52e0000 [0204.724] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c52e42e0) returned 1 [0204.724] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff1dea0000 [0204.748] GetProcAddress (hModule=0x7fff1dea0000, lpProcName="InitHelperDll") returned 0x7fff1dea11f0 [0204.748] InitHelperDll () returned 0x0 [0204.748] RegisterHelper () returned 0x0 [0204.748] GetProcessHeap () returned 0x236c52e0000 [0204.748] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x580) returned 0x236c5308e40 [0204.748] GetProcessHeap () returned 0x236c52e0000 [0204.748] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c53077e0) returned 1 [0204.748] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x236c52f0e50, lpcchValueName=0x8bcf7a7290, lpReserved=0x0, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8 | out: lpValueName="hnetmon", lpcchValueName=0x8bcf7a7290, lpType=0x0, lpData=0x236c52e8730, lpcbData=0x8bcf7a72e8) returned 0x0 [0204.748] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0204.749] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0204.749] GetProcessHeap () returned 0x236c52e0000 [0204.749] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x140) returned 0x236c52fac30 [0204.749] GetProcessHeap () returned 0x236c52e0000 [0204.749] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x10) returned 0x236c53058f0 [0204.749] GetProcessHeap () returned 0x236c52e0000 [0204.749] RtlAllocateHeap (HeapHandle=0x236c52e0000, Flags=0x0, Size=0x18) returned 0x236c53055b0 [0204.749] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0204.749] GetProcessHeap () returned 0x236c52e0000 [0204.749] RtlFreeHeap (HeapHandle=0x236c52e0000, Flags=0x0, BaseAddress=0x236c5307d10) returned 1 [0204.749] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) Thread: id = 127 os_tid = 0x8e4 Process: id = "20" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x70a40000" os_pid = "0x998" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xfd0" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001612e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 126 os_tid = 0x96c Thread: id = 128 os_tid = 0x90c Thread: id = 129 os_tid = 0xc80 Thread: id = 134 os_tid = 0xcd8 Thread: id = 135 os_tid = 0xce0